From 6cbd53c8272d0197c11b6e6e77fbac4e62e78071 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 08:06:49 +0100
Subject: [PATCH 01/17] fix: run plugin send checks for quick replies

---
 components/mail/mail-app.tsx               | 22 ++++++-----
 lib/outgoing/__tests__/quick-reply.test.ts | 44 +++++++++++++++++++++-
 lib/outgoing/plugin-send-check.ts          | 23 +++++++++++
 lib/outgoing/quick-reply.ts                | 33 ++++++++++++++--
 lib/plugin-types.ts                        |  7 ++++
 5 files changed, 116 insertions(+), 13 deletions(-)
 create mode 100644 lib/outgoing/plugin-send-check.ts

diff --git a/components/mail/mail-app.tsx b/components/mail/mail-app.tsx
index 310ef7dcb..e04c7186d 100644
--- a/components/mail/mail-app.tsx
+++ b/components/mail/mail-app.tsx
@@ -4099,6 +4099,12 @@ export function MailApp({ linkSegments: routeSegments }: MailAppProps = {}) {
           });
       }
     };
+    // RFC 5322 §3.6.4 threading - keep the conversation stitched together (#234).
+    const threading = computeReplyThreadingHeaders({
+      messageId: selectedEmail.messageId,
+      references: selectedEmail.references,
+    });
+    const replySubject = buildReplySubject(selectedEmail.subject || t('email_viewer.no_subject'), t('email_composer.prefix.reply'));
     const prepared = await prepareQuickReply({
       body,
       signatureIdentity,
@@ -4107,6 +4113,12 @@ export function MailApp({ linkSegments: routeSegments }: MailAppProps = {}) {
       to: recipients,
       fromEmail: headerFromEmail,
       identityId: sendingIdentity?.id,
+      subject: replySubject,
+      inReplyTo: threading?.inReplyTo?.[0],
+      // A plugin that said no told the user; one that crashed didn't.
+      onSendCheckStopped: (outcome) => {
+        if (outcome === 'failed') toast.error(t('email_composer.send_guard_failed'));
+      },
       questions: {
         // The fill-in words of the UI language and of English, as the composer.
         placeholderWords: settings.placeholderWarningEnabled
@@ -4137,16 +4149,8 @@ export function MailApp({ linkSegments: routeSegments }: MailAppProps = {}) {
       }
     }
 
-    // RFC 5322 §3.6.4 threading - keep the conversation stitched together (#234).
-    const threading = computeReplyThreadingHeaders({
-      messageId: selectedEmail.messageId,
-      references: selectedEmail.references,
-    });
-
     // The label goes on last, as in the composer.
-    const labelled = classifyOutgoing(quickLabel.policy, quickLabel.label, {
-      subject: buildReplySubject(selectedEmail.subject || t('email_viewer.no_subject'), t('email_composer.prefix.reply')),
-    });
+    const labelled = classifyOutgoing(quickLabel.policy, quickLabel.label, { subject: replySubject });
 
     // Send reply with just the body text
     const result = await sendEmail(
diff --git a/lib/outgoing/__tests__/quick-reply.test.ts b/lib/outgoing/__tests__/quick-reply.test.ts
index 8ee19a28e..723e96556 100644
--- a/lib/outgoing/__tests__/quick-reply.test.ts
+++ b/lib/outgoing/__tests__/quick-reply.test.ts
@@ -2,6 +2,8 @@ import { afterEach, describe, expect, it, vi } from 'vitest';
 import { prepareQuickReply, type QuickReplyQuestion, type QuickReplyQuestions } from '@/lib/outgoing/quick-reply';
 import { registerOutgoingFinalizer, registerPreSendCheck, resetSendPipeline } from '@/lib/outgoing/send-pipeline';
 import type { Identity } from '@/lib/jmap/types';
+import { emailHooks, pluginErrorTracker } from '@/lib/plugin-hooks';
+import type { OutgoingEmail } from '@/lib/plugin-types';
 
 vi.mock('@/lib/debug', () => ({ debug: { log: () => {}, warn: () => {}, error: () => {} } }));
 
@@ -14,7 +16,11 @@ const input = (signatureIdentity: Identity) => ({
   body: 'Thanks <3', signatureIdentity, separator: true, to: ['bob@example.com'], fromEmail: 'me@example.com', identityId: 'i',
 });
 
-afterEach(() => resetSendPipeline());
+afterEach(() => {
+  resetSendPipeline();
+  emailHooks.onBeforeEmailSend.clear();
+  pluginErrorTracker.resetAll();
+});
 
