V0.5 by slosar · Pull Request #2 · slosar/bor

slosar · 2026-03-04T18:34:49Z

A slew of bug fixes and features.

Copilot

Pull request overview

This PR bumps Bor Mail to v0.5.0 and introduces several UX/features around message viewing, threading, compose ergonomics, and mu parsing—along with corresponding documentation and test updates.

Changes:

Add “view in browser” (V), richer full headers (Ctrl+R), and safer/clickable URL rendering in message view.
Improve mu parsing & behaviors (Reply-To/List-Post handling, thread expansion, msgid normalization, MIME part counting) and add search query history navigation/persistence.
Enhance compose editor/file workflow (insert-file prompt, Ctrl+T transpose, Ctrl+Backspace/Ctrl+W word delete) plus new tests and docs; bump version to 0.5.0.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/test_mu.py	Updates address examples and adds coverage for Reply-To/List-Post parsing via mu JSON + raw email view().
tests/test_compose.py	Adds tests for reply destination precedence and compose editor helper behaviors (insert-file reading, word delete, transpose).
tests/test_app_integration.py	Extends mock message shape for new reply/list fields.
pyproject.toml	Version bump to 0.5.0.
documentation/keyboard_shortcuts.md	Documents new `V` shortcut.
documentation/configuration.md	Documents `html.browser_tmp_dir` and updates example config.
bor/tabs/message_index.py	Implements persisted search history with Up/Down navigation; resets search input via helper.
bor/tabs/message.py	Rich full headers, clickable URL markup, msgid normalization for navigation, and “view in browser” action.
bor/tabs/compose.py	Adds editor shortcuts (Ctrl+T/Ctrl+Backspace), file insert flow, and reply-to-list logic (List-Post precedence).
bor/tabs/attachments.py	Refines kitty image sizing to prefer natural pixel size and scale-to-fit with TIOCGWINSZ fallback.
bor/mu.py	Adds List-Post support, improves Reply-To parsing, fixes threading depth and thread discovery, normalizes msgid in view(), adjusts multipart part counting, captures extra headers.
bor/config.py	Adds `HtmlConfig.browser_tmp_dir`.
bor/init.py	Version bump to 0.5.0.
CHANGELOG.md	Documents v0.5.0 features and fixes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-04T18:41:57Z

        # From
        lines.append(f"[bold]From:[/bold]    {self.message.from_addr}")

+        # Show effective reply address when it differs from From
+        if self.message.list_post_addr and self.message.list_post_addr.email:
+            # Mailing list: show the list address (this is where 'r' will send)
+            if self.message.list_post_addr.email != self.message.from_addr.email:
+                lines.append(f"[bold]List:[/bold]    {self.message.list_post_addr.email}")
+        elif (self.message.reply_to_addr and
+                self.message.reply_to_addr.email != self.message.from_addr.email):
+            lines.append(f"[bold]Reply-To:[/bold] {self.message.reply_to_addr}")
+
        # To
        to_list = ", ".join(str(addr) for addr in self.message.to_addrs)
        lines.append(f"[bold]To:[/bold]      {to_list}")


MessageHeader renders with Rich markup (it embeds [bold]...[/bold] tags). User-controlled values like From/To names should be escaped (e.g., via rich_escape(str(...))) to avoid markup injection or MarkupError when display names contain [/] or similar markup characters.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2026-03-04T18:41:58Z

            if self.message.msgid:
-                lines.append(f"[bold]Msg-ID:[/bold]  {self.message.msgid}")
+                lines.append(f"[bold]Message-ID:[/bold] {rich_escape(self.message.msgid)}")
            if self.message.in_reply_to:
-                lines.append(f"[bold]Reply-To:[/bold] {self.message.in_reply_to}")
+                lines.append(f"[bold]In-Reply-To:[/bold] {rich_escape(self.message.in_reply_to)}")
+            if self.message.references:
+                n = len(self.message.references)
+                sample = " ".join(self.message.references[-2:])
+                suffix = f" (… {n} total)" if n > 2 else ""
+                lines.append(f"[bold]References:[/bold] {rich_escape(sample)}{suffix}")


In the full-header block you correctly rich_escape several fields, but the earlier basic header fields (From/To/CC/Subject) are still interpolated unescaped into Rich markup strings. To avoid markup injection / MarkupError for subjects or display names containing [ etc., consider escaping all user-controlled header values consistently.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2026-03-04T18:41:58Z

