@bobfrankston/rmfmail 1.2.306 → 1.2.308

package/.commitmsg

@@ -1,13 +1,25 @@
-Pop-out window: Ctrl+wheel and Ctrl+= / Ctrl+- / Ctrl+0 now zoom the window
+Trusted intermediaries: services that relay mail on other people's behalf
 
-"The wheel didn't work in a popped out window. It did work in the main preview
-window" (Bob 2026-09-06). The separate-OS-window pop-out (bin/popout-server.ts)
-renders the letter in a sandboxed iframe. msger's own zoom handler is injected
-into every frame and posts its request over window.ipc, but wry only listens
-to the top-level document's WebMessageReceived, so a request posted from the
-body frame was silently dropped after the handler had already preventDefault'd
-the gesture: no zoom, no error. The body page now forwards Ctrl+wheel and the
-zoom keys to the parent page (postMessage `popout-zoom`), which re-dispatches
-them as real events on the top-level document so the host applies its zoom.
-The page never learns msger's IPC protocol. The in-window overlay pop-out was
-already fine (it installs the viewer's own zoom controls).
+"How do I mark zoom and sites like that as trusted intermediaries?" (Bob
+2026-09-08, on a Google Calendar invitation From the organizer, signed
+d=google.com, every link wrapped as google.com/url?q=us02web.zoom.us). Two
+cautions fired — the server's spam verdict (GOOG_REDIR/KAM_GOOGLE_REDIR) and
+"a link hides where it goes" — and nothing in the app could answer either:
+the sender is not DMARC-proved, so "stop warning about this sender" was not
+offered, and the redirector rule's escape covers only the proved From.
+
+New allowlist.jsonc field `trustedIntermediaries` (e.g. google.com, zoom.us).
+An entry counts only on a message the service PROVABLY handled — a verified
+DKIM signature for its domain in the topmost Authentication-Results, or a
+DMARC pass when it is the From. Then its own redirector is routing, not
+laundering, and the bulk/association spam note is quieted exactly as a
+proved trusted sender quiets it. A message that merely links through
+google.com/url proves nothing and stays flagged; forgery evidence is never
+silenced. Findings now carry `via` (the signer behind the redirector, or the
+signed Sender: domain) and the viewer offers "Trust ‹domain› as an
+intermediary" under the banner; trustSenderOrDomain takes type
+"intermediary" (desktop + Android mirror), getAllowlist returns the list.
+docs/allowlist.md documents trustedSenders/trustedDomains (were missing) and
+the new list. Packages: mailx-types 0.1.83, mailx-store 0.1.115,
+mailx-settings 0.1.77, mailx-service 0.1.34, mailx-store-web 0.1.107,
+client 1.0.46.

