@bobfrankston/rmfmail 1.2.49 → 1.2.65

package/packages/mailx-store/db.ts

@@ -67,6 +67,24 @@ function isJunkContact(email: string, name: string): boolean {
     for (const re of _denyPatterns) { if (re.test(lower)) return true; }
     return false;
 }
+/** Sanitize a harvested display name. A real display name carries none of
+ *  `@ < > |` — their presence means an address parser mis-split a header
+ *  (e.g. a List-Id / "domain | Name@addr" fragment) and the "name" now
+ *  embeds structural mail punctuation or a whole email address. The worst
+ *  case is an embedded address that DIFFERS from this contact's own email:
+ *  autocomplete then shows a TRUSTED name while sending ELSEWHERE. Live
+ *  example (Bob 2026-06-22): a `discovered` row name `bob.ma | Bob@bob.ma`
+ *  was wired to `miyakot@kt.rim.or.jp`, so test mail Bob addressed to
+ *  himself silently went to a stranger in Japan ("MIA"). Drop the name;
+ *  keep the contact (the email is still useful) — autocomplete falls back
+ *  to showing the bare address, which the user won't mistake for someone. */
+export function cleanContactName(name: string): string {
+    const n = (name || "").trim().replace(/^"(.*)"$/, "$1").trim();
+    if (!n) return "";
+    if (/[@<>|]/.test(n)) return "";
+    return n;
+}
+
 /** User-configured patterns from contacts.jsonc `denylistPatterns`. Compiled
  *  once on settings load; invalid regexes are skipped with a warning. */
 export function setContactsDenyPatterns(patterns: string[]): void {
@@ -792,14 +810,21 @@ export class MailxDB {
         const last = this.getKv("contacts", "purge_v");
         if (last === TARGET) return;
         let dropped = 0;
+        let renamed = 0;
         try {
             const rows = this.db.prepare("SELECT id, email, name FROM contacts WHERE source IN ('discovered','sent','received')").all() as { id: number; email: string; name: string }[];
             const del = this.db.prepare("DELETE FROM contacts WHERE id = ?");
+            const blank = this.db.prepare("UPDATE contacts SET name = '' WHERE id = ?");
             for (const r of rows) {
-                if (isJunkContact(r.email || "", r.name || "")) { del.run(r.id); dropped++; }
+                if (isJunkContact(r.email || "", r.name || "")) { del.run(r.id); dropped++; continue; }
+                // Blank mis-parsed display names that embed `@ < > |` — these
+                // can impersonate one identity while sending to another (the
+                // "bob.ma | Bob@bob.ma" → miyakot@kt.rim.or.jp cross-wire,
+                // Bob 2026-06-22). Keep the contact; drop only the unsafe name.
+                if (r.name && cleanContactName(r.name) !== r.name) { blank.run(r.id); renamed++; }
             }
             this.setKv("contacts", "purge_v", TARGET);
-            if (dropped > 0) console.log(`  [contacts] one-shot purge: dropped ${dropped} junk rows (${TARGET})`);
+            if (dropped > 0 || renamed > 0) console.log(`  [contacts] one-shot purge: dropped ${dropped} junk rows, blanked ${renamed} unsafe names (${TARGET})`);
         } catch (e: any) {
             console.warn(`[contacts] one-shot purge failed: ${e.message}`);
         }
@@ -1379,6 +1404,55 @@ export class MailxDB {
         return Number(result.lastInsertRowid);
     }
 