 describe('prepareQuickReply', () => {
   it('builds the text and, for an HTML signature, an escaped HTML body', async () => {
@@ -107,3 +113,39 @@ describe('prepareQuickReply warnings', () => {
     expect(asked).toEqual([]);
   });
 });
+
+// Plugins' send checks (onBeforeEmailSend) ran for the composer and a
+// plugin's forward, never for a quick reply: a way around a send guard.
+describe('prepareQuickReply and plugin send checks', () => {
+  it('asks the plugins with the reply and stops when one says no', async () => {
+    const seen: OutgoingEmail[] = [];
+    emailHooks.onBeforeEmailSend.register('guard', (email: OutgoingEmail) => { seen.push(email); return false; });
+    const stopped: string[] = [];
+    const out = await prepareQuickReply({
+      ...input(text), body: 'IBAN DE89370400440532013000', subject: 'Re: Invoice', inReplyTo: '<m1@example.com>',
+      onSendCheckStopped: (outcome) => stopped.push(outcome),
+    });
+    expect(out).toBeNull();
+    expect(stopped).toEqual(['vetoed']);
+    expect(seen).toEqual([expect.objectContaining({
+      surface: 'quick-reply', mode: 'reply', to: ['bob@example.com'], subject: 'Re: Invoice',
+      inReplyTo: '<m1@example.com>', identityId: 'i', fromEmail: 'me@example.com',
+    })]);
+    expect(seen[0].textBody).toContain('IBAN DE89370400440532013000');
+  });
+
+  it('fails closed when a check crashes', async () => {
+    emailHooks.onBeforeEmailSend.register('guard', () => { throw new Error('boom'); });
+    const stopped: string[] = [];
+    expect(await prepareQuickReply({ ...input(text), onSendCheckStopped: (o) => stopped.push(o) })).toBeNull();
+    expect(stopped).toEqual(['failed']);
+  });
+
+  it('sends when the plugins allow it, with the disclaimer stage after them', async () => {
+    const order: string[] = [];
+    emailHooks.onBeforeEmailSend.register('guard', () => { order.push('plugin'); return undefined; });
+    registerOutgoingFinalizer('disclaimer', 10, (bodies) => { order.push('last'); return bodies; }, 'last');
+    expect(await prepareQuickReply(input(text))).not.toBeNull();
+    expect(order).toEqual(['plugin', 'last']);
+  });
+});
diff --git a/lib/outgoing/plugin-send-check.ts b/lib/outgoing/plugin-send-check.ts
new file mode 100644
index 000000000..919657290
--- /dev/null
+++ b/lib/outgoing/plugin-send-check.ts
@@ -0,0 +1,23 @@
+/**
+ * Plugins' say before a user's mail goes out (onBeforeEmailSend), the same
+ * for every surface that sends it: the composer (inline, pop-out, Pro tab),
+ * quick reply and a plugin's forward (api.email.forward). The bus fails
+ * closed: a handler that throws or runs out of time stops the send.
+ *
+ * Not run for mail Bulwark sends on its own (calendar invitations and RSVP
+ * replies, read receipts, List-Unsubscribe mails, phishing reports) nor for
+ * a crypto plugin's raw send, which happens after the composer's check.
+ */
+
+import { emailHooks } from '@/lib/plugin-hooks';
+import type { OutgoingEmail } from '@/lib/plugin-types';
+
+/**
+ * allowed: send. vetoed: a plugin said no and told the user. failed: a
+ * handler threw or ran out of time (nobody told the user yet).
+ */
+export type PluginSendCheckOutcome = 'allowed' | 'vetoed' | 'failed';
+
+export async function runPluginSendCheck(email: OutgoingEmail): Promise<PluginSendCheckOutcome> {
+  return emailHooks.onBeforeEmailSend.interceptOutcome(email);
+}
diff --git a/lib/outgoing/quick-reply.ts b/lib/outgoing/quick-reply.ts
index e4fc39d19..41bf5cf84 100644
--- a/lib/outgoing/quick-reply.ts
+++ b/lib/outgoing/quick-reply.ts
@@ -3,6 +3,7 @@ import { appendHtmlSignature, appendPlainTextSignature } from '@/lib/signature-u
 import { currentSignatureIdentity } from '@/lib/org/signature-state';
 import { findUnfilledPlaceholders, type PlaceholderWords } from '@/lib/placeholder-check';
 import { finalizeOutgoing, runPreSendChecks, type OutgoingBodies } from './send-pipeline';
+import { runPluginSendCheck, type PluginSendCheckOutcome } from './plugin-send-check';
 // Registers the organisation signature check and the disclaimer.
 import '@/lib/org/outgoing';
 
@@ -29,7 +30,10 @@ export interface QuickReplyQuestions {
  * checks and finalisers as the composer's send. Null when one stopped the
  * send. The organisation signature applies as in the composer
  * (`signatureIdentity` is what the reply would sign with on its own,
- * `sendingIdentity` the identity it goes out from).
+ * `sendingIdentity` the identity it goes out from). Plugins' send checks
+ * (onBeforeEmailSend) run on it too, after the organisation signature and
+ * before the disclaimer, as in the composer; `onSendCheckStopped` hears
+ * why one stopped it.
  */
 export async function prepareQuickReply(input: {
   body: string;
@@ -39,7 +43,11 @@ export async function prepareQuickReply(input: {
   to: string[];
   fromEmail?: string;
   identityId?: string;
+  /** The reply's subject (without a classification prefix) and the original's Message-ID, for plugins. */
+  subject?: string;
+  inReplyTo?: string;
   questions?: QuickReplyQuestions;
+  onSendCheckStopped?: (outcome: Exclude<PluginSendCheckOutcome, 'allowed'>) => void;
 }): Promise<OutgoingBodies | null> {
   const { body, separator, questions } = input;
 
@@ -88,6 +96,25 @@ export async function prepareQuickReply(input: {
   if (!(await runPreSendChecks(context))) return null;
   // Asked last, as in the composer, so an answered warning doesn't ask twice.
   if (questions?.confirmSend && !(await questions.ask({ kind: 'send' }))) return null;
-  // Quick reply has no plugin step in between: both stages at once.
-  return finalizeOutgoing(finalizeOutgoing({ html, text }, context), context, 'last');
+  const bodies = finalizeOutgoing({ html, text }, context);
+  // A quick reply used to skip plugins' send checks: a way around them.
+  const outcome = await runPluginSendCheck({
+    to: input.to,
+    cc: [],
+    bcc: [],
+    subject: input.subject ?? '',
+    htmlBody: bodies.html ?? '',
+    textBody: bodies.text,
+    identityId: input.identityId ?? '',
+    fromEmail: input.fromEmail,
+    attachments: [],
+    inReplyTo: input.inReplyTo,
+    surface: 'quick-reply',
+    mode: 'reply',
+  });
+  if (outcome !== 'allowed') {
+    input.onSendCheckStopped?.(outcome);
+    return null;
+  }
+  return finalizeOutgoing(bodies, context, 'last');
 }
diff --git a/lib/plugin-types.ts b/lib/plugin-types.ts
index 7e404f567..ee62206d8 100644
--- a/lib/plugin-types.ts
+++ b/lib/plugin-types.ts
@@ -1091,6 +1091,13 @@ export interface OutgoingEmail {
   inReplyTo?: string;
   /** Free-form custom headers added by the composer or earlier handlers */
   headers?: Record<string, string>;
+  /**
+   * Where the send comes from (onBeforeEmailSend, Bulwark 1.20 and later):
+   * the composer, a quick reply under a message, or a plugin's forward.
+   */
+  surface?: 'composer' | 'quick-reply' | 'plugin-forward';
+  /** compose, reply, replyAll or forward (onBeforeEmailSend, 1.20 and later). */
+  mode?: 'compose' | 'reply' | 'replyAll' | 'forward';
 }
 /**
  * Passed to onBeforeDraftAutoSave handlers as a transform value.

