@bobfrankston/rmfmail 1.2.290 → 1.2.292

package/.commitmsg

@@ -1,39 +1,29 @@
-Spam banner: an unknown rule must be able to condemn on its own
+Trusting a sender must not turn on their tracking pixels
 
-Bob 2026-08-28: "we have a problem since, of course, things like conference
-announcements use bulk mailers." An IEEE/ICECER call for papers, DMARC-proved,
-BAYES_00, scored exactly 4.5 of 4.5 — DCC_CHECK 3.0 + KAM_MARKETINGBL 1.0 +
-**1.5 GB_AWSTRACK_REDIR, Amazon SES's click-tracker** — and the one rule this
-file had never heard of pushed a proved announcement into "Check this message
-before acting on it / Links and attachments here should not be opened".
+Bob 2026-08-28, on a newsletter he subscribed to: "I don't need the spam
+reminder but I don't want to say show remote content in order to prevent
+tracking." He was right, and the shape of the bug is that the allowlist was
+answering two different questions with one list. The only gesture in the whole
+app that said "this correspondent is fine" was the remote-content banner's
+"Always: …", which buys a tracking pixel with every vote of confidence.
 
-The "unknown means caution" policy was right; testing it by PRESENCE was not.
-An unknown rule now keeps a proved sender at caution only when it could have
-flagged the message BY ITSELF — its own scores summed against the server's own
-threshold. That adds no constant to tune: "enough to condemn" already has a
-number and it is the one the server used. KAM_BENEFICIARY, the case the policy
-exists for, is worth 10.0 alone and still cautions; a 1.5 click-tracker cannot.
-Unscored rules (no X-Spam-Report) leave the sum unknown, and unknown stays
-cautious.
+Two lists now, both in allowlist.jsonc:
 
-Two classification fixes found by sampling what still cautioned a PROVED
-sender across the store:
+  senders / domains                 load their images, and I trust them
+  trustedSenders / trustedDomains   ONLY stop warning me about them
 
-- Branded ESP click-trackers (GB_AWSTRACK*, SendGrid, Mailchimp) are bulk-mail
-  machinery. Open redirectors (URI_PHP_REDIR and friends) stay unclassified —
-  a tracking domain the sending platform owns is not an abused redirect.
-- KAM_*URIBL_* ("Body contains URI listed in PCCC WILD RBL", 9.0) and
-  SH_HBL_EMAILS ("Email address listed in email blocklist", 8.0) are the same
-  evidence as URIBL_SBL — somebody else's list about a host the message
-  mentions — and were the bulk of the remaining noise: a Business Insider
-  newsletter, an MIT cancer-center invitation, a campaign mailing.
-  KAM_INFOUSMEBIZ judges the TLD a domain lives in, which is guilt by
-  neighbourhood.
+Both feed `senderTrusted` in the store; only the first feeds `allowRemote`, and
+that line carries a comment saying why it must never be widened to the second.
 
-Over the same 20,308 messages, of 1,131 flagged: 294 danger (unchanged — proof
-never overrides forgery), 278 caution, 559 quiet. What still cautions a proved
-sender is now almost entirely content-scam rules: ADVANCE_FEE, DEAR_BENEFICIARY,
-KAM_CRIM, UNDISC_MONEY, BITCOIN_DIRECT. The two false positives left in that
-set — a Substack news digest about displacement tripping KAM_CRIM, a Qatar
-Airways statement tripping BITCOIN_DIRECT — are exactly what sender trust is
-for, and are deliberately NOT being fixed by inventing more rule exceptions.
+The trust note gains the action it was missing: **"Stop warning about
+‹address›"** and **"Stop warning about *@‹domain›"**, naming the sender rather
+than saying "this one" so the choice is checkable afterwards. New IPC
+`trustSenderOrDomain` (toggle, like flagSenderOrDomain) wired through all six
+places — service, jsonrpc, web-service, web-jsonrpc, android-bootstrap,
+api-client + mailxapi.js; the bridge-contract guard passes at 110 client calls.
+
+The buttons appear only where the server's own verdict is the WHOLE finding and
+the sender is proved. A forgery banner gets no such button: no list should be
+able to silence "this message is not what it says it is", and there is nothing
+to trust when identity is the thing in doubt. A failed write reports itself on
+the button rather than looking like it worked.

