@bobfrankston/rmfmail 1.2.291 → 1.2.292

package/.commitmsg

@@ -1,31 +1,29 @@
-An approved sender, proved, says nothing at all
+Trusting a sender must not turn on their tracking pixels
 
-Bob 2026-08-28, having just clicked "Always: *@icecer.com" on a conference call
-for papers that still showed a bulk-mail note: "I accepted the server so
-shouldn't this be considered safe?" Yes — and this is the half of C165 that was
-still open. `allowlist.jsonc` has been the approved-sender store all along, and
-nothing consulted it when computing trust.
+Bob 2026-08-28, on a newsletter he subscribed to: "I don't need the spam
+reminder but I don't want to say show remote content in order to prevent
+tracking." He was right, and the shape of the bug is that the allowlist was
+answering two different questions with one list. The only gesture in the whole
+app that said "this correspondent is fine" was the remote-content banner's
+"Always: …", which buys a tracking pixel with every vote of confidence.
 
-`assessMessageTrust` and `spamScoreOf` now take `senderTrusted`, and store.ts
-fills it from the sender and domain lists the reader maintains. When the sender
-is approved AND proved AND nothing accuses it of forgery, the server-spam
-finding is not rendered at all and the score chip goes with it: the score
-answers "is this bulk", the reader has already answered "is it wanted", and
-repeating the first after the second is how a banner becomes furniture.
+Two lists now, both in allowlist.jsonc:
 
-Three boundaries, deliberate:
+  senders / domains                 load their images, and I trust them
+  trustedSenders / trustedDomains   ONLY stop warning me about them
 
-- **Trust never silences forgery evidence.** SPF_FAIL, a DMARC failure, a
-  FORGED_* rule, self-spoof, relay-auth mismatch — all still render, at full
-  severity, on a trusted sender.
-- **Trust counts only where the sender is PROVED** (DMARC, DKIM_VALID_AU, or
-  ALL_TRUSTED). Otherwise the approved-sender list would be a switch a forger
-  flips by typing a trusted address into From. A trusted address that cannot be
-  proved now gets a SHARPER warning than an untrusted one: "This claims to be a
-  sender you trust, but nothing proves it is."
-- **senderTrusted is narrower than allowRemote.** The recipient-alias list says
-  mail reached an address of the reader's, which permits images; it is not a
-  statement about who sent it, and the trust banner asks about the sender.
+Both feed `senderTrusted` in the store; only the first feeds `allowRemote`, and
+that line carries a comment saying why it must never be widened to the second.
 
-The measurement is unchanged — spamScoreOf still reports the score, kind and
-reasons, with `trusted: true` alongside. Only the display goes.
+The trust note gains the action it was missing: **"Stop warning about
+‹address›"** and **"Stop warning about *@‹domain›"**, naming the sender rather
+than saying "this one" so the choice is checkable afterwards. New IPC
+`trustSenderOrDomain` (toggle, like flagSenderOrDomain) wired through all six
+places — service, jsonrpc, web-service, web-jsonrpc, android-bootstrap,
+api-client + mailxapi.js; the bridge-contract guard passes at 110 client calls.
+
+The buttons appear only where the server's own verdict is the WHOLE finding and
+the sender is proved. A forgery banner gets no such button: no list should be
+able to silence "this message is not what it says it is", and there is nothing
+to trust when identity is the thing in doubt. A failed write reports itself on
+the button rather than looking like it worked.

package/client/android-bootstrap.bundle.js

@@ -7013,6 +7013,31 @@ var WebMailxService = class _WebMailxService {
     });
     return { flagged };
   }
+  /** Trust (or untrust) a sender / domain for the spam banner ONLY — no
+   *  remote content. Mirrors MailxService.trustSenderOrDomain; the desktop
+   *  and Android halves must answer "is this sender trusted" the same way or
+   *  the same message reads differently on the phone. */
+  async trustSenderOrDomain(type, value) {
+    const v = (value || "").trim().toLowerCase();
+    if (!v)
+      return { trusted: false };
+    let trusted = false;
+    await updateAllowlist((list) => {
+      const key = type === "sender" ? "trustedSenders" : "trustedDomains";
+      const arr = Array.isArray(list[key]) ? list[key] : [];
+      const idx = arr.findIndex((x) => (x || "").toLowerCase() === v);
+      if (idx >= 0) {
+        arr.splice(idx, 1);
+        trusted = false;
+      } else {
+        arr.push(v);
+        trusted = true;
+      }
+      list[key] = arr;
+      return list;
+    });
+    return { trusted };
+  }
   async updateFlags(accountId, uid, flags) {
     const envelope = this.db.getMessageByUid(accountId, uid);
     await this.syncManager.updateFlagsLocal(accountId, uid, envelope?.folderId || 0, flags);
@@ -7029,7 +7054,9 @@ var WebMailxService = class _WebMailxService {
       domains: list.domains || [],
       recipients: list.recipients || [],
       flaggedSenders: list.flaggedSenders || [],
-      flaggedDomains: list.flaggedDomains || []
+      flaggedDomains: list.flaggedDomains || [],
+      trustedSenders: list.trustedSenders || [],
+      trustedDomains: list.trustedDomains || []
     };
   }
   async allowRemoteContent(type, value) {
@@ -12498,6 +12525,9 @@ function installBridge() {
       return { ok: true };
     },
     getAllowlist: () => service.getAllowlist(),
+    trustSenderOrDomain: async (type, value) => {
+      return await service.trustSenderOrDomain(type, value);
+    },
     flagSenderOrDomain: async (type, value) => {
       return await service.flagSenderOrDomain(type, value);
     },