From edf619a19d96a8100307dea63b7f44c96eb37b61 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 08:16:39 +0100
Subject: [PATCH 02/17] feat: give send-check plugins the authored text,
 external recipients and attachment types

---
 .../composer-send-check-payload.test.tsx      | 313 ++++++++++++++++++
 components/email/email-composer.tsx           |  40 ++-
 .../plugin-host-email-forward.test.ts         |  24 ++
 lib/outgoing/__tests__/quick-reply.test.ts    |   8 +
 .../__tests__/send-check-payload.test.ts      | 126 +++++++
 lib/outgoing/attachment-sniff.ts              |  92 +++++
 lib/outgoing/quick-reply.ts                   |   5 +
 lib/outgoing/send-check-payload.ts            |  99 ++++++
 lib/plugin-sandbox/hook-payload.ts            |  26 ++
 lib/plugin-sandbox/host-api-forward.ts        |  18 +-
 lib/plugin-sandbox/loader.ts                  |   5 +-
 lib/plugin-types.ts                           |  46 ++-
 12 files changed, 792 insertions(+), 10 deletions(-)
 create mode 100644 components/email/__tests__/composer-send-check-payload.test.tsx
 create mode 100644 lib/outgoing/__tests__/send-check-payload.test.ts
 create mode 100644 lib/outgoing/attachment-sniff.ts
 create mode 100644 lib/outgoing/send-check-payload.ts
 create mode 100644 lib/plugin-sandbox/hook-payload.ts

diff --git a/components/email/__tests__/composer-send-check-payload.test.tsx b/components/email/__tests__/composer-send-check-payload.test.tsx
new file mode 100644
index 000000000..a8986b788
--- /dev/null
+++ b/components/email/__tests__/composer-send-check-payload.test.tsx
@@ -0,0 +1,313 @@
+import { render, screen, fireEvent, waitFor } from '@testing-library/react';
+import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest';
+import React from 'react';
+import { EmailComposer } from '../email-composer';
+import { usePolicyStore } from '@/stores/policy-store';
+import { resetSendPipeline } from '@/lib/outgoing/send-pipeline';
+import { DEFAULT_POLICY, type SettingsPolicy } from '@/lib/admin/types';
+import { DEFAULT_ORGANISATION_POLICY } from '@/lib/admin/organisation-policy';
+import type { OutgoingEmail } from '@/lib/plugin-types';
+
+// ─── Heavy component mocks (mirrors composer-reply-signature.test.tsx) ─
+
+// A stand-in for the TipTap editor: it hands the composer an editor object
+// whose content is whatever the composer last rendered into it, the way the
+// real editor reports itself ready from an effect after mounting.
+const editorState = vi.hoisted(() => ({ html: '' }));
+// A plugin that rewrites signatures (onSignatureRender), off unless a test turns it on.
+const signaturePlugin = vi.hoisted(() => ({ on: false }));
+// Send plugins: a footer added by onTransformOutgoingEmail, and a crypto
+// plugin taking the send over (onComposeSend).
+// What a send check plugin (onBeforeEmailSend) was handed.
+const sendChecks = vi.hoisted(() => ({ seen: [] as unknown[] }));
+const sendPlugins = vi.hoisted(() => ({
+  footer: false,
+  takeOver: null as null | ((request: { htmlBody: string; textBody: string }) => void),
+}));
+vi.mock('@/components/email/rich-text-editor', () => ({
+  RichTextEditor: ({ content, onChange, onEditorReady }: {
+    content: string;
+    onChange: (html: string) => void;
+    onEditorReady?: (editor: unknown) => void;
+  }) => {
+    editorState.html = content;
+    const onChangeRef = React.useRef(onChange);
+    onChangeRef.current = onChange;
+    React.useEffect(() => {
+      onEditorReady?.({
+        isDestroyed: false,
+        commands: {
+          focus: () => {},
+          setContent: (html: string) => {
+            editorState.html = html;
+            onChangeRef.current(html);
+          },
+        },
+      });
+      // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
+    return React.createElement('div', { 'data-testid': 'rich-text-editor', 'data-html': content });
+  },
+}));
+
+vi.mock('@/components/plugins/plugin-slot', () => ({ PluginSlot: () => null }));
+vi.mock('@/components/identity/sub-address-helper', () => ({ SubAddressHelper: () => null }));
+vi.mock('@/components/templates/template-picker', () => ({ TemplatePicker: () => null }));
+vi.mock('@/components/templates/template-form', () => ({ TemplateForm: () => null }));
+vi.mock('@/components/files/file-preview-modal', () => ({ FilePreviewModal: () => null }));
+vi.mock('@/hooks/use-focus-trap', () => ({
+  useFocusTrap: () => ({ current: null }),
+}));
+vi.mock('@/hooks/use-pro-multi-account-identities', () => ({
+  useProMultiAccountIdentities: () => ({ enabled: false, groups: [], allIdentities: [] }),
+  stripCrossAccountIdentityPrefix: (id: string) => ({ localAccountId: null, rawId: id }),
+}));
+
+// ─── Store mocks ──────────────────────────────────────────────────────────────
+
+vi.mock('@/stores/auth-store', () => {
+  const state = {
+    client: null,
+    identities: [],
+    primaryIdentity: null,
+    isAuthenticated: false,
+    isDemoMode: false,
+    activeAccountId: null,
+    connectionLost: false,
+    getClientForAccount: () => undefined,
+    getAllConnectedClients: () => new Map(),
+    syncIdentities: () => {},
+    refreshIdentities: async () => {},
+  };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useAuthStore: hook };
+});
+
+vi.mock('@/stores/identity-store', () => {
+  const state = {
+    identities: [
+      { id: 'id-me', email: 'me@example.com', name: 'Me', htmlSignature: '<b>Alice</b>', textSignature: 'Alice' },
+      { id: 'id-team', email: 'team@example.com', name: 'Team', htmlSignature: '', textSignature: '' },
+    ] as Array<Record<string, unknown>>,
+    defaultIdentityId: 'id-me',
+  };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useIdentityStore: hook, notifyIdentitySelected: () => {} };
+});
+
+vi.mock('@/stores/account-store', () => {
+  const state = { accounts: [], getAccountById: () => undefined };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useAccountStore: hook };
+});
+
+vi.mock('@/stores/email-store', () => {
+  const state = {
+    draftSaveEnabled: false,
+    sendRawEmail: async () => ({ sent: true }),
+  };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useEmailStore: hook };
+});
+
+vi.mock('@/stores/settings-store', () => {
+  const state = {
+    timeFormat: '24h',
+    plainTextMode: false,
+    subAddressDelimiter: '+',
+    autoSelectReplyIdentity: true,
+    attachmentReminderEnabled: false,
+    attachmentReminderKeywords: [],
+    emptySubjectWarningEnabled: false,
+    signatureDetails: { title: '', department: '', phone: '', mobile: '' },
+    sendDelaySeconds: 0,
+    // The default position: replies/forwards get the signature appended at
+    // send time rather than embedded above the quote.
+    signaturePosition: 'below_quote',
+    signatureSeparatorEnabled: true,
+    requestReadReceiptDefault: false,
+    addTrustedSender: () => {},
+    externalContentPolicy: 'block',
+    isSenderTrusted: () => false,
+    trustedSendersAddressBook: null,
+    updateSetting: () => {},
+  };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useSettingsStore: hook };
+});
+
+vi.mock('@/stores/contact-store', () => {
+  const state = {
+    contacts: [],
+    getAutocomplete: async () => [],
+    addToTrustedSendersBook: async () => {},
+  };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useContactStore: hook };
+});
+
+vi.mock('@/stores/template-store', () => {
+  const state = { templates: [], addTemplate: async () => {} };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useTemplateStore: hook };
+});
+
+// ─── Misc dependency mocks ────────────────────────────────────────────────────
+
+vi.mock('@/stores/toast-store', () => ({
+  toast: { info: () => {}, error: () => {}, success: () => {} },
+}));
+
+vi.mock('@/lib/plugin-hooks', () => ({
+  identityHooks: {
+    onSignatureRender: {
+      get size() { return signaturePlugin.on ? 1 : 0; },
+      transform: async (value: { html: string; text: string }) => ({ html: `${value.html}<p>PLUGIN</p>`, text: `${value.text} PLUGIN` }),
+    },
+    onIdentitySelect: { size: 0, emit: async () => {} },
+  },
+  templateHooks: {
+    onTemplateRender: { size: 0, transform: async (value: unknown) => value },
+    onTemplateApply: { size: 0, emit: async () => {} },
+  },
+  emailHooks: {
+    onComposerOpen: { call: async () => [] },
+    onRecipientChange: { call: async () => [] },
+    getRecipientSuggestions: { call: async () => [] },
+    onRecipientChipsChange: { transform: async (chips: unknown) => chips },
+    onDraftChange: { emit: () => {} },
+    onBeforeDraftAutoSave: { transform: async (draft: unknown) => draft },
+    onBeforeEmailSend: {
+      size: 1,
+      intercept: async () => true,
+      interceptOutcome: async (email: unknown) => { sendChecks.seen.push(email); return 'allowed'; },
+    },
+    onComposeSend: {
+      takeOver: async (request: { htmlBody: string; textBody: string }) => {
+        if (!sendPlugins.takeOver) return 'default';
+        sendPlugins.takeOver(request);
+        return 'handled';
+      },
+    },
+    onTransformOutgoingEmail: {
+      transform: async (email: { htmlBody: string; textBody: string }) => (sendPlugins.footer
+        ? { ...email, htmlBody: `${email.htmlBody}<p>Plugin footer</p>`, textBody: `${email.textBody}\n\nPlugin footer` }
+        : email),
+    },
+  },
+  contactHooks: {
+    search: { call: async () => [] },
+    onProvideRecipientSuggestions: { transform: async (initial: unknown) => initial },
+  },
+}));
+
+vi.mock('@/lib/email-sanitization', () => ({
+  sanitizeSignatureHtml: (v: string) => v,
+  sanitizeSignatureHtmlForDisplay: (v: string) => v,
+  sanitizeEmailHtml: (v: string) => v,
+  sanitizePluginBodyHtml: (v: string) => v,
+  escapeHtml: (v: string) => v,
