lotobo/mail-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Release Mail Tools 0.2.0
Verify / verify (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
zemion
2026-09-02 10:47:30 +02:00
parent 9bc0870404
commit 2ab972a9f3
35 changed files with 2061 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/README.md
+25 -13
View File
@@ -1,14 +1,17 @@
# Mail Tools
Mail Tools is a local-first browser workbench for inspecting `.eml` and MIME
messages. Version 0.1.0 unfolds headers, decodes RFC 2047 words, builds a bounded
multipart tree, decodes common transfer encodings, inventories attachments,
compares text bodies, and creates canonical or focused redacted exports.
Mail Tools is a local-first browser workbench for inspecting `.eml`, MIME and
mbox files. It unfolds headers, decodes RFC 2047 words, builds a bounded
multipart tree, threads mailbox messages, inventories attachments, compares
text bodies, and creates canonical or focused redacted exports. File imports
are parsed from their original octets, retain exact source byte ranges for raw
MIME entities, and assemble RFC 2231 continued parameters.
HTML bodies are sanitized and displayed only in an opaque sandbox with an
embedded `default-src 'none'` policy. Remote images, links, forms, scripts,
styles, media, frames and active documents are removed. No message, address,
attachment, URL or telemetry leaves the browser.
styles, media, frames and active documents are removed. Referenced CID images
of a small safe type can be embedded from the same message. No message,
address, attachment, URL or telemetry leaves the browser.
## Development and release
@@ -21,7 +24,7 @@ npm run test:browser
npm run release:artifact
```
The last command creates deterministic `release/mail-tools-0.1.0.zip` and its
The last command creates deterministic `release/mail-tools-0.2.0.zip` and its
SHA-256 sidecar. The app uses relative assets and is tested beneath
`/deep/nested/mail/`. It can run standalone or from add·ideas Toolbox.
@@ -29,17 +32,26 @@ SHA-256 sidecar. The app uses relative assets and is tested beneath
- source limit: 8 MiB; at most 2,000 headers, 500 MIME parts, nesting depth 20,
and a conservative 16 MiB decoded-data budget;
- folded headers, duplicate fields and RFC 2047 B/Q words;
- folded headers, duplicate fields, RFC 2047 B/Q words, and RFC 2231 parameter
continuations;
- multipart and nested `message/rfc822`, Base64 and quoted-printable;
- safe text previews, sanitized HTML, attachment inventory/download;
- address/date and unverified SPF/DKIM/DMARC/ARC header diagnostics;
- bounded mbox/mboxrd import and local Message-ID/References threading;
- safe text previews, sanitized HTML with local CID images, attachment
inventory/download;
- address/date and SPF/DKIM/DMARC/ARC claim diagnostics;
- RFC 6376 simple/relaxed RSA-SHA256 and RFC 8463 Ed25519-SHA256 DKIM
verification against a public-key TXT record pasted by the user;
- bounded line comparison and normalized EML plus top-level header redaction
with a JSON report.
This is not a mail client, spam detector, forensic verifier or anonymity tool.
It does not open mailbox containers, contact servers, decrypt S/MIME/OpenPGP,
validate DKIM signatures, establish sender identity, scan malware, render CID
resources, or guarantee round-trip byte identity. See
It does not contact mail or DNS servers, decrypt S/MIME/OpenPGP, establish
sender identity, scan malware, open maildir/PST/OST containers, or guarantee
that the deliberately normalized canonical export is byte-identical. DKIM
verification proves only that the preserved bytes match the pasted key record;
the tool cannot establish whether that record is authentic or current. The
untouched source octets remain available for inspection.
See
[`docs/PRIVACY-SECURITY.md`](docs/PRIVACY-SECURITY.md).
Licensed under GPL-3.0-or-later.