@bobfrankston/rmfmail 1.2.323 → 1.2.324

package/.commitmsg

@@ -1,17 +1,24 @@
-New event: the calendar picker is always there, and lists every calendar you can write to
+A proved, trusted sender vouches for its own links; the trust button appears whenever trust would clear the banner
 
-Bob 2026-09-11: "the add appointment box should give me a choice of
-calendars." v1.2.318 hid the picker whenever Google reported fewer than
-two writable calendars — and his four are one owned calendar plus two
-holiday feeds and a shared one, so the row never appeared and read as a
-missing feature.
+Bob 2026-09-11, a Toast receipt: "Another message to flag as safe because
+I trust toasttakeout.com. There should be a trust button."
 
-The row is now always shown. With one writable calendar the dropdown is
-disabled and its tooltip says that this is the only calendar Google lets
-you add events to, that the others are read-only, and where to change
-that (Google Calendar, then Refresh). getCalendars returns EVERY
-calendar with `selected` as a flag instead of a filter: the sidebar
-still lists the selected ones, but a calendar the reader owns and has
-unticked in Google is still one a new event can go to. The daemon logs
-each calendar's role and selection at enumeration so "why only one" can
-be answered from the log. mailx-types 0.1.98, mailx-service 0.1.39.
+The mail is dmarc=pass toasttab.com, toasttab.com is on his list, so the
+server's 19.9 spam verdict was already silent — what remained was the
+redirector warning: every link runs through toasttakeout.page.link
+(Firebase's per-app redirector) to toasttakeout.com. Two organisations by
+hostname, nobody signed for page.link, the sender is neither, so rules 1
+to 4 all missed, and the finding's own text said "only the sender could
+vouch for the link". Rule 5: when the proved sender is one the reader
+trusts, it has. Proof stays mandatory — trust without the server's pass
+clears nothing (tested), so a forger typing a trusted domain into From
+gets no vouching.
+
+The banner's "Stop warning about" buttons used to appear only when the
+server's verdict was the single finding. They now appear whenever every
+finding is one trust clears (the verdict, the redirector warning) and the
+sender is proved — the Toast receipt carried both and so had no button
+on the one message that needed it. A proved-but-untrusted sender's
+redirector warning now names the action; an unproved one says plainly
+that nothing proves who the sender is. mailx-types 0.1.99. Verified on
+the live receipt: two cautions before, nothing after.

package/.llm/trusted-lists.md

@@ -69,3 +69,4 @@ tests/trust.test.ts, .commitmsg, TODO.md C165, root version 1.2.311. Then rebuil
 - Bob confirmed 2026-09-10: 'quill worked' (v1.2.320 placeCaretAfterLink).
 - v1.2.322: trustedSendersVia ('sender via relay' pairs) — Ground News via amazonses.com. Banner offers 'Trust ‹sender› via ‹relay›' on the trusted-but-unproved caution; counts only when the relay DKIM-signed. 45/45 trust tests.
 - v1.2.323: New event picker always shown (disabled + explanatory tooltip when only one writable calendar); getCalendars returns all calendars with selected flag; daemon logs roles.
+- v1.2.324: redirector rule 5 — proved + trusted sender vouches for its own links (Toast via toasttakeout.page.link). Banner 'Stop warning about' now offered when every finding is verdict/redirector and sender proved. 48/48.

package/client/android-bootstrap.bundle.js

@@ -2589,6 +2589,8 @@ function provedSenderDomain(input) {
 function redirectorLink(input) {
   const bodyHtml = input.bodyHtml || "";
   const senderDomain = provedSenderDomain(input);
+  if (senderDomain && input.senderTrusted)
+    return null;
   const intermediary = provedIntermediary(input);
   const signers = dkimSigners(input);
   for (const m of bodyHtml.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
@@ -2618,13 +2620,14 @@ function redirectorLink(input) {
       if (senderDomain && sameOrg(target.hostname, senderDomain))
         continue;
       const signer = signers.find((s) => sameOrg(s, url.hostname));
-      const how = signer ? ` ${signer} signed this message; "Trust ${signer} as an intermediary" stops this warning for links through ${signer} in mail it signs.` : ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; only the sender could vouch for the link.`;
+      const how = signer ? ` ${signer} signed this message; "Trust ${signer} as an intermediary" stops this warning for links through ${signer} in mail it signs.` : senderDomain ? ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; ${senderDomain} proved it sent this, and "Stop warning about *@${senderDomain}" lets it vouch for its own links.` : ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; only the sender could vouch for the link, and nothing proves who the sender is.`;
       return {
         id: "redirector-link",
         severity: "caution",
         text: `A link hides where it goes: it passes through ${url.hostname} and ends at ${target.hostname}.`,
         detail: `${url.hostname} -> ${target.hostname}.${how}`,
-        ...signer ? { via: signer } : {}
+        ...signer ? { via: signer } : {},
+        ...senderDomain && !signer ? { sender: senderDomain } : {}
       };
     }
   }