@bobfrankston/rmfmail 1.2.308 → 1.2.309

package/.commitmsg

@@ -1,25 +1,11 @@
-Trusted intermediaries: services that relay mail on other people's behalf
+Trust banner names the intermediary and the action that trusts it
 
-"How do I mark zoom and sites like that as trusted intermediaries?" (Bob
-2026-09-08, on a Google Calendar invitation From the organizer, signed
-d=google.com, every link wrapped as google.com/url?q=us02web.zoom.us). Two
-cautions fired — the server's spam verdict (GOOG_REDIR/KAM_GOOGLE_REDIR) and
-"a link hides where it goes" — and nothing in the app could answer either:
-the sender is not DMARC-proved, so "stop warning about this sender" was not
-offered, and the redirector rule's escape covers only the proved From.
-
-New allowlist.jsonc field `trustedIntermediaries` (e.g. google.com, zoom.us).
-An entry counts only on a message the service PROVABLY handled — a verified
-DKIM signature for its domain in the topmost Authentication-Results, or a
-DMARC pass when it is the From. Then its own redirector is routing, not
-laundering, and the bulk/association spam note is quieted exactly as a
-proved trusted sender quiets it. A message that merely links through
-google.com/url proves nothing and stays flagged; forgery evidence is never
-silenced. Findings now carry `via` (the signer behind the redirector, or the
-signed Sender: domain) and the viewer offers "Trust ‹domain› as an
-intermediary" under the banner; trustSenderOrDomain takes type
-"intermediary" (desktop + Android mirror), getAllowlist returns the list.
-docs/allowlist.md documents trustedSenders/trustedDomains (were missing) and
-the new list. Packages: mailx-types 0.1.83, mailx-store 0.1.115,
-mailx-settings 0.1.77, mailx-service 0.1.34, mailx-store-web 0.1.107,
-client 1.0.46.
+"Is there a 'trust this intermediary' operation or do I need to edit it
+manually? If so the banner should tell which and how" (Bob 2026-09-08). The
+button existed since v1.2.308 but the finding text did not mention it. The
+spam-verdict note now ends with: Sent on the author's behalf by google.com,
+which signed it; "Trust google.com as an intermediary" stops this note for
+mail google.com signs. The redirector warning ends the same way, naming the
+signer — or, when nobody signed for the redirector host, says plainly that
+there is no intermediary to trust and only the sender could vouch for the
+link. mailx-types 0.1.85.

package/client/android-bootstrap.bundle.js

@@ -2392,6 +2392,7 @@ function serverSpamVerdict(input) {
   const senderDomain = (bare(header(input.headerLines, "sender")).split("@")[1] || "").toLowerCase();
   const relay = senderDomain ? a.signers.find((s) => sameOrg(s, senderDomain)) : "";
   const via = relay && !a.proved ? { via: relay } : {};
+  const relayNote = relay && !a.proved ? `. Sent on the author's behalf by ${relay}, which signed it; "Trust ${relay} as an intermediary" stops this note for mail ${relay} signs.` : "";
   const numbers = Number.isFinite(a.score) && Number.isFinite(a.threshold) ? `SpamAssassin score ${a.score} of ${a.threshold}` : "flagged by SpamAssassin";
   const why = a.reasons.length ? ` \u2014 ${a.reasons.join("; ")}` : "";
   const bayes = a.bayesHam ? "; your own trained filter puts it at 0-1% spam (BAYES_00)" : "";
@@ -2428,7 +2429,7 @@ function serverSpamVerdict(input) {
     id: "server-spam-verdict",
     severity: "caution",
     text: "Your mail server classified this as spam before delivering it.",
-    detail: `${proof}${numbers}${why}${bayes}`,
+    detail: `${proof}${numbers}${why}${bayes}${relayNote}`,
     ...via
   };
 }
@@ -2533,11 +2534,12 @@ function redirectorLink(input) {
       if (sameOrg(target.hostname, url.hostname))
         continue;
       const signer = signers.find((s) => sameOrg(s, url.hostname));
+      const how = signer ? ` ${signer} signed this message; "Trust ${signer} as an intermediary" stops this warning for links through ${signer} in mail it signs.` : ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; only the sender could vouch for the link.`;
       return {
         id: "redirector-link",
         severity: "caution",
         text: `A link hides where it goes: it passes through ${url.hostname} and ends at ${target.hostname}.`,
-        detail: `${url.hostname} -> ${target.hostname}`,
+        detail: `${url.hostname} -> ${target.hostname}.${how}`,
         ...signer ? { via: signer } : {}
       };
     }