@bobfrankston/rmfmail 1.2.282 → 1.2.283

package/client/components/message-viewer.ts

@@ -1652,26 +1652,27 @@ export async function showMessage(accountId: string, uid: number, folderId?: num
         // it can be checked rather than believed. (Claude Code 2026-08-25)
         bodyEl.innerHTML = "";
 
-        // The server's spam score, shown whether or not it crossed the line
-        // (Bob 2026-08-25: "should we have a flag ... with the spam assassin
-        // number and a color code?"). The sextortion mail that prompted this
-        // scored 2.7 against a 4.5 threshold — under the wire, so nothing was
-        // flagged, but "did not quite trip it" is not the same as clean and
-        // the reader deserves the number rather than a silent pass.
+        // The server's spam score — shown ONLY when it is high enough to mean
+        // something (Bob 2026-08-25: "only show the spam score if it is high
+        // and likely"). The first cut put a chip on every message that carried
+        // a score, which is nearly all of them: a badge that is always present
+        // carries no information and becomes furniture the eye stops reading.
         //
-        // The colour is a PROPORTION of the server's own threshold, not a
-        // constant: red once the server flagged it, amber past halfway to its
-        // line, quiet below. If the server's threshold changes, this follows.
+        // The floor is halfway to the SERVER'S OWN threshold, so it is a
+        // proportion rather than a constant and follows if that threshold ever
+        // changes. Halfway is where "did not quite trip the wire" starts being
+        // a different statement from "clean" — the sextortion mail that
+        // prompted all of this scored 2.7 against 4.5 and was delivered
+        // unflagged, so showing only the flagged ones would miss exactly the
+        // case worth showing.
         const spam = (msg as any).spamScore as { score: number; threshold: number; flagged: boolean };
-        if (spam && Number.isFinite(spam.score)) {
-            const level = spam.flagged ? "high" : (spam.score >= spam.threshold / 2 ? "mid" : "low");
+        if (spam && Number.isFinite(spam.score) && (spam.flagged || spam.score >= spam.threshold / 2)) {
+            const level = spam.flagged ? "high" : "mid";
             const chip = document.createElement("div");
             chip.className = `mv-spamscore mv-spamscore-${level}`;
             chip.title = level === "high"
                 ? "Your mail server scored this at or above its spam threshold and flagged it."
-                : level === "mid"
-                    ? "Below your server's spam threshold, but more than halfway to it."
-                    : "Well below your mail server's spam threshold.";
+                : "Below your server's spam threshold, but more than halfway to it.";
             chip.textContent = `spam score ${spam.score} of ${spam.threshold}`;
             bodyEl.appendChild(chip);
         }

package/client/styles/components.css

@@ -2977,10 +2977,12 @@ body.calendar-sidebar-on .calendar-sidebar { display: flex; }
     opacity: 0.9;
 }
 
-/* Receiving server's spam score — always shown when the server left one, so a
-   below-threshold score is visible instead of silently passing. Colour is a
-   proportion of the server's own threshold (see message-viewer), which is why
-   there is no number hardcoded here. (Claude Code 2026-08-25) */
+/* Receiving server's spam score. Rendered only when the score is at least
+   halfway to the server's own threshold — a chip on every message is furniture
+   the eye stops reading (Bob 2026-08-25: "only show the spam score if it is
+   high and likely"). Two levels only, because anything quieter never renders
+   at all. The cutoff is a proportion, computed in message-viewer, which is why
+   no number appears here. (Claude Code 2026-08-25) */
 .mv-spamscore {
     display: inline-block;
     margin: 0 0 var(--gap-sm) 0;
@@ -2990,6 +2992,5 @@ body.calendar-sidebar-on .calendar-sidebar { display: flex; }
     font-family: var(--font-mono, ui-monospace, monospace);
     letter-spacing: 0.01em;
 }
-.mv-spamscore-low  { background: var(--color-bg-alt, #eee); color: var(--color-text-muted, #666); }
 .mv-spamscore-mid  { background: oklch(0.55 0.18 50); color: white; font-weight: 600; }
 .mv-spamscore-high { background: oklch(0.42 0.20 25); color: white; font-weight: 700; }

package/npmchanges.md

@@ -703,3 +703,68 @@ tests/trust.test.ts pins both phishes and, as importantly, the negative cases:
 a self-sent note with no auth headers, SPF failure on mail not claiming to be
 you, a modest image map, a same-site return-path parameter, and ordinary mail.
 