+  parseHtmlSafely: (html: string) => new DOMParser().parseFromString(html, 'text/html'),
+}));
+
+vi.mock('@/lib/email-threading', () => ({
+  computeReplyThreadingHeaders: () => ({ inReplyTo: [], references: [] }),
+}));
+vi.mock('@/lib/sub-addressing', () => ({ generateSubAddress: () => '' }));
+vi.mock('@/lib/debug', () => ({ debug: { log: () => {}, warn: () => {}, error: () => {} } }));
+vi.mock('@/components/email/quoted-html', () => ({
+  buildQuotedHtmlBlock: (html: string) => `<div data-quoted-html="">${html}</div>`,
+  serializeEditorContent: () => editorState.html,
+}));
+vi.mock('@/lib/template-utils', () => ({ substitutePlaceholders: (s: string) => s }));
+
+// ─── Tests ────────────────────────────────────────────────────────────────────
+
+/**
+ * A send check plugin gets what it needs to judge a message without the
+ * quoted original and without the policy: the user's own text, the
+ * recipients outside the organisation, where the send comes from.
+ */
+
+const DRAFT = {
+  to: 'bob@example.com, Carol <carol@partner.test>',
+  cc: '',
+  bcc: 'mallory@evil.test',
+  subject: 'Re: Invoice',
+  body: '<p>Pay to DE89 3704 0044 0532 0130 00 please.</p><blockquote>Quoted: DE44 5001 0517 5407 3249 31</blockquote>',
+  showCc: false,
+  showBcc: true,
+  selectedIdentityId: 'id-me',
+  subAddressTag: '',
+  mode: 'compose' as const,
+  draftId: 'draft-1',
+};
+
+function setPolicy(domains: string[]) {
+  const policy: SettingsPolicy = {
+    ...DEFAULT_POLICY,
+    organisation: {
+      ...DEFAULT_ORGANISATION_POLICY,
+      externalMail: { ...DEFAULT_ORGANISATION_POLICY.externalMail, recipientWarning: false, domains },
+    },
+  };
+  usePolicyStore.setState({ policy, rawPolicy: policy, subject: null });
+}
+
+describe('composer: what a send check plugin gets', () => {
+  beforeEach(() => {
+    resetSendPipeline();
+    sendChecks.seen = [];
+    setPolicy([]);
+  });
+  afterEach(() => {
+    resetSendPipeline();
+    vi.clearAllMocks();
+  });
+
+  it('the authored text without the quote, the external recipients and the surface', async () => {
+    const onSend = vi.fn();
+    render(<EmailComposer mode="reply" initialData={{ ...DRAFT, mode: 'reply' as const }} onSend={onSend} />);
+    fireEvent.click(screen.getAllByTestId('composer-send')[0]);
+    await waitFor(() => expect(onSend).toHaveBeenCalledTimes(1));
+    expect(sendChecks.seen).toHaveLength(1);
+    const email = sendChecks.seen[0] as OutgoingEmail;
+    expect(email.surface).toBe('composer');
+    expect(email.mode).toBe('reply');
+    expect(email.authoredText).toContain('DE89 3704 0044 0532 0130 00');
+    expect(email.authoredText).not.toContain('DE44');
+    expect(email.htmlBody).toContain('DE44');
+    // Internal: the identity's own domain. The admin's warning is off.
+    expect(email.externalRecipients).toEqual(['carol@partner.test', 'mallory@evil.test']);
+  });
+
+  it("counts the admin's organisation domains as internal", async () => {
+    setPolicy(['partner.test']);
+    const onSend = vi.fn();
+    render(<EmailComposer initialData={DRAFT} onSend={onSend} />);
+    fireEvent.click(screen.getAllByTestId('composer-send')[0]);
+    await waitFor(() => expect(onSend).toHaveBeenCalledTimes(1));
+    expect((sendChecks.seen[0] as OutgoingEmail).externalRecipients).toEqual(['mallory@evil.test']);
+  });
+});
diff --git a/components/email/email-composer.tsx b/components/email/email-composer.tsx
index 9864a3cce..6febe2b36 100644
--- a/components/email/email-composer.tsx
+++ b/components/email/email-composer.tsx
@@ -113,6 +113,8 @@ import { wantsSignatureSeparator } from "@/lib/signature-delimiter";
 import { finalizeOutgoing, runPreSendChecks, type OutgoingContext } from "@/lib/outgoing/send-pipeline";
 import { classifyOutgoing, isLabelRequiredError, labelMissing, labelsPolicyFor, resolveLabel, type OriginalMessage } from "@/lib/outgoing/classification";
 import { beginLabelTakeover, endLabelTakeover } from "@/lib/outgoing/classification-raw";
+import { runPluginSendCheck } from "@/lib/outgoing/plugin-send-check";
+import { externalRecipientsFor, inspectAttachments, sniffFile } from "@/lib/outgoing/send-check-payload";
 import { whenPolicySettled } from "@/stores/policy-store";
 import { ClassificationLabelPicker, type ClassificationPickerHandle } from "./classification-label-picker";
 import { useComposerClassification } from "./use-composer-classification";
@@ -2220,10 +2222,12 @@ export function EmailComposer({
     // Let plugins veto each upload before it's queued.
     const allowedFiles: File[] = [];
     for (const file of files) {
+      const sniffedType = emailHooks.onBeforeAttachmentUpload.size > 0 ? await sniffFile(file) : undefined;
       const ok = await emailHooks.onBeforeAttachmentUpload.intercept({
         name: file.name,
         type: file.type || 'application/octet-stream',
         size: file.size,
+        ...(sniffedType ? { sniffedType } : {}),
       });
       if (ok) allowedFiles.push(file);
     }
@@ -3608,8 +3612,16 @@ export function EmailComposer({
     try {
       const effectiveDelayedUntil = await resolveDelayedUntil(delayedUntil);
       // Let plugins veto the send (external-mail warning, mistyped-domain
-      // guards, etc.). Returning false from any handler aborts before either
-      // the S/MIME or standard JMAP path runs.
+      // guards, send checks). Returning false from any handler aborts before
+      // either the S/MIME or standard JMAP path runs. What a send check needs
+      // beyond the bodies (lib/outgoing/send-check-payload.ts) is worked out
+      // only while a plugin listens.
+      const checking = emailHooks.onBeforeEmailSend.size > 0;
+      const sendClient = composerClientRef.current ?? client;
+      const readBlob = (blobId: string, name: string, type: string, bytes: number) => (sendClient
+        ? sendClient.fetchBlobArrayBuffer(blobId, name, type, undefined, bytes)
+        : Promise.reject(new Error('No client')));
+      const sentAttachments = attachmentsRef.current.filter(att => att.blobId && !att.uploading && !att.error);
       const sendablePreview: OutgoingEmail = {
         to: toAddresses.map(r => formatRecipient(r.name, r.email)),
         cc: ccAddresses.map(r => formatRecipient(r.name, r.email)),
@@ -3619,12 +3631,28 @@ export function EmailComposer({
         textBody: finalBody,
         identityId: currentIdentity?.id || '',
         fromEmail,
-        attachments: attachmentsRef.current
-          .filter(att => att.blobId && !att.uploading && !att.error)
-          .map(a => ({ name: a.name, type: a.type || 'application/octet-stream', size: a.size })),
+        attachments: checking
+          ? await inspectAttachments([
+            ...sentAttachments.map(a => ({
+              name: a.name, type: a.type, size: a.size, blobId: a.blobId, file: a.file,
+              load: (bytes: number) => readBlob(a.blobId!, a.name, a.type, bytes),
+            })),
+            ...inlineAttachments.map(a => ({
+              name: a.name, type: a.type, size: a.size, blobId: a.blobId, inline: true,
+              load: (bytes: number) => readBlob(a.blobId, a.name, a.type, bytes),
+            })),
+          ])
+          : sentAttachments.map(a => ({ name: a.name, type: a.type || 'application/octet-stream', size: a.size, blobId: a.blobId })),
         inReplyTo: threadingHeaders?.inReplyTo?.[0],
+        surface: 'composer',
+        mode,
+        authoredText: extractUserAuthoredText(
+          plainTextMode ? plainTextBodyWithoutSignature(body, signatureIdentity) : stripEmbeddedSignatureHtml(body),
+          { plainTextMode, forwardedSeparator: tQuote('forwarded_separator') },
+        ),
+        externalRecipients: checking ? await externalRecipientsFor(outgoingContext) : [],
       };
-      const sendCheck = await emailHooks.onBeforeEmailSend.interceptOutcome(sendablePreview);
+      const sendCheck = await runPluginSendCheck(sendablePreview);
       if (sendCheck !== 'allowed') {
         // A plugin vetoed the send (it is expected to show its own UI).
         // Leave a trace so a silent no-op send is diagnosable (#592).
diff --git a/lib/__tests__/plugin-host-email-forward.test.ts b/lib/__tests__/plugin-host-email-forward.test.ts
index 050a26bd9..463ba96c2 100644
--- a/lib/__tests__/plugin-host-email-forward.test.ts
+++ b/lib/__tests__/plugin-host-email-forward.test.ts
@@ -19,6 +19,7 @@ vi.mock('@/stores/toast-store', () => ({
 }));
 