+        try:
+            config = get_config()
+            tmp_dir_str = config.html.browser_tmp_dir
+            tmp_dir = Path(tmp_dir_str).expanduser() if tmp_dir_str else None
+            if tmp_dir is not None:
+                tmp_dir.mkdir(parents=True, exist_ok=True)
+            tmp = tempfile.NamedTemporaryFile(
+                suffix=".html", prefix="bor_msg_", delete=False,
+                mode="w", encoding="utf-8", dir=tmp_dir,
+            )
+            tmp.write(full_html)
+            tmp.close()
+            webbrowser.open(Path(tmp.name).as_uri())


action_view_in_browser creates a delete=False temp HTML file and never cleans it up, so repeated use will leave many bor_msg_*.html files behind (especially if html.browser_tmp_dir is set to a persistent directory). Consider a cleanup strategy (e.g., reuse a deterministic filename per message/session, or delete older files on startup).

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2026-03-04T19:56:43Z

@slosar I've opened a new pull request, #3, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-03-04T19:57:01Z

@slosar I've opened a new pull request, #4, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-03-04T19:57:29Z

@slosar I've opened a new pull request, #5, to work on those changes. Once the pull request is ready, I'll request review from you.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…markup injection Co-authored-by: slosar <1197186+slosar@users.noreply.github.com>

Co-authored-by: slosar <1197186+slosar@users.noreply.github.com>

Escape all user-controlled header values in message view to prevent Rich markup injection

…umulation Co-authored-by: slosar <1197186+slosar@users.noreply.github.com>

Escape Rich markup in MessageHeader user-controlled values

Fix temp HTML file accumulation in action_view_in_browser

slosar added 9 commits February 27, 2026 07:36

more fixes

9d7272a

added view in browser

375b6e6

fixed reply to

62eba69

fixed extraction, added search history

351e550

added rich headers

29184a9

fixed threading level

ecb4aed

image handling

5dd6b79

fixed navigation issue

aac1ed9

version bump

ec45199

slosar requested a review from Copilot March 4, 2026 18:34

Copilot started reviewing on behalf of slosar March 4, 2026 18:35 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

Initial plan

47c7145

Copilot AI mentioned this pull request Mar 4, 2026

Escape Rich markup in MessageHeader user-controlled values #3

Merged

Initial plan

d55552e

Copilot AI mentioned this pull request Mar 4, 2026

Escape all user-controlled header values in message view to prevent Rich markup injection #4

Merged

Initial plan

29148aa

Copilot AI mentioned this pull request Mar 4, 2026

Fix temp HTML file accumulation in action_view_in_browser #5

Merged

slosar and others added 8 commits March 4, 2026 14:57

Remove spurious import

c132a45

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Escape all user-controlled header values with rich_escape to prevent …

e02005e

…markup injection Co-authored-by: slosar <1197186+slosar@users.noreply.github.com>

Escape Rich markup in all user-controlled MessageHeader values

7121a56

Co-authored-by: slosar <1197186+slosar@users.noreply.github.com>

Merge pull request #4 from slosar/copilot/sub-pr-2-again

6fb6b8e

Escape all user-controlled header values in message view to prevent Rich markup injection

Merge branch 'v0.5' into copilot/sub-pr-2

a89d84e

Use deterministic filename for browser temp HTML files to prevent acc…

2f20b2a

…umulation Co-authored-by: slosar <1197186+slosar@users.noreply.github.com>

Merge pull request #3 from slosar/copilot/sub-pr-2

9d374f4

Escape Rich markup in MessageHeader user-controlled values

Merge pull request #5 from slosar/copilot/sub-pr-2-another-one

c0363b0

Fix temp HTML file accumulation in action_view_in_browser

slosar merged commit 88bc9c0 into main Mar 4, 2026
2 checks passed

slosar deleted the v0.5 branch March 4, 2026 20:05

Navigation Menu

V0.5 - #2

V0.5#2
slosar merged 20 commits into
mainfrom
v0.5

slosar commented Mar 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

slosar Mar 4, 2026

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

slosar Mar 4, 2026

Uh oh!

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

slosar Mar 4, 2026

Uh oh!

Uh oh!

Copilot AI commented Mar 4, 2026

Uh oh!

Copilot AI commented Mar 4, 2026

Uh oh!

Copilot AI commented Mar 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

slosar commented Mar 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

slosar Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

slosar Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

slosar Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI commented Mar 4, 2026

Uh oh!

Copilot AI commented Mar 4, 2026

Uh oh!

Copilot AI commented Mar 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants