@bobfrankston/rmfmail 1.2.306 → 1.2.308

package/client/components/message-viewer.ts

@@ -1720,7 +1720,7 @@ export async function showMessage(accountId: string, uid: number, folderId?: num
             bodyEl.appendChild(chip);
         }
 
-        const trust = ((msg as any).trust || []) as { id: string; severity: string; text: string; detail: string }[];
+        const trust = ((msg as any).trust || []) as { id: string; severity: string; text: string; detail: string; via?: string }[];
         if (trust.length) {
             // An `info` finding is not an accusation, so it gets neither the
             // headline nor the "do not open anything" footer — it renders as a
@@ -1796,6 +1796,40 @@ export async function showMessage(accountId: string, uid: number, folderId?: num
                 }
                 warn.appendChild(actions);
             }
+            // "Trust ‹service› as an intermediary" (Bob 2026-09-08: "how do I
+            // mark zoom and sites like that as trusted intermediaries?"). A
+            // finding carries `via` only when a party PROVABLY handled the
+            // message — the DKIM signer behind a google.com/url redirector,
+            // the Sender: domain that signed a calendar invitation on the
+            // organizer's behalf — so the button names a real party, and the
+            // list entry it writes can only ever count on mail that party
+            // signed. Nothing is offered on a danger banner: no list silences
+            // "this message is not what it says it is".
+            const vias = worst === "danger" ? [] : Array.from(new Set(trust.map(f => f.via).filter(Boolean)));
+            if (vias.length) {
+                const actions = document.createElement("div");
+                actions.className = "mv-trust-actions";
+                for (const via of vias) {
+                    const b = document.createElement("button");
+                    b.className = "mv-trust-action";
+                    b.textContent = `Trust ${via} as an intermediary`;
+                    b.addEventListener("click", async () => {
+                        b.disabled = true;
+                        try {
+                            const res = await trustSenderOrDomain("intermediary", via);
+                            if (!res?.trusted) throw new Error("the intermediary list did not save");
+                            warn.remove();
+                            document.querySelector(".mv-spamscore")?.remove();
+                        } catch (e: any) {
+                            // The reader pressed a button and must know whether it took.
+                            b.disabled = false;
+                            b.textContent = `Could not save: ${e?.message || e}`;
+                        }
+                    });
+                    actions.appendChild(b);
+                }
+                warn.appendChild(actions);
+            }
             bodyEl.appendChild(warn);
         }
 

package/client/compose/compose.bundle.js

@@ -1353,7 +1353,7 @@ function trustSenderOrDomain(type, value) {
   return ipc().trustSenderOrDomain?.(type, value) ?? Promise.resolve({ trusted: false });
 }
 function getAllowlist() {
-  return ipc().getAllowlist?.() ?? Promise.resolve({ senders: [], domains: [], recipients: [], flaggedSenders: [], flaggedDomains: [], trustedSenders: [], trustedDomains: [] });
+  return ipc().getAllowlist?.() ?? Promise.resolve({ senders: [], domains: [], recipients: [], flaggedSenders: [], flaggedDomains: [], trustedSenders: [], trustedDomains: [], trustedIntermediaries: [] });
 }
 function flagSenderOrDomain(type, value) {
   return ipc().flagSenderOrDomain?.(type, value) ?? Promise.resolve({ flagged: false });