@bobfrankston/rmfmail 1.2.299 → 1.2.301

package/.commitmsg

@@ -1,53 +1,29 @@
-Laundering needs a second party — a redirector alone is not one
-
-Google's account-security notice, which is exactly the mail a reader must be
-able to believe, carried a caution banner: "A link hides where it goes: it
-passes through accounts.google.com and ends at myaccount.google.com." Both
-halves of that sentence name Google. Bob, on the message:
-`mailxstore/bobma/e1/e193f2bb….eml`, "this is valid."
-
-The check compared `target.hostname === url.hostname` and reported anything
-else. That catches the case it was written for — `castanet-sa.fr/redirect.php
-?newurl=https://evil.example`, someone's abandoned redirect script spending a
-real business's reputation — but the comparison is not what the finding
-claims. Laundering requires a SECOND PARTY, someone whose name is on the
-visible link without their consent. Two ways a link has none, both now checked,
-neither of them a threshold:
-
-  1. The redirector and the destination are the same organisation. Equality
-     widened to the sub/parent-domain test this file already uses twice, now a
-     shared `sameOrg()` — deliberately not "the last two labels match", which
-     would make paypal.co.uk and evil.co.uk relatives.
-
-  2. The redirector IS the sender, proved. accounts.google.com and
-     myaccount.google.com are siblings, so rule 1 does not reach them; what
-     clears the message is that the receiving server recorded `dmarc=pass
-     header.from=accounts.google.com`. The host in the visible link belongs to
-     the party that provably sent the mail. Whether that party is trustworthy
-     is a different question than the one this check asks.
-
-The proof comes from `provedSenderDomain()`, which asks dmarcProof first — an
-Authentication-Results header alone is enough, so this works on Gmail-API mail
-with no SpamAssassin headers — and falls back to the DKIM_VALID_AU /
-ALL_TRUSTED proofs SpamAssassin states in its own rule list. It reads the
-topmost Authentication-Results only, which the sender cannot write. No proof
-means the check stays on: an escape a forger could open by typing a domain
-into From would be worse than no check.
-
-The mirror rule is NOT safe and is deliberately absent. "The link ENDS at the
-proved sender" would clear `legit-bank.com/r?u=https://evil.com` sent from a
-DMARC-proved evil.com, which is the laundering case in its purest form — the
-reader sees the bank's hostname. Only the visible host may be the sender's.
-
-Measured over the 800 most recent messages in the store: redirector-link fires
-15 times before, 4 after. Cleared: Substack's own link wrapper on Substack
-mail (6), Google's alert, Microsoft Teams, dev.to. Still flagged, correctly by
-this rule's terms: Microsoft's Safe Links wrapper (nam.safelink.emails.azure.net
--> admin.microsoft.com, 3) and a donation platform bouncing back to the charity
-that mailed. Those are third-party hostnames in front of the reader, and no
-hostname allowlist is going in to quiet them.
-
-Four tests: the sibling-subdomain case, the Google alert with its proof and
-again with the proof removed, and a forged accounts.google.com whose server
-recorded the DMARC failure — still flagged, as the escape is the server's
-verdict and never the From line's say-so.
+Placing the caret in the body is the same act as taking focus
+
+Ctrl+N opens compose with the cursor in the message body instead of the To
+field (Bob 2026-09-03: "^n (and forward?) still start me in the body rather
+than the to field" — and yes, forward too).
+
+applyInit made the decision twice. First it seeded the body and called
+`editor.setCursor(0)`; twenty lines later it picked the first empty field and
+focused it. Reading top to bottom the second one wins, and it does not:
+`setCursor` is not a caret-placement call, it is a focus call. rmf-tiny's
+implementation ends with `editor.focus()` and then re-runs the whole placement
+inside `requestAnimationFrame` — deliberately, to survive the nested-iframe
+focus race that produced the old "have to click in and try again" symptom — so
+it lands after anything applyInit does synchronously afterwards. Quill's
+`setSelection` focuses as well. Whatever order the two lines were written in,
+the editor was always going to win.
+
+So the two are now one decision, made once and up front: `focusTarget` is the
+first field the user still has to fill, To → Subject → body, and `setCursor` is
+asked for only when the answer is the body. On a reply that is still the body —
+To and Subject are filled, and the call also scrolls the quote out of view so
+the empty line is what's on screen, which is the behaviour it exists for. On a
+forward and on new mail it is the To field, untouched.
+
+Forward has been doing this since it grew a quoted body. Ctrl+N joined it in
+v1.2.298, three hours ago: before the account signature reached compose,
+`bodyToRender` was empty for new mail and the branch holding `setCursor` never
+ran at all. The first message anyone composed with a signature was also the
+first one that opened with the cursor in the wrong place.

package/client/android-bootstrap.bundle.js

@@ -2318,6 +2318,7 @@ function analyzeServerSpam(input) {
   const unknown = rules.filter((r) => r.cls === "other" && scored(r));
   const unknownWeight = unknown.reduce((sum, r) => sum + r.score, 0);
   const unknownCouldFlagAlone = !unknown.length ? false : !Number.isFinite(unknownWeight) || !Number.isFinite(threshold) ? true : unknownWeight >= threshold;
+  const bulkOnly = rules.every((r) => !scored(r) || r.cls === "bulk" || r.cls === "neutral");
   const kind = dmarc.authFailures.length || present("forgery") ? "forgery" : present("association") ? "association" : unknownCouldFlagAlone ? "unclassified" : rules.length ? "bulk" : "unclassified";
   const has = (name) => rules.some((r) => r.name === name);
   const provedBy = dmarc.pass ? "dmarc" : has("DKIM_VALID_AU") ? "dkim" : has("ALL_TRUSTED") ? "trusted" : "";
@@ -2334,6 +2335,7 @@ function analyzeServerSpam(input) {
     kind,
     proved: !!provedBy,
     provedBy,
+    bulkOnly,
     provedDomain: dmarc.domain || fromDomain,
     provedPolicy: dmarc.policy,
     bayesHam: rules.some((r) => r.name === "BAYES_00" || r.name === "BAYES_01"),
@@ -2381,7 +2383,7 @@ function serverSpamVerdict(input) {
     return {
       id: "server-spam-verdict",
       severity: "info",
-      text: "Your mail server rates this bulk mail \u2014 nothing that scored tests who sent it.",
+      text: a.bulkOnly ? "Your mail server rates this bulk mail \u2014 nothing that scored tests who sent it." : "Your mail server rates this bulk mail.",
       detail: `${numbers}${why}${bayes}`
     };
   const proof = a.proved ? `${provedNote(a)} ` : "";
@@ -2561,6 +2563,7 @@ function spamScoreOf(input) {
     kind: a.kind,
     proved: a.proved,
     provedBy: a.provedBy,
+    bulkOnly: a.bulkOnly,
     trusted: !!input.senderTrusted && a.proved && a.kind !== "forgery" && !a.authFailures.length,
     reasons: a.reasons
   };