@bobfrankston/rmfmail 1.2.291 → 1.2.293

package/client/components/message-viewer.ts

@@ -9,7 +9,7 @@
  * drift impossible: there is exactly one path into this pane.
  */
 
-import { getMessage, updateFlags, allowRemoteContent, flagSenderOrDomain, getAttachment, openAttachment, getMessageSource, addContact, listContacts, upsertContact, unsubscribeOneClick, addPreferredContact, onEvent, subscribeStore } from "../lib/api-client.js";
+import { getMessage, updateFlags, allowRemoteContent, flagSenderOrDomain, trustSenderOrDomain, getAttachment, openAttachment, getMessageSource, addContact, listContacts, upsertContact, unsubscribeOneClick, addPreferredContact, onEvent, subscribeStore } from "../lib/api-client.js";
 import { isSenderApproved, noteApprovedLocally, refreshApprovedSenders } from "../lib/approved-senders.js";
 import { buildInviteCard } from "./invite-card.js";
 import { showContextMenu } from "./context-menu.js";
@@ -1730,6 +1730,59 @@ export async function showMessage(accountId: string, uid: number, folderId?: num
                     `</div>`).join("") +
                 (worst === "info" ? ""
                     : `<div class="mv-trust-foot">Links and attachments here should not be opened.</div>`);
+
+            // "Stop warning me about this sender" — the action the note was
+            // missing. Bob 2026-08-28: "I don't need the spam reminder but I
+            // don't want to say show remote content in order to prevent
+            // tracking." Until now the only way to vouch for a sender was the
+            // remote-content banner, which turns on their tracking pixels; this
+            // writes the separate trustedSenders/trustedDomains list instead.
+            //
+            // Offered only where the server's own verdict is the whole finding
+            // and the sender is proved. A forgery banner has no such button: no
+            // list should be able to silence "this message is not what it says
+            // it is", and there is nothing to trust when the identity is the
+            // thing in doubt.
+            const spamOnly = trust.length === 1 && trust[0].id === "server-spam-verdict" && worst !== "danger";
+            const fromAddr = (msg.from?.address || "").toLowerCase();
+            const fromDomain = fromAddr.split("@")[1] || "";
+            if (spamOnly && spam?.proved && fromAddr) {
+                const actions = document.createElement("div");
+                actions.className = "mv-trust-actions";
+                // Name the sender in the label — a button that says "trust" with
+                // no object tells the reader nothing they can verify later.
+                for (const [label, type, value] of [
+                    [`Stop warning about ${fromAddr}`, "sender", fromAddr],
+                    [`Stop warning about *@${fromDomain}`, "domain", fromDomain],
+                ] as const) {
+                    if (!value) continue;
+                    const b = document.createElement("button");
+                    b.className = "mv-trust-action";
+                    b.textContent = label;
+                    b.addEventListener("click", async () => {
+                        b.disabled = true;
+                        try {
+                            // The button only ever ADDS, so anything but
+                            // `trusted: true` means the write did not land —
+                            // a missing bridge method, a merge that dropped
+                            // the list (2026-08-28), a refused cloud write.
+                            // Removing the banner on a failed save is the
+                            // worst outcome: it looks saved and comes back.
+                            const res = await trustSenderOrDomain(type, value);
+                            if (!res?.trusted) throw new Error("the sender list did not save");
+                            warn.remove();
+                            document.querySelector(".mv-spamscore")?.remove();
+                        } catch (e: any) {
+                            // Never fail silently: the reader pressed a button
+                            // and must know whether it took.
+                            b.disabled = false;
+                            b.textContent = `Could not save: ${e?.message || e}`;
+                        }
+                    });
+                    actions.appendChild(b);
+                }
+                warn.appendChild(actions);
+            }
             bodyEl.appendChild(warn);
         }
 

package/client/compose/compose.bundle.js

@@ -1122,6 +1122,7 @@ __export(api_client_exports, {
   syncAccount: () => syncAccount,
   syncFolderNow: () => syncFolderNow,
   triggerSync: () => triggerSync,
+  trustSenderOrDomain: () => trustSenderOrDomain,
   undeleteMessage: () => undeleteMessage,
   unsubscribeOneClick: () => unsubscribeOneClick,
   updateCalendarEvent: () => updateCalendarEvent,
@@ -1348,8 +1349,11 @@ function addUserDictWords(words) {
 function removeUserDictWord(word) {
   return ipc().removeUserDictWord?.(word) ?? Promise.resolve([]);
 }
+function trustSenderOrDomain(type, value) {
+  return ipc().trustSenderOrDomain?.(type, value) ?? Promise.resolve({ trusted: false });
+}
 function getAllowlist() {
-  return ipc().getAllowlist?.() ?? Promise.resolve({ senders: [], domains: [], recipients: [], flaggedSenders: [], flaggedDomains: [] });
+  return ipc().getAllowlist?.() ?? Promise.resolve({ senders: [], domains: [], recipients: [], flaggedSenders: [], flaggedDomains: [], trustedSenders: [], trustedDomains: [] });
 }
 function flagSenderOrDomain(type, value) {
   return ipc().flagSenderOrDomain?.(type, value) ?? Promise.resolve({ flagged: false });