@bobfrankston/rmfmail 1.2.291 → 1.2.293

package/.commitmsg

@@ -1,31 +1,28 @@
-An approved sender, proved, says nothing at all
+The allowlist merge silently dropped any list it had not been taught
 
-Bob 2026-08-28, having just clicked "Always: *@icecer.com" on a conference call
-for papers that still showed a bulk-mail note: "I accepted the server so
-shouldn't this be considered safe?" Yes — and this is the half of C165 that was
-still open. `allowlist.jsonc` has been the approved-sender store all along, and
-nothing consulted it when computing trust.
+Caught by driving the button from v1.2.292: pressing "Stop warning about
+*@digital.conservativeintel.com" returned `{trusted: true}`, the banner
+disappeared — and nothing was written. `trustedDomains` was empty on readback
+and absent from allowlist.jsonc.
 
-`assessMessageTrust` and `spamScoreOf` now take `senderTrusted`, and store.ts
-fills it from the sender and domain lists the reader maintains. When the sender
-is approved AND proved AND nothing accuses it of forgery, the server-spam
-finding is not rendered at all and the score chip goes with it: the score
-answers "is this bulk", the reader has already answered "is it wanted", and
-repeating the first after the second is how a banner becomes furniture.
+Cause: `saveAllowlist` merges the local copy with the cloud one so a second
+machine's entries survive, and that merge rebuilt the result from a HARDCODED
+list of the five fields it knew. The two lists added earlier the same day were
+dropped on the way to disk, with a success return the whole way up. A merge
+that must be taught each new field will keep losing the next one.
 
-Three boundaries, deliberate:
+- `mergeAllowlists(local, cloud)` — extracted, exported, and tested — unions
+  every field present in either copy, discovering names at runtime. Arrays
+  union; anything else prefers the local side, since the caller is the one
+  making a change; no key either side has is ever dropped. That last property
+  is what keeps a second machine's entries alive and what saved this file in
+  the 2026-07-23 wipe.
+- `DEFAULT_ALLOWLIST` names trustedSenders/trustedDomains on both the desktop
+  and Android sides, so a fresh file has them.
+- The banner button no longer trusts a bare resolve: it only ever ADDS, so
+  anything but `trusted: true` is a failed write, and it says so on the button
+  instead of removing a banner that will come back. That check is what would
+  have caught this bug at the UI instead of at a grep of the JSON.
 
-- **Trust never silences forgery evidence.** SPF_FAIL, a DMARC failure, a
-  FORGED_* rule, self-spoof, relay-auth mismatch — all still render, at full
-  severity, on a trusted sender.
-- **Trust counts only where the sender is PROVED** (DMARC, DKIM_VALID_AU, or
-  ALL_TRUSTED). Otherwise the approved-sender list would be a switch a forger
-  flips by typing a trusted address into From. A trusted address that cannot be
-  proved now gets a SHARPER warning than an untrusted one: "This claims to be a
-  sender you trust, but nothing proves it is."
-- **senderTrusted is narrower than allowRemote.** The recipient-alias list says
-  mail reached an address of the reader's, which permits images; it is not a
-  statement about who sent it, and the trust banner asks about the sender.
-
-The measurement is unchanged — spamScoreOf still reports the score, kind and
-reasons, with `trusted: true` alongside. Only the display goes.
+tests/allowlist-merge.test.ts covers the shape that loses data, including a
+field named nowhere in the code.

package/client/android-bootstrap.bundle.js

@@ -4122,7 +4122,9 @@ var init_web_settings = __esm({
       domains: [],
       recipients: [],
       flaggedSenders: [],
-      flaggedDomains: []
+      flaggedDomains: [],
+      trustedSenders: [],
+      trustedDomains: []
     };
     PREV_KEEP = 5;
     SHARED_REFRESH_MS = 5 * 6e4;
@@ -7013,6 +7015,31 @@ var WebMailxService = class _WebMailxService {
     });
     return { flagged };
   }
+  /** Trust (or untrust) a sender / domain for the spam banner ONLY — no
+   *  remote content. Mirrors MailxService.trustSenderOrDomain; the desktop
+   *  and Android halves must answer "is this sender trusted" the same way or
+   *  the same message reads differently on the phone. */
+  async trustSenderOrDomain(type, value) {
+    const v = (value || "").trim().toLowerCase();
+    if (!v)
+      return { trusted: false };
+    let trusted = false;
+    await updateAllowlist((list) => {
+      const key = type === "sender" ? "trustedSenders" : "trustedDomains";
+      const arr = Array.isArray(list[key]) ? list[key] : [];
+      const idx = arr.findIndex((x) => (x || "").toLowerCase() === v);
+      if (idx >= 0) {
+        arr.splice(idx, 1);
+        trusted = false;
+      } else {
+        arr.push(v);
+        trusted = true;
+      }
+      list[key] = arr;
+      return list;
+    });
+    return { trusted };
+  }
   async updateFlags(accountId, uid, flags) {
     const envelope = this.db.getMessageByUid(accountId, uid);
     await this.syncManager.updateFlagsLocal(accountId, uid, envelope?.folderId || 0, flags);
@@ -7029,7 +7056,9 @@ var WebMailxService = class _WebMailxService {
       domains: list.domains || [],
       recipients: list.recipients || [],
       flaggedSenders: list.flaggedSenders || [],
-      flaggedDomains: list.flaggedDomains || []
+      flaggedDomains: list.flaggedDomains || [],
+      trustedSenders: list.trustedSenders || [],
+      trustedDomains: list.trustedDomains || []
     };
   }
   async allowRemoteContent(type, value) {
@@ -12498,6 +12527,9 @@ function installBridge() {
       return { ok: true };
     },
     getAllowlist: () => service.getAllowlist(),
+    trustSenderOrDomain: async (type, value) => {
+      return await service.trustSenderOrDomain(type, value);
+    },
     flagSenderOrDomain: async (type, value) => {
       return await service.flagSenderOrDomain(type, value);
     },