 import { dispatchApiCall } from '../plugin-sandbox/host-api';
+import type { OutgoingEmail } from '../plugin-types';
 
 function plugin(perms: string[], id = 'e-invoice'): InstalledPlugin {
   return {
@@ -186,6 +187,29 @@ describe('api.email.forward', () => {
     }
   });
 
+  it("gives send checks the note, the recipients outside and what the attachments really are", async () => {
+    const seen: OutgoingEmail[] = [];
+    client.fetchBlobArrayBuffer = vi.fn(async (blobId: string) => new TextEncoder().encode(blobId === 'pdf-1' ? 'MZ' : '<Invoice/>').buffer);
+    const off = emailHooks.onBeforeEmailSend.register('send-checks', (outgoing: OutgoingEmail) => { seen.push(outgoing); return false; });
+    try {
+      const pending = call(FORWARDER, 'email.forward', 'E1', { to: ['books@outside.test', 'ann2@example.com'], text: 'Please book this.' });
+      await answerDialog(true);
+      expect(await pending).toEqual({ sent: false, reason: 'stopped' });
+      expect(seen[0]).toMatchObject({
+        surface: 'plugin-forward',
+        mode: 'forward',
+        authoredText: 'Please book this.',
+        externalRecipients: ['books@outside.test'],
+      });
+      expect(seen[0].attachments).toEqual([
+        { name: 'invoice.pdf', type: 'application/pdf', size: 5000, blobId: 'pdf-1', sniffedType: 'application/x-msdownload' },
+        { name: 'xrechnung.xml', type: 'application/xml', size: 3000, blobId: 'xml-1', sniffedType: 'text/plain', textExcerpt: '<Invoice/>' },
+      ]);
+    } finally {
+      off.dispose();
+    }
+  });
+
   it('needs email:forward and sound input', async () => {
     await expect(call(plugin(['email:read', 'email:send']), 'email.forward', 'E1', { to: ['a@example.com'] }))
       .rejects.toThrow(/lacks permission "email:forward"/);
diff --git a/lib/outgoing/__tests__/quick-reply.test.ts b/lib/outgoing/__tests__/quick-reply.test.ts
index 723e96556..3ff01cb8d 100644
--- a/lib/outgoing/__tests__/quick-reply.test.ts
+++ b/lib/outgoing/__tests__/quick-reply.test.ts
@@ -134,6 +134,14 @@ describe('prepareQuickReply and plugin send checks', () => {
     expect(seen[0].textBody).toContain('IBAN DE89370400440532013000');
   });
 