package/client/android-bootstrap.bundle.js

@@ -2250,6 +2250,31 @@ function classifyRule(name, dmarcFailed) {
       return "bulk";
   return "other";
 }
+function dkimSigners(input) {
+  const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+  const out = [];
+  for (const part of auth.split(";")) {
+    if (!/\bdkim=pass\b/i.test(part))
+      continue;
+    const d = (part.match(/header\.d=([^\s;,]+)/i)?.[1] || "").toLowerCase();
+    if (d && !out.includes(d))
+      out.push(d);
+  }
+  return out;
+}
+function provedIntermediary(input) {
+  const list = (input.trustedIntermediaries || []).map((d) => (d || "").trim().toLowerCase()).filter(Boolean);
+  if (!list.length)
+    return "";
+  const proved = dkimSigners(input);
+  const dmarc = dmarcProof(input);
+  if (dmarc.pass && dmarc.domain)
+    proved.push(dmarc.domain);
+  for (const entry of list)
+    if (proved.some((p) => sameOrg(p, entry)))
+      return entry;
+  return "";
+}
 function dmarcProof(input) {
   const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
   if (!auth)
@@ -2340,7 +2365,9 @@ function analyzeServerSpam(input) {
     provedPolicy: dmarc.policy,
     bayesHam: rules.some((r) => r.name === "BAYES_00" || r.name === "BAYES_01"),
     authFailures: dmarc.authFailures,
-    reasons
+    reasons,
+    intermediary: provedIntermediary(input),
+    signers: dkimSigners(input)
   };
 }
 function provedNote(a) {
@@ -2359,9 +2386,12 @@ function serverSpamVerdict(input) {
   const a = analyzeServerSpam(input);
   if (!a || !a.flagged)
     return null;
-  const trustedAndProved = input.senderTrusted && a.proved;
+  const trustedAndProved = input.senderTrusted && a.proved || !!a.intermediary;
   if (trustedAndProved && a.kind !== "forgery" && !a.authFailures.length)
     return null;
+  const senderDomain = (bare(header(input.headerLines, "sender")).split("@")[1] || "").toLowerCase();
+  const relay = senderDomain ? a.signers.find((s) => sameOrg(s, senderDomain)) : "";
+  const via = relay && !a.proved ? { via: relay } : {};
   const numbers = Number.isFinite(a.score) && Number.isFinite(a.threshold) ? `SpamAssassin score ${a.score} of ${a.threshold}` : "flagged by SpamAssassin";
   const why = a.reasons.length ? ` \u2014 ${a.reasons.join("; ")}` : "";
   const bayes = a.bayesHam ? "; your own trained filter puts it at 0-1% spam (BAYES_00)" : "";
@@ -2398,7 +2428,8 @@ function serverSpamVerdict(input) {
     id: "server-spam-verdict",
     severity: "caution",
     text: "Your mail server classified this as spam before delivering it.",
-    detail: `${proof}${numbers}${why}${bayes}`
+    detail: `${proof}${numbers}${why}${bayes}`,
+    ...via
   };
 }
 function selfSpoof(input) {
@@ -2475,6 +2506,8 @@ function provedSenderDomain(input) {
 function redirectorLink(input) {
   const bodyHtml = input.bodyHtml || "";
   const senderDomain = provedSenderDomain(input);
+  const intermediary = provedIntermediary(input);
+  const signers = dkimSigners(input);
   for (const m of bodyHtml.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
     let url;
     try {
@@ -2486,6 +2519,8 @@ function redirectorLink(input) {
       continue;
     if (senderDomain && sameOrg(url.hostname, senderDomain))
       continue;
+    if (intermediary && sameOrg(url.hostname, intermediary))
+      continue;
     for (const [, value] of url.searchParams) {
       let target;
       try {
@@ -2497,11 +2532,13 @@ function redirectorLink(input) {
         continue;
       if (sameOrg(target.hostname, url.hostname))
         continue;
+      const signer = signers.find((s) => sameOrg(s, url.hostname));
       return {
         id: "redirector-link",
         severity: "caution",
         text: `A link hides where it goes: it passes through ${url.hostname} and ends at ${target.hostname}.`,
-        detail: `${url.hostname} -> ${target.hostname}`
+        detail: `${url.hostname} -> ${target.hostname}`,
+        ...signer ? { via: signer } : {}
       };
     }
   }
@@ -2564,7 +2601,7 @@ function spamScoreOf(input) {
     proved: a.proved,
     provedBy: a.provedBy,
     bulkOnly: a.bulkOnly,
-    trusted: !!input.senderTrusted && a.proved && a.kind !== "forgery" && !a.authFailures.length,
+    trusted: (!!input.senderTrusted && a.proved || !!a.intermediary) && a.kind !== "forgery" && !a.authFailures.length,
     reasons: a.reasons
   };
 }
@@ -7099,7 +7136,7 @@ var WebMailxService = class _WebMailxService {
       return { trusted: false };
     let trusted = false;
     await updateAllowlist((list) => {
-      const key = type === "sender" ? "trustedSenders" : "trustedDomains";
+      const key = type === "sender" ? "trustedSenders" : type === "intermediary" ? "trustedIntermediaries" : "trustedDomains";
       const arr = Array.isArray(list[key]) ? list[key] : [];
       const idx = arr.findIndex((x) => (x || "").toLowerCase() === v);
       if (idx >= 0) {
@@ -7132,7 +7169,8 @@ var WebMailxService = class _WebMailxService {
       flaggedSenders: list.flaggedSenders || [],
       flaggedDomains: list.flaggedDomains || [],
       trustedSenders: list.trustedSenders || [],
-      trustedDomains: list.trustedDomains || []
+      trustedDomains: list.trustedDomains || [],
+      trustedIntermediaries: list.trustedIntermediaries || []
     };
   }
   async allowRemoteContent(type, value) {