@bobfrankston/rmfmail 1.2.314 → 1.2.316

package/.commitmsg

@@ -1,27 +1,32 @@
-Self-spoof: a DMARC-proved From is not a spoof, whatever else failed
+New event: spelling suggestions, the right Google account, and a prompt refresh
 
-Bob 2026-09-09, the ISOC Internet Policy list post, red banner "This
-message is not what it says it is — claims to be from your own address,
-internetpolicy@elists.isoc.org, but it did not come from your account.
-DKIM authentication failed". The list rewrote From to itself and signed
-it; iecc.com recorded dkim=pass d=elists.isoc.org and dmarc=pass
-header.from=elists.isoc.org — and dkim=fail for the original author's
-standardstrack.com signature the list had broken. Delivered-To was the
-list address, so it counted as one of Bob's own, and selfSpoof read every
-Authentication-Results and every signature and took the one failure as
-"did not come from your account". One broken signature on a message whose
-From domain passed DMARC aligned is not evidence about the From line; the
-pass is. selfSpoof now returns before the failure scan when dmarcProof
-passes for the actual From domain (a pass for some other domain still
-proves nothing — tested).
+Three from Bob 2026-09-10 on the calendar sidebar's New event dialog.
 
-Measured over the last 120 days: 977 messages whose From is their own
-Delivered-To, 35 self-spoof findings before, 20 after; the 15 cleared are
-all ISOC list posts, the 20 that remain are the sextortion/phish/NDA-scam
-mail the check exists for.
+"Spelling correct didn't work." The main window's right-click handler
+replaced the native WebView2 menu with mailx's Cut/Copy/Paste block on
+every surface — and Chromium's spelling suggestions and "Add to
+dictionary" exist only in the native menu, unreachable from JS. A word in
+the New event box was underlined with no menu that could fix it. Plain
+text controls (TEXTAREA, text-like INPUT) now keep the native menu, which
+already carries Cut/Copy/Paste/Select all for a text field; everything
+else is unchanged. (msger's compose items — Bold, Italic, View source —
+also appear on those fields via its IsEditable gate and forward to the
+compose frame, which is a no-op outside compose; cosmetic, noted.)
 
-Also: a danger banner on a proved-list post now says which list delivered
-it and that trusting the list (right-click the From address) would not
-clear the finding — a red banner with no way forward sends the reader
-hunting (Bob: "right mouse on the From … that's not obvious to the normal
-user"). mailx-types 0.1.90.
+"I just used the add event but don't see them on Google calendar." The
+dialog opens Google Calendar's create page in the browser, which signs in
+as the browser's DEFAULT Google account, not necessarily the one mailx's
+calendar reads. The URL now carries authuser=<primary calendar account
+email> so the event lands where the sidebar looks.
+
+"Creating an event should trigger an immediate update for the calendar
+view." The reader saves the event in the browser; mailx only learned of
+it at the next 5-minute throttled refresh. New refreshCalendarNow IPC
+(service, jsonrpc, mailxapi.js, api-client, MailxApi, Android stub that
+says ok:false) rewinds the throttle once and goes through
+getCalendarEvents, so the in-flight dedup and the calendarUpdated emit
+stay in one place; a 20 s floor of its own keeps it from reopening the
+quota hole the throttle closed. The sidebar arms it after a create: on
+the next window focus, and at 45 s / 2 min / 5 min in case the browser
+sits on another monitor. mailx-types 0.1.93, mailx-service 0.1.36,
+mailx-store-web 0.1.114.

package/.llm/trusted-lists.md

@@ -40,6 +40,10 @@ tests/trust.test.ts, .commitmsg, TODO.md C165, root version 1.2.311. Then rebuil
 ## Follow-up 2026-09-09 evening
 - Button beside the chip ("Trust the ‹List-Id› list"), From-menu item now toggles (Stop trusting…), docs reworded re editing allowlist.jsonc. Danger banners keep no list button: 123/123 proved-list danger cases in 120 days were URL phish/malware listings.
 
+## Self-spoof false positive (found from Bob's screenshot, 2026-09-09 late)
+- ISOC + berglist posts red as "claims to be from your own address": Delivered-To = list address = From, and selfSpoof took ANY dkim=fail in ANY Authentication-Results as proof of forgery. v1.2.314: DMARC-aligned pass vetoes. Next (v1.2.315): alignedPass() — From domain's own SPF pass or DKIM pass vetoes (relaxed alignment for domains with no DMARC policy). Store: 35 → 20 → 15 findings; the 15 are real phish.
+- Danger banner on a proved-list post now names the list and says right-click From / that trust would not clear it.
+
 ## Status
 - [x] trust.ts
 - [x] settings/store/service/web
@@ -47,3 +51,9 @@ tests/trust.test.ts, .commitmsg, TODO.md C165, root version 1.2.311. Then rebuil
 - [x] tests pass (tests/trust.test.ts 40/40)
 - [x] docs/TODO/.commitmsg/versions (v1.2.312)
 - [x] rebuild.cmd — v1.2.312 (feature) + v1.2.313 (chip button + undo toggle) published, APKs built. Restart the app to pick up.
+
+## 2026-09-10 — New event dialog (three items, publishing as one version)
+- Spelling: main-window contextmenu handler (client/app.ts) now leaves the native menu on TEXTAREA / text INPUT — Chromium spelling suggestions live only there.
+- Google account: buildGoogleEventUrl adds authuser=<primary calendar email> (getPrimaryAccount("calendar")).
+- Immediate update: refreshCalendarNow IPC (6 edits) + armPostCreateRefresh() in calendar-sidebar.ts (focus + 45s/2m/5m). Service floor 20s.
+- Status: compiled, bundles built, rebuild.cmd next, then restart.

package/client/android-bootstrap.bundle.js

@@ -2267,6 +2267,23 @@ function dkimSigners(input) {
   }
   return out;
 }
+function alignedPass(input) {
+  const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+  if (!fromDomain)
+    return "";
+  if (dkimSigners(input).some((d) => sameOrg(d, fromDomain)))
+    return "dkim";
+  const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+  for (const part of auth.split(";")) {
+    if (!/\bspf=pass\b/i.test(part))
+      continue;
+    const mailfrom = (part.match(/(?:spf|smtp)\.mailfrom=([^\s;,]+)/i)?.[1] || "").toLowerCase();
+    const domain = mailfrom.includes("@") ? mailfrom.split("@")[1] : mailfrom;
+    if (domain && sameOrg(domain, fromDomain))
+      return "spf";
+  }
+  return "";
+}
 function provedIntermediary(input) {
   const list = (input.trustedIntermediaries || []).map((d) => (d || "").trim().toLowerCase()).filter(Boolean);
   if (!list.length)
@@ -2483,7 +2500,7 @@ function selfSpoof(input) {
   const auth = headerAll(input.headerLines, "authentication-results").join(" ; ");
   if (!auth)
     return null;
-  if (dmarcProof(input).pass)
+  if (dmarcProof(input).pass || alignedPass(input))
     return null;
   const failed = [
     /\bspf=(fail|softfail)\b/i.test(auth) ? "SPF" : "",
@@ -7802,6 +7819,9 @@ var WebMailxService = class _WebMailxService {
   async getCalendarEvents(_fromMs, _toMs) {
     return [];
   }
+  async refreshCalendarNow() {
+    return { ok: false, reason: "no calendar on Android" };
+  }
   async getCalendars() {
     return [];
   }