@bobfrankston/rmfmail 1.2.322 → 1.2.324

package/.commitmsg

@@ -1,27 +1,24 @@
-Trust a sender via the relay that signs for it ("groundnews.email via amazonses.com")
+A proved, trusted sender vouches for its own links; the trust button appears whenever trust would clear the banner
 
-Bob 2026-09-10, Ground News: "another valid site. How do I approve it?"
-The banner read "This claims to be a sender you trust, but nothing proves
-it is" — groundnews.email is on his list, but Ground News sends through
-Amazon SES, the message is signed only as amazonses.com, and the domain
-publishes no DMARC record, so the sender can never be proved and the list
-was ignored, correctly, with no way forward. Trusting amazonses.com as an
-intermediary was not offered (no Sender: header) and would be too broad.
+Bob 2026-09-11, a Toast receipt: "Another message to flag as safe because
+I trust toasttakeout.com. There should be a trust button."
 
-New allowlist.jsonc `trustedSendersVia`: "‹sender domain› via ‹relay
-domain›" pairs. An entry counts only when the From domain matches AND the
-named relay's DKIM signature verified at the receiving server — a relay
-like SES lets a customer send only From identities it has verified, so
-the pair is evidence a forger's own relay account cannot supply, and a
-message without the relay's signature matches nothing. Never silences
-forgery evidence. The trusted-but-unproved caution now names the relay
-that signed and the action; the banner offers "Trust ‹sender› via
-‹relay›". trustSenderOrDomain type "via", TRUST_LIST_KEYS carries the
-key for desktop and Android; getAllowlist returns it.
+The mail is dmarc=pass toasttab.com, toasttab.com is on his list, so the
+server's 19.9 spam verdict was already silent — what remained was the
+redirector warning: every link runs through toasttakeout.page.link
+(Firebase's per-app redirector) to toasttakeout.com. Two organisations by
+hostname, nobody signed for page.link, the sender is neither, so rules 1
+to 4 all missed, and the finding's own text said "only the sender could
+vouch for the link". Rule 5: when the proved sender is one the reader
+trusts, it has. Proof stays mandatory — trust without the server's pass
+clears nothing (tested), so a forger typing a trusted domain into From
+gets no vouching.
 
-Tests: Ground News headers; pair silences only with that relay's
-signature (not unsigned, not another relay, not another From through the
-same relay); a phishing listing stays red. Verified on the live message:
-caution with the offer before, silent after. mailx-types 0.1.97,
-mailx-settings 0.1.89, mailx-store 0.1.124, mailx-service 0.1.38,
-mailx-store-web 0.1.117.
+The banner's "Stop warning about" buttons used to appear only when the
+server's verdict was the single finding. They now appear whenever every
+finding is one trust clears (the verdict, the redirector warning) and the
+sender is proved — the Toast receipt carried both and so had no button
+on the one message that needed it. A proved-but-untrusted sender's
+redirector warning now names the action; an unproved one says plainly
+that nothing proves who the sender is. mailx-types 0.1.99. Verified on
+the live receipt: two cautions before, nothing after.

package/.llm/trusted-lists.md

@@ -68,3 +68,5 @@ tests/trust.test.ts, .commitmsg, TODO.md C165, root version 1.2.311. Then rebuil
 - v1.2.321: signature block uses a 3cm <hr> instead of '-- ' (compose.ts sigBlock).
 - Bob confirmed 2026-09-10: 'quill worked' (v1.2.320 placeCaretAfterLink).
 - v1.2.322: trustedSendersVia ('sender via relay' pairs) — Ground News via amazonses.com. Banner offers 'Trust ‹sender› via ‹relay›' on the trusted-but-unproved caution; counts only when the relay DKIM-signed. 45/45 trust tests.
+- v1.2.323: New event picker always shown (disabled + explanatory tooltip when only one writable calendar); getCalendars returns all calendars with selected flag; daemon logs roles.
+- v1.2.324: redirector rule 5 — proved + trusted sender vouches for its own links (Toast via toasttakeout.page.link). Banner 'Stop warning about' now offered when every finding is verdict/redirector and sender proved. 48/48.

package/client/android-bootstrap.bundle.js

@@ -2589,6 +2589,8 @@ function provedSenderDomain(input) {
 function redirectorLink(input) {
   const bodyHtml = input.bodyHtml || "";
   const senderDomain = provedSenderDomain(input);
+  if (senderDomain && input.senderTrusted)
+    return null;
   const intermediary = provedIntermediary(input);
   const signers = dkimSigners(input);
   for (const m of bodyHtml.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
@@ -2618,13 +2620,14 @@ function redirectorLink(input) {
       if (senderDomain && sameOrg(target.hostname, senderDomain))
         continue;
       const signer = signers.find((s) => sameOrg(s, url.hostname));
-      const how = signer ? ` ${signer} signed this message; "Trust ${signer} as an intermediary" stops this warning for links through ${signer} in mail it signs.` : ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; only the sender could vouch for the link.`;
+      const how = signer ? ` ${signer} signed this message; "Trust ${signer} as an intermediary" stops this warning for links through ${signer} in mail it signs.` : senderDomain ? ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; ${senderDomain} proved it sent this, and "Stop warning about *@${senderDomain}" lets it vouch for its own links.` : ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; only the sender could vouch for the link, and nothing proves who the sender is.`;
       return {
         id: "redirector-link",
         severity: "caution",
         text: `A link hides where it goes: it passes through ${url.hostname} and ends at ${target.hostname}.`,
         detail: `${url.hostname} -> ${target.hostname}.${how}`,
-        ...signer ? { via: signer } : {}
+        ...signer ? { via: signer } : {},
+        ...senderDomain && !signer ? { sender: senderDomain } : {}
       };
     }
   }