@bobfrankston/rmfmail 1.2.321 → 1.2.323

package/.commitmsg

@@ -1,10 +1,17 @@
-Compose: a thin 3 cm rule above the signature instead of "-- "
+New event: the calendar picker is always there, and lists every calendar you can write to
 
-Bob 2026-09-10: "you seem to be putting a -- above the signature. If I
-want it it should be part of my HTML. If you do it it should be a line
-rather than -- and maybe three cm or an inch." The signature block in
-compose.ts hard-coded the "-- " delimiter above acct.sig / acct.signature.
-It is now a left-aligned <hr> 3 cm wide, 1 px, grey, inline-styled since
-no stylesheet travels with mail. Anything else belongs in the signature
-HTML itself. Trade-off noted to Bob: other clients use "-- " to trim a
-quoted signature; without it some will quote it back.
+Bob 2026-09-11: "the add appointment box should give me a choice of
+calendars." v1.2.318 hid the picker whenever Google reported fewer than
+two writable calendars — and his four are one owned calendar plus two
+holiday feeds and a shared one, so the row never appeared and read as a
+missing feature.
+
+The row is now always shown. With one writable calendar the dropdown is
+disabled and its tooltip says that this is the only calendar Google lets
+you add events to, that the others are read-only, and where to change
+that (Google Calendar, then Refresh). getCalendars returns EVERY
+calendar with `selected` as a flag instead of a filter: the sidebar
+still lists the selected ones, but a calendar the reader owns and has
+unticked in Google is still one a new event can go to. The daemon logs
+each calendar's role and selection at enumeration so "why only one" can
+be answered from the log. mailx-types 0.1.98, mailx-service 0.1.39.

package/.llm/trusted-lists.md

@@ -66,3 +66,6 @@ tests/trust.test.ts, .commitmsg, TODO.md C165, root version 1.2.311. Then rebuil
 - v1.2.319: TinyMCE smart-paste left the caret INSIDE the pasted <a>; stepCaretOutOfPastedLink in client/compose/editor.ts moves it after the anchor one tick after paste. Quill path has the same shape (insertText link + setSelection) — untouched, Bob uses TinyMCE.
 - v1.2.320: Quill counterpart — placeCaretAfterLink(index) = setSelection + format("link", false) at 5 paste sites + 2 Edit-link dialog sites. Untested; Bob will switch editor to test.
 - v1.2.321: signature block uses a 3cm <hr> instead of '-- ' (compose.ts sigBlock).
+- Bob confirmed 2026-09-10: 'quill worked' (v1.2.320 placeCaretAfterLink).
+- v1.2.322: trustedSendersVia ('sender via relay' pairs) — Ground News via amazonses.com. Banner offers 'Trust ‹sender› via ‹relay›' on the trusted-but-unproved caution; counts only when the relay DKIM-signed. 45/45 trust tests.
+- v1.2.323: New event picker always shown (disabled + explanatory tooltip when only one writable calendar); getCalendars returns all calendars with selected flag; daemon logs roles.

