@bobfrankston/rmfmail 1.2.307 → 1.2.309

package/.commitmsg

@@ -1,20 +1,11 @@
-Google Contacts sync: a renamed contact is now renamed in mailx
+Trust banner names the intermediary and the action that trusts it
 
-"When I gave a name 'Tyler Nichols' why didn't it match 'tyler k nichols'?"
-(Bob 2026-09-06). The matcher was fine: every typed word must appear in the
-name or address. The Gmail row for that contact was stored under its OLD
-Google name "T Nichols", and the People sync never wrote `name` on a google
-row, so a contact renamed in Google kept its first-seen name here forever.
-Worse, the sync's UPDATE ... WHERE email = ? also tried to convert the
-discovered duplicate into a second google row with the same (source, email,
-name) and hit the UNIQUE constraint, so it failed outright — 4,505
-"[contacts] field update failed" lines in one day's log, meaning no contact
-with any mail traffic ever received its card fields either.
-
-New MailxDB.upsertGoogleContact(googleId, name, email, card) owns the google
-row: name and card follow Google on every sync, discovered rows are left
-alone, and stray duplicate google rows for one address are collapsed. The
-People sync calls it instead of recordSentAddress + inline SQL (which also
-inflated use_count on every full sync). A one-time full resync per account
-(kv contacts/resync:<account>) refreshes the names already stored stale.
-Packages: mailx-store 0.1.113, mailx-imap 0.1.174.
+"Is there a 'trust this intermediary' operation or do I need to edit it
+manually? If so the banner should tell which and how" (Bob 2026-09-08). The
+button existed since v1.2.308 but the finding text did not mention it. The
+spam-verdict note now ends with: Sent on the author's behalf by google.com,
+which signed it; "Trust google.com as an intermediary" stops this note for
+mail google.com signs. The redirector warning ends the same way, naming the
+signer — or, when nobody signed for the redirector host, says plainly that
+there is no intermediary to trust and only the sender could vouch for the
+link. mailx-types 0.1.85.