+  it('hands over the typed text and the recipients outside the organisation', async () => {
+    const seen: OutgoingEmail[] = [];
+    emailHooks.onBeforeEmailSend.register('guard', (email: OutgoingEmail) => { seen.push(email); return undefined; });
+    expect(await prepareQuickReply({ ...input(text), body: 'Card 4242 4242 4242 4242', to: ['bob@example.com', 'Eve@Other.test'] })).not.toBeNull();
+    expect(seen[0].authoredText).toBe('Card 4242 4242 4242 4242');
+    expect(seen[0].externalRecipients).toEqual(['eve@other.test']);
+  });
+
   it('fails closed when a check crashes', async () => {
     emailHooks.onBeforeEmailSend.register('guard', () => { throw new Error('boom'); });
     const stopped: string[] = [];
diff --git a/lib/outgoing/__tests__/send-check-payload.test.ts b/lib/outgoing/__tests__/send-check-payload.test.ts
new file mode 100644
index 000000000..3b1dce85a
--- /dev/null
+++ b/lib/outgoing/__tests__/send-check-payload.test.ts
@@ -0,0 +1,126 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { externalRecipientsFor, inspectAttachments, sniffFile, TEXT_EXCERPT_BYTES } from '../send-check-payload';
+import { isTextAttachment, sniffType, SNIFF_BYTES } from '../attachment-sniff';
+import type { OutgoingContext } from '../send-pipeline';
+import { DEFAULT_ORGANISATION_POLICY } from '@/lib/admin/organisation-policy';
+import { DEFAULT_POLICY } from '@/lib/admin/types';
+import { usePolicyStore } from '@/stores/policy-store';
+import { useAuthStore } from '@/stores/auth-store';
+import type { Identity } from '@/lib/jmap/types';
+import { hookArgsFor } from '@/lib/plugin-sandbox/hook-payload';
+import type { InstalledPlugin, OutgoingEmail } from '@/lib/plugin-types';
+
+vi.mock('@/lib/debug', () => ({ debug: { log: () => {}, warn: () => {}, error: () => {} } }));
+
+const bytes = (...parts: (number[] | string)[]) => new Uint8Array(parts.flatMap((p) => (typeof p === 'string' ? Array.from(new TextEncoder().encode(p)) : p)));
+
+describe('sniffType', () => {
+  it('names programs and archives by their first bytes, whatever the name says', () => {
+    expect(sniffType(bytes('MZ', [0x90, 0, 3]))).toBe('application/x-msdownload');
+    expect(sniffType(bytes([0x7f], 'ELF', [2, 1]))).toBe('application/x-executable');
+    expect(sniffType(bytes('PK', [3, 4, 20, 0]))).toBe('application/zip');
+    expect(sniffType(bytes([0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1, 0]))).toBe('application/x-ole-storage');
+    expect(sniffType(bytes('%PDF-1.7\n'))).toBe('application/pdf');
+    expect(sniffType(bytes([0x89], 'PNG', [0x0d, 0x0a, 0x1a, 0x0a]))).toBe('image/png');
+    expect(sniffType(bytes('RIFF', [0, 0, 0, 0], 'WEBPVP8 '))).toBe('image/webp');
+    expect(sniffType(bytes('#!/bin/sh\nrm -rf /\n'))).toBe('text/x-shellscript');
+  });
+
+  it('tells HTML and plain text from binary data', () => {
+    expect(sniffType(bytes('\uFEFF  <!DOCTYPE html><html>'))).toBe('text/html');
+    expect(sniffType(bytes('IBAN;Name\nDE89370400440532013000;Alice\n'))).toBe('text/plain');
+    // A character cut off at the end of the head is still text.
+    expect(sniffType(bytes('Grüße', [0xc3]))).toBe('text/plain');
+    expect(sniffType(bytes('abc', [0], 'def'))).toBeUndefined();
+    expect(sniffType(bytes([0xff, 0xfe, 0x41]))).toBeUndefined();
+    expect(sniffType(new Uint8Array())).toBeUndefined();
+  });
+
+  it('knows text attachments by type, else by extension', () => {
+    expect(isTextAttachment('a.bin', 'text/csv')).toBe(true);
+    expect(isTextAttachment('export.csv', 'application/octet-stream')).toBe(true);
+    expect(isTextAttachment('data.json', '')).toBe(true);
+    expect(isTextAttachment('photo.jpg', 'image/jpeg')).toBe(false);
+  });
+});
+
+describe('inspectAttachments', () => {
+  it('reads a local text file: its type and the text', async () => {
+    const file = new Blob(['IBAN DE89 3704 0044 0532 0130 00']);
+    const [out] = await inspectAttachments([{ name: 'list.csv', type: 'text/csv', size: file.size, blobId: 'b1', file }]);
+    expect(out).toEqual({
+      name: 'list.csv', type: 'text/csv', size: file.size, blobId: 'b1',
+      sniffedType: 'text/plain', textExcerpt: 'IBAN DE89 3704 0044 0532 0130 00',
+    });
+  });
+
+  it('reads a server blob: a megabyte of a text file, only the head of anything else', async () => {
+    const asked: number[] = [];
+    const load = (content: string) => async (n: number) => { asked.push(n); return new TextEncoder().encode(content).buffer as ArrayBuffer; };
+    const out = await inspectAttachments([
+      { name: 'notes.txt', type: 'text/plain', size: 10, blobId: 'b1', load: load('hello') },
+      { name: 'invoice.pdf', type: 'application/pdf', size: 9_000_000, blobId: 'b2', load: load('MZ\u0090') },
+    ]);
+    expect(asked).toEqual([TEXT_EXCERPT_BYTES, SNIFF_BYTES]);
+    expect(out[0]).toMatchObject({ sniffedType: 'text/plain', textExcerpt: 'hello' });
+    // A renamed program: the name and type say PDF, the bytes don't.
+    expect(out[1]).toEqual({ name: 'invoice.pdf', type: 'application/pdf', size: 9_000_000, blobId: 'b2', sniffedType: 'application/x-msdownload' });
+  });
+
+  it("doesn't read a program named .txt as text, nor inline images", async () => {
+    const out = await inspectAttachments([
+      { name: 'readme.txt', type: 'text/plain', size: 3, file: new Blob([bytes('MZ', [0x90])]) },
+      { name: 'pasted.png', type: 'image/png', size: 8, blobId: 'b3', inline: true, file: new Blob([bytes([0x89], 'PNG', [0x0d, 0x0a, 0x1a, 0x0a])]) },
+    ]);
+    expect(out[0]).toEqual({ name: 'readme.txt', type: 'text/plain', size: 3, sniffedType: 'application/x-msdownload' });
+    expect(out[1]).toEqual({ name: 'pasted.png', type: 'image/png', size: 8, blobId: 'b3', inline: true, sniffedType: 'image/png' });
+  });
+
+  it('passes a file it cannot read on without the two fields', async () => {
+    const [out] = await inspectAttachments([{ name: 'a.txt', type: '', size: 1, blobId: 'b', load: async () => { throw new Error('offline'); } }]);
+    expect(out).toEqual({ name: 'a.txt', type: 'application/octet-stream', size: 1, blobId: 'b' });
+  });
+
+  it('sniffs a file before upload', async () => {
+    expect(await sniffFile(new Blob([bytes('MZ', [0x90])]))).toBe('application/x-msdownload');
+  });
+});
+
+describe('externalRecipientsFor', () => {
+  const context = (to: string[], bcc: string[] = []): OutgoingContext => ({
+    surface: 'composer', to, cc: [], bcc, fromEmail: 'alice@example.org', identityId: 'i1', mode: 'compose', plainText: false,
+    sender: { name: 'Alice', email: 'alice@example.org' },