package/client/android-bootstrap.bundle.js

@@ -2350,6 +2350,9 @@ function serverSpamVerdict(input) {
   const a = analyzeServerSpam(input);
   if (!a || !a.flagged)
     return null;
+  const trustedAndProved = input.senderTrusted && a.proved;
+  if (trustedAndProved && a.kind !== "forgery" && !a.authFailures.length)
+    return null;
   const numbers = Number.isFinite(a.score) && Number.isFinite(a.threshold) ? `SpamAssassin score ${a.score} of ${a.threshold}` : "flagged by SpamAssassin";
   const why = a.reasons.length ? ` \u2014 ${a.reasons.join("; ")}` : "";
   const bayes = a.bayesHam ? "; your own trained filter puts it at 0-1% spam (BAYES_00)" : "";
@@ -2375,6 +2378,13 @@ function serverSpamVerdict(input) {
       detail: `${numbers}${why}${bayes}`
     };
   const proof = a.proved ? `${provedNote(a)} ` : "";
+  if (input.senderTrusted && !a.proved)
+    return {
+      id: "server-spam-verdict",
+      severity: "caution",
+      text: "This claims to be a sender you trust, but nothing proves it is.",
+      detail: `No DMARC pass, no valid signature from the sending domain, and it passed through hosts your server does not trust. ${numbers}${why}`
+    };
   return {
     id: "server-spam-verdict",
     severity: "caution",
@@ -2534,6 +2544,7 @@ function spamScoreOf(input) {
     kind: a.kind,
     proved: a.proved,
     provedBy: a.provedBy,
+    trusted: !!input.senderTrusted && a.proved && a.kind !== "forgery" && !a.authFailures.length,
     reasons: a.reasons
   };
 }
@@ -7002,6 +7013,31 @@ var WebMailxService = class _WebMailxService {
     });
     return { flagged };
   }
+  /** Trust (or untrust) a sender / domain for the spam banner ONLY — no
+   *  remote content. Mirrors MailxService.trustSenderOrDomain; the desktop
+   *  and Android halves must answer "is this sender trusted" the same way or
+   *  the same message reads differently on the phone. */
+  async trustSenderOrDomain(type, value) {
+    const v = (value || "").trim().toLowerCase();
+    if (!v)
+      return { trusted: false };
+    let trusted = false;
+    await updateAllowlist((list) => {
+      const key = type === "sender" ? "trustedSenders" : "trustedDomains";
+      const arr = Array.isArray(list[key]) ? list[key] : [];
+      const idx = arr.findIndex((x) => (x || "").toLowerCase() === v);
+      if (idx >= 0) {
+        arr.splice(idx, 1);
+        trusted = false;
+      } else {
+        arr.push(v);
+        trusted = true;
+      }
+      list[key] = arr;
+      return list;
+    });
+    return { trusted };
+  }
   async updateFlags(accountId, uid, flags) {
     const envelope = this.db.getMessageByUid(accountId, uid);
     await this.syncManager.updateFlagsLocal(accountId, uid, envelope?.folderId || 0, flags);
@@ -7018,7 +7054,9 @@ var WebMailxService = class _WebMailxService {
       domains: list.domains || [],
       recipients: list.recipients || [],
       flaggedSenders: list.flaggedSenders || [],
-      flaggedDomains: list.flaggedDomains || []
+      flaggedDomains: list.flaggedDomains || [],
+      trustedSenders: list.trustedSenders || [],
+      trustedDomains: list.trustedDomains || []
     };
   }
   async allowRemoteContent(type, value) {
@@ -12487,6 +12525,9 @@ function installBridge() {
       return { ok: true };
     },
     getAllowlist: () => service.getAllowlist(),
+    trustSenderOrDomain: async (type, value) => {
+      return await service.trustSenderOrDomain(type, value);
+    },
     flagSenderOrDomain: async (type, value) => {
       return await service.flagSenderOrDomain(type, value);
     },