security(smime): fork upstream plugin and fix two audit findings

S-01 audited bulwarkmail/plugins/smime @ 91085a3 (2,935 lines). Nine
findings, two HIGH. No backdoor and no exfiltration path anywhere in the
bundle — the problems are trust-model and input-validation gaps. Full
report in vnc/audits/SMIME-PLUGIN-AUDIT-2026-08-04.md.

Fork is source-only. The upstream smime.zip is a 1.77 MB prebuilt bundle
whose manifest reads 1.0.1 while the source reads 1.0.2, so auditing
src/ would not audit what that zip installs. We build from source.

Finding 1 (HIGH) — certificate substitution. maybeAutoImportSigner gated
on signatureValid alone, but smimeVerify runs checkChain:false, so that
only proves "signed by whoever holds this key", not that the claimed
identity is real. Self-sign a cert asserting victim@example.com, send one
signed message, and it was stored as the encryption target for that
address — the user's next Encrypt to the victim went to the attacker.
Now requires signerEmailMatch === true and !selfSigned. Both values were
already computed and displayed as untrusted in the banner; only the
import path ignored them. Tests for `true` explicitly so an undefined
match (missing From header) fails closed.

Finding 3 (MED-HIGH) — CRLF header injection. Escaping reached only
Subject and attachment filename; display names, raw addresses,
Message-ID, In-Reply-To, References and attachment Content-Type were
emitted verbatim, and formatAddress escapes only backslash and quote.
In-Reply-To/References/display names are copied from inbound mail when
replying or forwarding, so the value is attacker-supplied. Sanitising
inside formatHeader covers all 17 call sites by construction; the three
headers assembled directly get stripCrlf explicitly.

Also adds auth:observe to the manifest. The plugin registers
onAfterLogout/onAccountSwitch — real hooks (lib/plugin-hooks.ts:362-363)
— without declaring the permission, so under B-09 the session-key wipe
would silently stop running.

verify-fixes.mjs carries 19 assertions including source checks that fail
if either guard is removed or a new unsanitised interpolated header
appears. That last one immediately caught the interpolated smime-type
Content-Type header, which manual review had dismissed as static.

Finding 2 (unauthenticated CBC accepted on decrypt) is NOT fixed. This
is not safe for real mail yet — sandbox accounts only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vnc/plugins/smime/src/smime-encrypt.js

@@ -0,0 +1,53 @@
+import * as pkijs from 'pkijs';
+import { parseCertificateDer } from './certificate-utils.js';
+import { nativeEngine } from './crypto-engine.js';
+import { toHex } from './util.js';
+
+/**
+ * Produce CMS EnvelopedData for the given MIME content.
+ * Content type: application/pkcs7-mime; smime-type=enveloped-data.
+ * Always includes the sender's cert so the sender can decrypt their Sent mail.
+ * Ported from lib/smime/smime-encrypt.ts.
+ */
+export async function smimeEncrypt(mimeBytes, recipientCertsDer, senderCertDer, useAes128) {
+  const allCertDers = deduplicateCerts([...recipientCertsDer, senderCertDer]);
+  if (allCertDers.length === 0) throw new Error('No recipient certificates provided');
+
+  const recipientCerts = allCertDers.map((der) => parseCertificateDer(der));
+  const cmsEnveloped = new pkijs.EnvelopedData();
+
+  for (const cert of recipientCerts) {
+    cmsEnveloped.addRecipientByCertificate(cert, { oaepHashAlgorithm: 'SHA-256' }, undefined, nativeEngine());
+  }
+
+  const contentEncryptionAlgorithm = useAes128
+    ? { name: 'AES-GCM', length: 128 }
+    : { name: 'AES-GCM', length: 256 };
+
+  await cmsEnveloped.encrypt(
+    contentEncryptionAlgorithm,
+    mimeBytes.buffer.slice(mimeBytes.byteOffset, mimeBytes.byteOffset + mimeBytes.byteLength),
+    nativeEngine(),
+  );
+
+  const cms = new pkijs.ContentInfo({
+    contentType: '1.2.840.113549.1.7.3', // id-envelopedData
+    content: cmsEnveloped.toSchema(),
+  });
+
+  const cmsBytes = cms.toSchema().toBER(false);
+  return new Blob([cmsBytes], { type: 'application/pkcs7-mime; smime-type=enveloped-data' });
+}
+
+function deduplicateCerts(certs) {
+  const seen = new Set();
+  const result = [];
+  for (const cert of certs) {
+    const key = toHex(cert);
+    if (!seen.has(key)) {
+      seen.add(key);
+      result.push(cert);
+    }
+  }
+  return result;
+}