@bobfrankston/rmfmail 1.2.321 → 1.2.322

package/.commitmsg

@@ -1,10 +1,27 @@
-Compose: a thin 3 cm rule above the signature instead of "-- "
+Trust a sender via the relay that signs for it ("groundnews.email via amazonses.com")
 
-Bob 2026-09-10: "you seem to be putting a -- above the signature. If I
-want it it should be part of my HTML. If you do it it should be a line
-rather than -- and maybe three cm or an inch." The signature block in
-compose.ts hard-coded the "-- " delimiter above acct.sig / acct.signature.
-It is now a left-aligned <hr> 3 cm wide, 1 px, grey, inline-styled since
-no stylesheet travels with mail. Anything else belongs in the signature
-HTML itself. Trade-off noted to Bob: other clients use "-- " to trim a
-quoted signature; without it some will quote it back.
+Bob 2026-09-10, Ground News: "another valid site. How do I approve it?"
+The banner read "This claims to be a sender you trust, but nothing proves
+it is" — groundnews.email is on his list, but Ground News sends through
+Amazon SES, the message is signed only as amazonses.com, and the domain
+publishes no DMARC record, so the sender can never be proved and the list
+was ignored, correctly, with no way forward. Trusting amazonses.com as an
+intermediary was not offered (no Sender: header) and would be too broad.
+
+New allowlist.jsonc `trustedSendersVia`: "‹sender domain› via ‹relay
+domain›" pairs. An entry counts only when the From domain matches AND the
+named relay's DKIM signature verified at the receiving server — a relay
+like SES lets a customer send only From identities it has verified, so
+the pair is evidence a forger's own relay account cannot supply, and a
+message without the relay's signature matches nothing. Never silences
+forgery evidence. The trusted-but-unproved caution now names the relay
+that signed and the action; the banner offers "Trust ‹sender› via
+‹relay›". trustSenderOrDomain type "via", TRUST_LIST_KEYS carries the
+key for desktop and Android; getAllowlist returns it.
+
+Tests: Ground News headers; pair silences only with that relay's
+signature (not unsigned, not another relay, not another From through the
+same relay); a phishing listing stays red. Verified on the live message:
+caution with the offer before, silent after. mailx-types 0.1.97,
+mailx-settings 0.1.89, mailx-store 0.1.124, mailx-service 0.1.38,
+mailx-store-web 0.1.117.

package/.llm/trusted-lists.md

@@ -66,3 +66,5 @@ tests/trust.test.ts, .commitmsg, TODO.md C165, root version 1.2.311. Then rebuil
 - v1.2.319: TinyMCE smart-paste left the caret INSIDE the pasted <a>; stepCaretOutOfPastedLink in client/compose/editor.ts moves it after the anchor one tick after paste. Quill path has the same shape (insertText link + setSelection) — untouched, Bob uses TinyMCE.
 - v1.2.320: Quill counterpart — placeCaretAfterLink(index) = setSelection + format("link", false) at 5 paste sites + 2 Edit-link dialog sites. Untested; Bob will switch editor to test.
 - v1.2.321: signature block uses a 3cm <hr> instead of '-- ' (compose.ts sigBlock).
+- Bob confirmed 2026-09-10: 'quill worked' (v1.2.320 placeCaretAfterLink).
+- v1.2.322: trustedSendersVia ('sender via relay' pairs) — Ground News via amazonses.com. Banner offers 'Trust ‹sender› via ‹relay›' on the trusted-but-unproved caution; counts only when the relay DKIM-signed. 45/45 trust tests.