+    /** Rename a folder row's path (+leaf name) and rewrite every descendant
+     *  folder whose path lives under the old prefix. A single IMAP RENAME on the
+     *  server renames child mailboxes too (RFC 3501), and Gmail/Outlook rename
+     *  cascades the same way, so the local mirror must move the whole subtree in
+     *  lockstep. All in one transaction so a crash can't leave half the subtree
+     *  pointing at the old prefix.
+     *
+     *  `newName` is the new LEAF name written to the renamed row's `name`
+     *  column; descendant rows keep their own leaf names (only the prefix
+     *  changes). The (account_id, path) UNIQUE constraint means the caller must
+     *  have already verified newPath is free. */
+    renameFolderPath(accountId: string, oldPath: string, newPath: string, newName: string, delimiter: string): void {
+        const childPrefix = oldPath + delimiter;
+        this.db.exec("BEGIN");
+        try {
+            // The folder itself — path + leaf name both change.
+            this.db.prepare(
+                "UPDATE folders SET path = ?, name = ? WHERE account_id = ? AND path = ?"
+            ).run(newPath, newName, accountId, oldPath);
+            // Descendants — rewrite only the path prefix, keep their leaf names.
+            // SUBSTR(path, len(childPrefix)+1) is the part after the old prefix.
+            const descendants = this.db.prepare(
+                "SELECT id, path FROM folders WHERE account_id = ? AND path LIKE ? ESCAPE '\\'"
+            ).all(accountId, childPrefix.replace(/[\\%_]/g, "\\$&") + "%") as { id: number; path: string }[];
+            const upd = this.db.prepare("UPDATE folders SET path = ? WHERE id = ?");
+            for (const d of descendants) {
+                const rest = d.path.slice(oldPath.length); // includes the leading delimiter
+                upd.run(newPath + rest, d.id);
+            }
+            this.db.exec("COMMIT");
+        } catch (e) {
+            this.db.exec("ROLLBACK");
+            throw e;
+        }
+    }
+
+    /** Update only a folder's display `name`, leaving `path` untouched. For
+     *  providers whose `path` is an opaque, rename-stable id (Outlook/Graph:
+     *  path = folder id), a rename/reparent changes the display name but NOT
+     *  the id — so synthesizing a new hierarchical path (as renameFolderPath
+     *  does) would corrupt the id-as-path invariant every later Graph op relies
+     *  on. This updates the name in place. No descendant rewrite: opaque-id
+     *  children don't carry the parent in their path. */
+    renameFolderName(accountId: string, folderId: number, newName: string): void {
+        this.db.prepare(
+            "UPDATE folders SET name = ? WHERE account_id = ? AND id = ?"
+        ).run(newName, accountId, folderId);
+    }
+
     getFolders(accountId: string): Folder[] {
         const rows = this.db.prepare(
             "SELECT * FROM folders WHERE account_id = ? ORDER BY path"
@@ -2630,6 +2704,32 @@ export class MailxDB {
         return rows.map(r => r.uid);
     }
 