package/client/android-bootstrap.bundle.js

@@ -2250,6 +2250,31 @@ function classifyRule(name, dmarcFailed) {
       return "bulk";
   return "other";
 }
+function dkimSigners(input) {
+  const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+  const out = [];
+  for (const part of auth.split(";")) {
+    if (!/\bdkim=pass\b/i.test(part))
+      continue;
+    const d = (part.match(/header\.d=([^\s;,]+)/i)?.[1] || "").toLowerCase();
+    if (d && !out.includes(d))
+      out.push(d);
+  }
+  return out;
+}
+function provedIntermediary(input) {
+  const list = (input.trustedIntermediaries || []).map((d) => (d || "").trim().toLowerCase()).filter(Boolean);
+  if (!list.length)
+    return "";
+  const proved = dkimSigners(input);
+  const dmarc = dmarcProof(input);
+  if (dmarc.pass && dmarc.domain)
+    proved.push(dmarc.domain);
+  for (const entry of list)
+    if (proved.some((p) => sameOrg(p, entry)))
+      return entry;
+  return "";
+}
 function dmarcProof(input) {
   const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
   if (!auth)
@@ -2340,7 +2365,9 @@ function analyzeServerSpam(input) {
     provedPolicy: dmarc.policy,
     bayesHam: rules.some((r) => r.name === "BAYES_00" || r.name === "BAYES_01"),
     authFailures: dmarc.authFailures,
-    reasons
+    reasons,
+    intermediary: provedIntermediary(input),
+    signers: dkimSigners(input)
   };
 }
 function provedNote(a) {
@@ -2359,9 +2386,13 @@ function serverSpamVerdict(input) {
   const a = analyzeServerSpam(input);
   if (!a || !a.flagged)
     return null;
-  const trustedAndProved = input.senderTrusted && a.proved;
+  const trustedAndProved = input.senderTrusted && a.proved || !!a.intermediary;
   if (trustedAndProved && a.kind !== "forgery" && !a.authFailures.length)
     return null;
+  const senderDomain = (bare(header(input.headerLines, "sender")).split("@")[1] || "").toLowerCase();
+  const relay = senderDomain ? a.signers.find((s) => sameOrg(s, senderDomain)) : "";
+  const via = relay && !a.proved ? { via: relay } : {};
+  const relayNote = relay && !a.proved ? `. Sent on the author's behalf by ${relay}, which signed it; "Trust ${relay} as an intermediary" stops this note for mail ${relay} signs.` : "";
   const numbers = Number.isFinite(a.score) && Number.isFinite(a.threshold) ? `SpamAssassin score ${a.score} of ${a.threshold}` : "flagged by SpamAssassin";
   const why = a.reasons.length ? ` \u2014 ${a.reasons.join("; ")}` : "";
   const bayes = a.bayesHam ? "; your own trained filter puts it at 0-1% spam (BAYES_00)" : "";
@@ -2398,7 +2429,8 @@ function serverSpamVerdict(input) {
     id: "server-spam-verdict",
     severity: "caution",
     text: "Your mail server classified this as spam before delivering it.",
-    detail: `${proof}${numbers}${why}${bayes}`
+    detail: `${proof}${numbers}${why}${bayes}${relayNote}`,
+    ...via
   };
 }
 function selfSpoof(input) {
@@ -2475,6 +2507,8 @@ function provedSenderDomain(input) {
 function redirectorLink(input) {
   const bodyHtml = input.bodyHtml || "";
   const senderDomain = provedSenderDomain(input);
+  const intermediary = provedIntermediary(input);
+  const signers = dkimSigners(input);
   for (const m of bodyHtml.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
     let url;
     try {
@@ -2486,6 +2520,8 @@ function redirectorLink(input) {
       continue;
     if (senderDomain && sameOrg(url.hostname, senderDomain))
       continue;
+    if (intermediary && sameOrg(url.hostname, intermediary))
+      continue;
     for (const [, value] of url.searchParams) {
       let target;
       try {
@@ -2497,11 +2533,14 @@ function redirectorLink(input) {
         continue;
       if (sameOrg(target.hostname, url.hostname))
         continue;
+      const signer = signers.find((s) => sameOrg(s, url.hostname));
+      const how = signer ? ` ${signer} signed this message; "Trust ${signer} as an intermediary" stops this warning for links through ${signer} in mail it signs.` : ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; only the sender could vouch for the link.`;
       return {
         id: "redirector-link",
         severity: "caution",
         text: `A link hides where it goes: it passes through ${url.hostname} and ends at ${target.hostname}.`,
-        detail: `${url.hostname} -> ${target.hostname}`
+        detail: `${url.hostname} -> ${target.hostname}.${how}`,
+        ...signer ? { via: signer } : {}
       };
     }
   }
@@ -2564,7 +2603,7 @@ function spamScoreOf(input) {
     proved: a.proved,
     provedBy: a.provedBy,
     bulkOnly: a.bulkOnly,
-    trusted: !!input.senderTrusted && a.proved && a.kind !== "forgery" && !a.authFailures.length,
+    trusted: (!!input.senderTrusted && a.proved || !!a.intermediary) && a.kind !== "forgery" && !a.authFailures.length,
     reasons: a.reasons
   };
 }
@@ -7099,7 +7138,7 @@ var WebMailxService = class _WebMailxService {
       return { trusted: false };
     let trusted = false;
     await updateAllowlist((list) => {
-      const key = type === "sender" ? "trustedSenders" : "trustedDomains";
+      const key = type === "sender" ? "trustedSenders" : type === "intermediary" ? "trustedIntermediaries" : "trustedDomains";
       const arr = Array.isArray(list[key]) ? list[key] : [];
       const idx = arr.findIndex((x) => (x || "").toLowerCase() === v);
       if (idx >= 0) {
@@ -7132,7 +7171,8 @@ var WebMailxService = class _WebMailxService {
       flaggedSenders: list.flaggedSenders || [],
       flaggedDomains: list.flaggedDomains || [],
       trustedSenders: list.trustedSenders || [],
-      trustedDomains: list.trustedDomains || []
+      trustedDomains: list.trustedDomains || [],
+      trustedIntermediaries: list.trustedIntermediaries || []
     };
   }
   async allowRemoteContent(type, value) {