package/client/android-bootstrap.bundle.js

@@ -2297,6 +2297,23 @@ function provedIntermediary(input) {
       return entry;
   return "";
 }
+function parseSenderVia(entry) {
+  const m = (entry || "").trim().toLowerCase().match(/^(\S+)\s+via\s+(\S+)$/);
+  return m ? { domain: m[1], signer: m[2] } : null;
+}
+function provedSenderVia(input) {
+  const entries = (input.trustedSendersVia || []).map(parseSenderVia).filter(Boolean);
+  if (!entries.length)
+    return "";
+  const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+  if (!fromDomain)
+    return "";
+  const signers = dkimSigners(input);
+  for (const e of entries)
+    if (sameOrg(fromDomain, e.domain) && signers.some((s) => sameOrg(s, e.signer)))
+      return `${e.domain} via ${e.signer}`;
+  return "";
+}
 function listProof(input) {
   const none = { id: "", proved: false, host: "" };
   const raw = header(input.headerLines, "list-id");
@@ -2420,7 +2437,8 @@ function analyzeServerSpam(input) {
     reasons,
     intermediary: provedIntermediary(input),
     signers: dkimSigners(input),
-    list
+    list,
+    senderVia: provedSenderVia(input)
   };
 }
 function provedNote(a) {
@@ -2439,7 +2457,7 @@ function serverSpamVerdict(input) {
   const a = analyzeServerSpam(input);
   if (!a || !a.flagged)
     return null;
-  const trustedAndProved = input.senderTrusted && a.proved || !!a.intermediary || a.list.trusted;
+  const trustedAndProved = input.senderTrusted && a.proved || !!a.intermediary || a.list.trusted || !!a.senderVia;
   if (trustedAndProved && a.kind !== "forgery" && !a.authFailures.length)
     return null;
   const senderDomain = (bare(header(input.headerLines, "sender")).split("@")[1] || "").toLowerCase();
@@ -2473,14 +2491,19 @@ function serverSpamVerdict(input) {
       detail: `${numbers}${why}${bayes}`
     };
   const proof = a.proved ? `${provedNote(a)} ` : "";
-  if (input.senderTrusted && !a.proved)
+  if (input.senderTrusted && !a.proved) {
+    const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+    const relaySigner = a.signers.find((s) => !sameOrg(s, fromDomain)) || "";
+    const senderViaNote = relaySigner ? `. ${relaySigner} signed this message on the sender's behalf; "Trust ${fromDomain} via ${relaySigner}" stops this note for mail from ${fromDomain} that ${relaySigner} signs.` : "";
     return {
       id: "server-spam-verdict",
       severity: "caution",
       text: "This claims to be a sender you trust, but nothing proves it is.",
-      detail: `No DMARC pass, no valid signature from the sending domain, and it passed through hosts your server does not trust. ${numbers}${why}${listNote}`,
-      ...viaList
+      detail: `No DMARC pass, no valid signature from the sending domain, and it passed through hosts your server does not trust. ${numbers}${why}${listNote}${senderViaNote}`,
+      ...viaList,
+      ...relaySigner ? { senderVia: `${fromDomain} via ${relaySigner}` } : {}
     };
+  }
   return {
     id: "server-spam-verdict",
     severity: "caution",
@@ -2664,7 +2687,7 @@ function spamScoreOf(input) {
     proved: a.proved,
     provedBy: a.provedBy,
     bulkOnly: a.bulkOnly,
-    trusted: (!!input.senderTrusted && a.proved || !!a.intermediary || a.list.trusted) && a.kind !== "forgery" && !a.authFailures.length,
+    trusted: (!!input.senderTrusted && a.proved || !!a.intermediary || a.list.trusted || !!a.senderVia) && a.kind !== "forgery" && !a.authFailures.length,
     reasons: a.reasons,
     listId: a.list.id,
     listProved: a.list.proved,
@@ -2679,7 +2702,8 @@ var init_trust = __esm({
       sender: "trustedSenders",
       domain: "trustedDomains",
       intermediary: "trustedIntermediaries",
-      list: "trustedLists"
+      list: "trustedLists",
+      via: "trustedSendersVia"
     };
     FORGERY_RULES = [
       /^SPF_(HELO_)?(FAIL|SOFTFAIL)$/,
@@ -4291,7 +4315,8 @@ var init_web_settings = __esm({
       trustedSenders: [],
       trustedDomains: [],
       // Mailing lists by List-Id — mirrors mailx-settings DEFAULT_ALLOWLIST (2026-09-09).
-      trustedLists: []
+      trustedLists: [],
+      trustedSendersVia: []
     };
     PREV_KEEP = 5;
     SHARED_REFRESH_MS = 5 * 6e4;
@@ -7256,7 +7281,8 @@ var WebMailxService = class _WebMailxService {
       trustedSenders: list.trustedSenders || [],
       trustedDomains: list.trustedDomains || [],
       trustedIntermediaries: list.trustedIntermediaries || [],
-      trustedLists: list.trustedLists || []
+      trustedLists: list.trustedLists || [],
+      trustedSendersVia: list.trustedSendersVia || []
     };
   }
   async allowRemoteContent(type, value) {