+    /** UIDs we actually have a stored MESSAGE ROW for in this folder — from the
+     *  `messages` table, NOT `message_folders`. The two can diverge: an "orphan
+     *  membership" (a message_folders row whose messages row was never written /
+     *  got deleted) makes getUidsForFolder report a UID we don't truly have.
+     *  The set-diff backfill must diff against THIS so it re-fetches the real
+     *  message data for orphans instead of treating them as present (Bob
+     *  2026-06-20: ~1k old INBOX messages stuck missing — membership said
+     *  "have it", the row didn't exist). */
+    getStoredUids(accountId: string, folderId: number): number[] {
+        const rows = this.db.prepare(
+            "SELECT uid FROM messages WHERE account_id = ? AND folder_id = ?"
+        ).all(accountId, folderId) as any[];
+        return rows.map(r => r.uid);
+    }
+
+    /** Count of stored MESSAGE ROWS in a folder (messages table). The deficit
+     *  gate compares this to the server's count to decide whether to reconcile;
+     *  using the messages table (not message_folders) means orphan memberships
+     *  don't mask a real "rows are missing" deficit. */
+    getStoredCount(accountId: string, folderId: number): number {
+        const r = this.db.prepare(
+            "SELECT count(*) as cnt FROM messages WHERE account_id = ? AND folder_id = ?"
+        ).get(accountId, folderId) as any;
+        return r?.cnt || 0;
+    }
+
     /** List recent rows in a folder for a Sent-sweep / reconciliation pass.
      *  Returns only the columns the sweeper needs (uid, message_id, date,
      *  subject, size, has_attachments, preview, body_path) for every row in
@@ -2797,6 +2897,7 @@ export class MailxDB {
         const lower = email.toLowerCase();
         if (this.isAddressDenylisted(lower)) return;
         if (isJunkContact(lower, name)) return;
+        name = cleanContactName(name);
         const now = Date.now();
         // discovered tier holds one row per email — bump if present, else
         // insert. Doesn't touch preferred or google rows for the same email;
@@ -2911,6 +3012,7 @@ export class MailxDB {
             if (!email || !VALID.test(email)) return;
             if (isJunkContact(email, name)) return;
             if (this.isAddressDenylisted(email)) return;
+            name = cleanContactName(name);
             const e = agg.get(email);
             if (e) {
                 e.cnt++;
@@ -3451,6 +3553,7 @@ export class MailxDB {
         for (const part of parts) {
             const fromMatch = part.match(/^from:(.+)$/i);
             const toMatch = part.match(/^to:(.+)$/i);
+            const ccMatch = part.match(/^cc:(.+)$/i);
             const subjectMatch = part.match(/^subject:(.+)$/i);
             const dateMatch = part.match(/^date:([><]?=?)(.+)$/i);
             const afterMatch = part.match(/^after:(.+)$/i);
@@ -3465,8 +3568,15 @@ export class MailxDB {
                 const term = ftsClean(fromMatch[1]);
                 if (term) frags.push({ s: `{from_name from_address}:${term}*`, op: false });
             } else if (toMatch) {
+                // `to:` deliberately spans To AND Cc — when someone searches
+                // "to:bob" they mean "addressed to bob", and being Cc'd counts.
+                // Use `cc:` for a Cc-only match. (Bcc isn't indexed: it's absent
+                // on received mail by design, and only meaningful in Sent.)
                 const term = ftsClean(toMatch[1]);
                 if (term) frags.push({ s: `{to_text cc_text}:${term}*`, op: false });
+            } else if (ccMatch) {
+                const term = ftsClean(ccMatch[1]);
+                if (term) frags.push({ s: `cc_text:${term}*`, op: false });
             } else if (subjectMatch) {
                 const term = ftsClean(subjectMatch[1]);
                 if (term) frags.push({ s: `subject:${term}*`, op: false });
@@ -3538,6 +3648,9 @@ export class MailxDB {
             ftsQuery += sep + frags[i].s;
         }
         ftsQuery = ftsQuery.trim();
+        // (Header-scoped search is reachable via the `subject:`/`from:`/`to:`
+        // qualifiers — no separate "headers only" mode needed, and body search
+        // isn't slow enough to warrant one.)
         // No real FTS term — either qualifier-only ("is:flagged after:1w") or
         // every term sanitized away (user typed only punctuation). There is NO
         // valid FTS5 "match everything" string — `MATCH '*'` is itself an FTS5
@@ -3633,13 +3746,20 @@ export class MailxDB {
         }
     }
 
-    /** Rebuild FTS index from existing messages */
+    /** Rebuild FTS index from existing messages.
+     *  body_text is seeded from `preview` here (all db.ts can reach); the full
+     *  message body is backfilled separately by mailx-imap's backfillFtsBodies()
+     *  pass, which can read the cached .eml. */
     rebuildSearchIndex(): number {
-        // Drop and recreate in case schema changed
+        // Drop and recreate. MUST be the STANDALONE schema (no content=messages):
+        // the external-content form indexes to_text/cc_text/body_text columns
+        // that don't exist on `messages`, so content-dereferencing silently
+        // drops those terms — the exact breakage migrateFtsSchema() repairs.
+        // Recreating it here used to quietly reintroduce that bug on every
+        // -reindex (Bob 2026-06-05 "search missed to/cc/body").
         try { this.db.exec("DROP TABLE IF EXISTS messages_fts"); } catch { /* ignore */ }
         this.db.exec(`CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5(
-            subject, from_name, from_address, to_text, cc_text, body_text,
-            content=messages, content_rowid=id
+            subject, from_name, from_address, to_text, cc_text, body_text
         )`);
 
         // Use a single transaction + prepared statement for speed (~50x faster than individual inserts)

package/packages/mailx-store/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.54",
+  "version": "0.1.56",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/packages/mailx-types/contact-rules.d.ts

@@ -1,5 +1,5 @@
 export declare const CONTACT_RULES: {
-    readonly rulesVersion: "v3-domain-oneoff";
+    readonly rulesVersion: "v4-name-hygiene";
     readonly junk: {
         readonly localExact: "^(no-?reply|do-?not-?reply|noreply|mailer-daemon|postmaster|abuse|automated|bounce(s|d)?|list-?(server|admin|owner|manager)?|notification|notifications?|admin@.*automated|root|daemon|nobody|undisclosed)$";
         readonly localSuffix: "(-bounces|\\+bounces|-noreply|-no-reply|-notifications?|-mailer)$";

package/packages/mailx-types/contact-rules.js

@@ -1,7 +1,7 @@
 // AUTO-GENERATED from contact-rules.jsonc — do not edit.
 // Edit the .jsonc and run `node build-rules.js` (or `npm run build`).
 export const CONTACT_RULES = {
-    "rulesVersion": "v3-domain-oneoff",
+    "rulesVersion": "v4-name-hygiene",
     "junk": {
         "localExact": "^(no-?reply|do-?not-?reply|noreply|mailer-daemon|postmaster|abuse|automated|bounce(s|d)?|list-?(server|admin|owner|manager)?|notification|notifications?|admin@.*automated|root|daemon|nobody|undisclosed)$",
         "localSuffix": "(-bounces|\\+bounces|-noreply|-no-reply|-notifications?|-mailer)$",

package/packages/mailx-types/contact-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"contact-rules.js","sourceRoot":"","sources":["contact-rules.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,sEAAsE;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG;IACzB,cAAc,EAAE,kBAAkB;IAClC,MAAM,EAAE;QACJ,YAAY,EAAE,6MAA6M;QAC3N,aAAa,EAAE,mEAAmE;QAClF,aAAa,EAAE,4FAA4F;QAC3G,aAAa,EAAE,8CAA8C;QAC7D,QAAQ,EAAE,8EAA8E;KAC3F;CACK,CAAC"}
+{"version":3,"file":"contact-rules.js","sourceRoot":"","sources":["contact-rules.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,sEAAsE;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG;IACzB,cAAc,EAAE,iBAAiB;IACjC,MAAM,EAAE;QACJ,YAAY,EAAE,6MAA6M;QAC3N,aAAa,EAAE,mEAAmE;QAClF,aAAa,EAAE,4FAA4F;QAC3G,aAAa,EAAE,8CAA8C;QAC7D,QAAQ,EAAE,8EAA8E;KAC3F;CACK,CAAC"}

package/packages/mailx-types/contact-rules.jsonc

@@ -17,7 +17,7 @@
 //                  (e.g. "16179691997.15082868100.nfblcbll1x")
 //   domain       — entire domain match (Google Voice SMS, reply.fb.com)
 {
-  "rulesVersion": "v3-domain-oneoff",
+  "rulesVersion": "v4-name-hygiene",
   "junk": {
     "localExact": "^(no-?reply|do-?not-?reply|noreply|mailer-daemon|postmaster|abuse|automated|bounce(s|d)?|list-?(server|admin|owner|manager)?|notification|notifications?|admin@.*automated|root|daemon|nobody|undisclosed)$",
     "localSuffix": "(-bounces|\\+bounces|-noreply|-no-reply|-notifications?|-mailer)$",

package/packages/mailx-types/contact-rules.ts

@@ -2,7 +2,7 @@
 // Edit the .jsonc and run `node build-rules.js` (or `npm run build`).
 
 export const CONTACT_RULES = {
-    "rulesVersion": "v3-domain-oneoff",
+    "rulesVersion": "v4-name-hygiene",
     "junk": {
         "localExact": "^(no-?reply|do-?not-?reply|noreply|mailer-daemon|postmaster|abuse|automated|bounce(s|d)?|list-?(server|admin|owner|manager)?|notification|notifications?|admin@.*automated|root|daemon|nobody|undisclosed)$",
         "localSuffix": "(-bounces|\\+bounces|-noreply|-no-reply|-notifications?|-mailer)$",

package/packages/mailx-types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",