package/client/android-bootstrap.bundle.js

@@ -2297,6 +2297,23 @@ function provedIntermediary(input) {
       return entry;
   return "";
 }
+function parseSenderVia(entry) {
+  const m = (entry || "").trim().toLowerCase().match(/^(\S+)\s+via\s+(\S+)$/);
+  return m ? { domain: m[1], signer: m[2] } : null;
+}
+function provedSenderVia(input) {
+  const entries = (input.trustedSendersVia || []).map(parseSenderVia).filter(Boolean);
+  if (!entries.length)
+    return "";
+  const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+  if (!fromDomain)
+    return "";
+  const signers = dkimSigners(input);
+  for (const e of entries)
+    if (sameOrg(fromDomain, e.domain) && signers.some((s) => sameOrg(s, e.signer)))
+      return `${e.domain} via ${e.signer}`;
+  return "";
+}
 function listProof(input) {
   const none = { id: "", proved: false, host: "" };
   const raw = header(input.headerLines, "list-id");
@@ -2420,7 +2437,8 @@ function analyzeServerSpam(input) {
     reasons,
     intermediary: provedIntermediary(input),
     signers: dkimSigners(input),
-    list
+    list,
+    senderVia: provedSenderVia(input)
   };
 }
 function provedNote(a) {
@@ -2439,7 +2457,7 @@ function serverSpamVerdict(input) {
   const a = analyzeServerSpam(input);
   if (!a || !a.flagged)
     return null;
-  const trustedAndProved = input.senderTrusted && a.proved || !!a.intermediary || a.list.trusted;
+  const trustedAndProved = input.senderTrusted && a.proved || !!a.intermediary || a.list.trusted || !!a.senderVia;
   if (trustedAndProved && a.kind !== "forgery" && !a.authFailures.length)
     return null;
   const senderDomain = (bare(header(input.headerLines, "sender")).split("@")[1] || "").toLowerCase();
@@ -2473,14 +2491,19 @@ function serverSpamVerdict(input) {
       detail: `${numbers}${why}${bayes}`
     };
   const proof = a.proved ? `${provedNote(a)} ` : "";
-  if (input.senderTrusted && !a.proved)
+  if (input.senderTrusted && !a.proved) {
+    const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+    const relaySigner = a.signers.find((s) => !sameOrg(s, fromDomain)) || "";
+    const senderViaNote = relaySigner ? `. ${relaySigner} signed this message on the sender's behalf; "Trust ${fromDomain} via ${relaySigner}" stops this note for mail from ${fromDomain} that ${relaySigner} signs.` : "";
     return {
       id: "server-spam-verdict",
       severity: "caution",
       text: "This claims to be a sender you trust, but nothing proves it is.",
-      detail: `No DMARC pass, no valid signature from the sending domain, and it passed through hosts your server does not trust. ${numbers}${why}${listNote}`,
-      ...viaList
+      detail: `No DMARC pass, no valid signature from the sending domain, and it passed through hosts your server does not trust. ${numbers}${why}${listNote}${senderViaNote}`,
+      ...viaList,
+      ...relaySigner ? { senderVia: `${fromDomain} via ${relaySigner}` } : {}
     };
+  }
   return {
     id: "server-spam-verdict",
     severity: "caution",
@@ -2664,7 +2687,7 @@ function spamScoreOf(input) {
     proved: a.proved,
     provedBy: a.provedBy,
     bulkOnly: a.bulkOnly,
-    trusted: (!!input.senderTrusted && a.proved || !!a.intermediary || a.list.trusted) && a.kind !== "forgery" && !a.authFailures.length,
+    trusted: (!!input.senderTrusted && a.proved || !!a.intermediary || a.list.trusted || !!a.senderVia) && a.kind !== "forgery" && !a.authFailures.length,
     reasons: a.reasons,
     listId: a.list.id,
     listProved: a.list.proved,
@@ -2679,7 +2702,8 @@ var init_trust = __esm({
       sender: "trustedSenders",
       domain: "trustedDomains",
       intermediary: "trustedIntermediaries",
-      list: "trustedLists"
+      list: "trustedLists",
+      via: "trustedSendersVia"
     };
     FORGERY_RULES = [
       /^SPF_(HELO_)?(FAIL|SOFTFAIL)$/,
@@ -4291,7 +4315,8 @@ var init_web_settings = __esm({
       trustedSenders: [],
       trustedDomains: [],
       // Mailing lists by List-Id — mirrors mailx-settings DEFAULT_ALLOWLIST (2026-09-09).
-      trustedLists: []
+      trustedLists: [],
+      trustedSendersVia: []
     };
     PREV_KEEP = 5;
     SHARED_REFRESH_MS = 5 * 6e4;
@@ -7256,7 +7281,8 @@ var WebMailxService = class _WebMailxService {
       trustedSenders: list.trustedSenders || [],
       trustedDomains: list.trustedDomains || [],
       trustedIntermediaries: list.trustedIntermediaries || [],
-      trustedLists: list.trustedLists || []
+      trustedLists: list.trustedLists || [],
+      trustedSendersVia: list.trustedSendersVia || []
     };
   }
   async allowRemoteContent(type, value) {