58 lines
2.5 KiB
Markdown
58 lines
2.5 KiB
Markdown
# Mail Tools
|
|
|
|
Mail Tools is a local-first browser workbench for inspecting `.eml`, MIME and
|
|
mbox files. It unfolds headers, decodes RFC 2047 words, builds a bounded
|
|
multipart tree, threads mailbox messages, inventories attachments, compares
|
|
text bodies, and creates canonical or focused redacted exports. File imports
|
|
are parsed from their original octets, retain exact source byte ranges for raw
|
|
MIME entities, and assemble RFC 2231 continued parameters.
|
|
|
|
HTML bodies are sanitized and displayed only in an opaque sandbox with an
|
|
embedded `default-src 'none'` policy. Remote images, links, forms, scripts,
|
|
styles, media, frames and active documents are removed. Referenced CID images
|
|
of a small safe type can be embedded from the same message. No message,
|
|
address, attachment, URL or telemetry leaves the browser.
|
|
|
|
## Development and release
|
|
|
|
Requires Node.js 22+ and npm 11+.
|
|
|
|
```sh
|
|
npm ci
|
|
npm run check
|
|
npm run test:browser
|
|
npm run release:artifact
|
|
```
|
|
|
|
The last command creates deterministic `release/mail-tools-0.2.0.zip` and its
|
|
SHA-256 sidecar. The app uses relative assets and is tested beneath
|
|
`/deep/nested/mail/`. It can run standalone or from add·ideas Toolbox.
|
|
|
|
## v0.1 boundary
|
|
|
|
- source limit: 8 MiB; at most 2,000 headers, 500 MIME parts, nesting depth 20,
|
|
and a conservative 16 MiB decoded-data budget;
|
|
- folded headers, duplicate fields, RFC 2047 B/Q words, and RFC 2231 parameter
|
|
continuations;
|
|
- multipart and nested `message/rfc822`, Base64 and quoted-printable;
|
|
- bounded mbox/mboxrd import and local Message-ID/References threading;
|
|
- safe text previews, sanitized HTML with local CID images, attachment
|
|
inventory/download;
|
|
- address/date and SPF/DKIM/DMARC/ARC claim diagnostics;
|
|
- RFC 6376 simple/relaxed RSA-SHA256 and RFC 8463 Ed25519-SHA256 DKIM
|
|
verification against a public-key TXT record pasted by the user;
|
|
- bounded line comparison and normalized EML plus top-level header redaction
|
|
with a JSON report.
|
|
|
|
This is not a mail client, spam detector, forensic verifier or anonymity tool.
|
|
It does not contact mail or DNS servers, decrypt S/MIME/OpenPGP, establish
|
|
sender identity, scan malware, open maildir/PST/OST containers, or guarantee
|
|
that the deliberately normalized canonical export is byte-identical. DKIM
|
|
verification proves only that the preserved bytes match the pasted key record;
|
|
the tool cannot establish whether that record is authentic or current. The
|
|
untouched source octets remain available for inspection.
|
|
See
|
|
[`docs/PRIVACY-SECURITY.md`](docs/PRIVACY-SECURITY.md).
|
|
|
|
Licensed under GPL-3.0-or-later.
|