+## v1.2.282 — 2026-08-25
+
+Catch the spam that scores under the threshold
+
+A sextortion mail arrived that none of yesterday's checks caught ("yet this
+spam got through"). SpamAssassin scored it 2.7 against a 4.5 threshold and
+delivered it, so server-spam-verdict correctly stayed silent — the server said
+no. Three independent proofs of forgery were sitting in the message anyway.
+
+spf=none now counts as "not authenticated" for self-claimed mail, not just
+fail. bobf.frankston.com publishes no SPF record, so nothing sent as that
+domain can ever FAIL — only come back none. Treating none as neutral left the
+least-protected domain the least defended, which is backwards. Checked against
+the real store before changing it, 50,000 messages scanned:
+
+  From at one of Bob's domains          10,338
+    no Authentication-Results           10,034   <- his own mail, still ignored
+    spf=pass                               243   <- still ignored
+    spf=fail / softfail                     33
+    spf=none                                18   <- nearly all spam
+
+The 18 were "Settle your debt", "AAA Final notice", "McAfee Protection Plan
+Ended" and similar. Legitimate self-mail sits in the no-header group: it never
+crossed a trust boundary, so there is no Authentication-Results to read, and
+that case is untouched. An explicit spf/dkim/dmarc=pass still silences the
+check.
+
+relay-auth-mismatch — Bob's own catch: "note that the origin is different than
+the from domain in antiabuse and in source-auth".
+
+  From:          universe@bobf.frankston.com
+  X-Source-Auth: admin@calebjross.com
+  X-Source-Cap:  (base64) calebjro;calebjro;box2202.bluehost.com
+  Message-ID:    <...@calebjross.com>
+
+A Bluehost cPanel account belonging to an unrelated domain authenticated and
+sent mail wearing his address. That stamp is written by the RELAY, downstream
+of whoever submitted the message, so a forger cannot remove or edit it — which
+makes the disagreement about as close to proof as mail headers get. Compared at
+the registrable-domain level, since a host legitimately sending for a domain
+authenticates as some account AT that domain and the local part varies for
+ordinary reasons. Covers the cPanel/Exim, Postfix and Communigate spellings.
+
+zero-width-obfuscation — the body had ~1380 zero-width characters stuffed
+between letters, so "i regret to inform you" reached every word-matching filter
+as gibberish while rendering as clean prose. SpamAssassin saw it
+(UNICODE_OBFU_ZW_MANY) and still totalled only 2.7. Counted only BETWEEN TWO
+LATIN LETTERS, which is what obfuscation looks like and what the legitimate
+uses are not: an emoji ZWJ joins pictographs, Arabic and Indic ZWNJ sit between
+their own scripts' letters. The occurrence count guards against a stray
+character surviving a copy-paste; it is a sanity bound, not a sensitivity dial.
+
+The score itself is now always visible — a chip above the body reading "spam
+score 2.7 of 4.5" ("should we have a flag ... with the spam assassin number and
+a color code?"). Separate from the findings on purpose: a finding is an
+accusation and fires only on evidence, this is a measurement. Colour is a
+PROPORTION of the server's own threshold — red once flagged, amber past halfway
+to its line, quiet below — so it follows if the server's threshold changes
+rather than hardcoding a number. Viewer only for now; the message-list row
+would need the score stored at sync time.
+
+tests/trust.test.ts covers all three, and the negative cases with them: spf=pass
+and no-header both silent, a relay identity at the same organisation, an emoji
+ZWJ family sequence, and a stray zero-width character from a paste.
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/rmfmail",
-  "version": "1.2.282",
+  "version": "1.2.283",
   "description": "Local-first email client with IMAP sync and standalone native app",
   "type": "module",
   "main": "bin/mailx.js",
@@ -34,8 +34,8 @@
   "dependencies": {
     "@bobfrankston/iflow-direct": "^0.1.65",
     "@bobfrankston/mailx-host": "^0.1.15",
-    "@bobfrankston/mailx-imap": "^0.1.159",
-    "@bobfrankston/mailx-store-web": "^0.1.87",
+    "@bobfrankston/mailx-imap": "^0.1.160",
+    "@bobfrankston/mailx-store-web": "^0.1.88",
     "@bobfrankston/mailx-sync": "^0.1.29",
     "@bobfrankston/miscinfo": "^1.0.20",
     "@bobfrankston/msger": "^0.1.429",
@@ -116,8 +116,8 @@
     "dependencies": {
       "@bobfrankston/iflow-direct": "^0.1.65",
       "@bobfrankston/mailx-host": "^0.1.15",
-      "@bobfrankston/mailx-imap": "^0.1.159",
-      "@bobfrankston/mailx-store-web": "^0.1.87",
+      "@bobfrankston/mailx-imap": "^0.1.160",
+      "@bobfrankston/mailx-store-web": "^0.1.88",
       "@bobfrankston/mailx-sync": "^0.1.29",
       "@bobfrankston/miscinfo": "^1.0.20",
       "@bobfrankston/msger": "^0.1.429",