+  });
+  beforeEach(() => {
+    useAuthStore.setState({ client: null, identities: [{ id: 'i1', name: 'Alice', email: 'alice@example.org' } as unknown as Identity] });
+  });
+
+  it("lists recipients outside the organisation's domains also while the admin's warning is off", async () => {
+    usePolicyStore.setState({
+      policy: {
+        ...DEFAULT_POLICY,
+        organisation: {
+          ...DEFAULT_ORGANISATION_POLICY,
+          externalMail: { ...DEFAULT_ORGANISATION_POLICY.externalMail, recipientWarning: false, domains: ['partner.example'] },
+        },
+      },
+    });
+    expect(await externalRecipientsFor(context(['bob@example.org', 'Carol@Partner.Example', 'eve@other.test'], ['x@sub.example.org', 'Mallory@Evil.test'])))
+      .toEqual(['eve@other.test', 'mallory@evil.test']);
+    expect(await externalRecipientsFor(context(['bob@example.org']))).toEqual([]);
+  });
+});
+
+describe('hookArgsFor', () => {
+  const email = {
+    to: [], cc: [], bcc: [], subject: '', htmlBody: '', textBody: '', identityId: '',
+    attachments: [{ name: 'a.txt', type: 'text/plain', size: 1, textExcerpt: 'secret' }],
+  } as OutgoingEmail;
+  const plugin = (permissions: string[]) => ({ id: 'p', permissions, managed: true } as unknown as InstalledPlugin);
+
+  it('gives the text of attachments only to a plugin that may read files', () => {
+    expect((hookArgsFor(plugin(['email:send']), 'onBeforeEmailSend', [email])[0] as OutgoingEmail).attachments[0]).toEqual({ name: 'a.txt', type: 'text/plain', size: 1 });
+    expect((hookArgsFor(plugin(['email:send', 'email:blob-read']), 'onBeforeEmailSend', [email])[0] as OutgoingEmail).attachments[0].textExcerpt).toBe('secret');
+    expect(email.attachments[0].textExcerpt).toBe('secret');
+  });
+});
diff --git a/lib/outgoing/attachment-sniff.ts b/lib/outgoing/attachment-sniff.ts
new file mode 100644
index 000000000..1671a1c27
--- /dev/null
+++ b/lib/outgoing/attachment-sniff.ts
@@ -0,0 +1,92 @@
+/**
+ * What a file really is, read from its first bytes: a renamed program
+ * (invoice.pdf that starts with "MZ") is still a program. Used for the
+ * attachment information plugins get before an upload and before a send
+ * (AttachmentInfo.sniffedType, OutgoingEmail.attachments[].sniffedType).
+ *
+ * Only well-known signatures; anything else is undefined, never a guess
+ * from the name.
+ */
+
+/** Bytes a sniff needs; read at most this much for a binary file. */
+export const SNIFF_BYTES = 4096;
+
+const startsWith = (bytes: Uint8Array, sig: readonly number[], offset = 0): boolean =>
+  bytes.length >= offset + sig.length && sig.every((b, i) => bytes[offset + i] === b);
+
+const ascii = (text: string): number[] => Array.from(text, (c) => c.charCodeAt(0));
+
+const SIGNATURES: readonly { sig: readonly number[]; offset?: number; type: string }[] = [
+  { sig: ascii('MZ'), type: 'application/x-msdownload' },
+  { sig: [0x7f, 0x45, 0x4c, 0x46], type: 'application/x-executable' },
+  { sig: [0xcf, 0xfa, 0xed, 0xfe], type: 'application/x-mach-binary' },
+  { sig: [0xce, 0xfa, 0xed, 0xfe], type: 'application/x-mach-binary' },
+  { sig: [0xfe, 0xed, 0xfa, 0xcf], type: 'application/x-mach-binary' },
+  { sig: [0xfe, 0xed, 0xfa, 0xce], type: 'application/x-mach-binary' },
+  { sig: [0xca, 0xfe, 0xba, 0xbe], type: 'application/x-mach-binary' },
+  { sig: [0x4c, 0x00, 0x00, 0x00, 0x01, 0x14, 0x02, 0x00], type: 'application/x-ms-shortcut' },
+  { sig: ascii('MSCF'), type: 'application/vnd.ms-cab-compressed' },
+  { sig: [0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1], type: 'application/x-ole-storage' },
+  { sig: [0x50, 0x4b, 0x03, 0x04], type: 'application/zip' },
+  { sig: [0x50, 0x4b, 0x05, 0x06], type: 'application/zip' },
+  { sig: [0x50, 0x4b, 0x07, 0x08], type: 'application/zip' },
+  { sig: ascii('Rar!\x1a\x07'), type: 'application/x-rar-compressed' },
+  { sig: [0x37, 0x7a, 0xbc, 0xaf, 0x27, 0x1c], type: 'application/x-7z-compressed' },
+  { sig: [0x1f, 0x8b], type: 'application/gzip' },
+  { sig: ascii('%PDF-'), type: 'application/pdf' },
+  { sig: ascii('{\\rtf'), type: 'application/rtf' },
+  { sig: [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a], type: 'image/png' },
+  { sig: [0xff, 0xd8, 0xff], type: 'image/jpeg' },
+  { sig: ascii('GIF87a'), type: 'image/gif' },
+  { sig: ascii('GIF89a'), type: 'image/gif' },
+  { sig: ascii('#!'), type: 'text/x-shellscript' },
+];
+
+/** The MIME type the bytes start with, or undefined when none is known. */
+export function sniffType(bytes: Uint8Array): string | undefined {
+  for (const { sig, offset, type } of SIGNATURES) {
+    if (startsWith(bytes, sig, offset)) return type;
+  }
+  if (startsWith(bytes, ascii('RIFF')) && startsWith(bytes, ascii('WEBP'), 8)) return 'image/webp';
+  return sniffText(bytes);
+}
+
+/** text/html or text/plain for text without NUL bytes that decodes as UTF-8. */
+function sniffText(bytes: Uint8Array): string | undefined {
+  if (bytes.length === 0) return undefined;
+  const head = bytes.subarray(0, Math.min(bytes.length, SNIFF_BYTES));
+  if (head.includes(0)) return undefined;
+  let text: string;
+  try {
+    // A multi-byte character cut at the end of the head is fine.
+    text = new TextDecoder('utf-8', { fatal: true }).decode(head.subarray(0, trimPartialUtf8(head)));
+  } catch {
+    return undefined;
+  }
+  const start = text.replace(/^\uFEFF/, '').trimStart().slice(0, 64).toLowerCase();
+  if (start.startsWith('<!doctype html') || start.startsWith('<html')) return 'text/html';
+  return 'text/plain';
+}
+
+/** Length of `bytes` without a UTF-8 sequence cut off at its end. */
+function trimPartialUtf8(bytes: Uint8Array): number {
+  let end = bytes.length;
+  for (let back = 1; back <= 3 && end - back >= 0; back++) {
+    const b = bytes[end - back];
+    if ((b & 0xc0) === 0x80) continue; // continuation byte
+    const need = b >= 0xf0 ? 4 : b >= 0xe0 ? 3 : b >= 0xc0 ? 2 : 1;
+    return need > back ? end - back : end;
+  }
+  return end;
+}
+
+const TEXT_EXTENSIONS = new Set(['txt', 'csv', 'tsv', 'json', 'xml', 'ics', 'vcf', 'md', 'log', 'htm', 'html', 'yaml', 'yml', 'ini', 'conf']);
+const TEXT_TYPES = new Set(['application/json', 'application/xml', 'application/csv', 'application/x-yaml', 'application/yaml']);
+
+/** Whether a file is text a send check may read: by type, else by extension. */
+export function isTextAttachment(name: string, type: string): boolean {
+  const t = (type || '').toLowerCase().split(';')[0].trim();
+  if (t.startsWith('text/') || TEXT_TYPES.has(t)) return true;
+  const ext = name.toLowerCase().match(/\.([a-z0-9]+)$/)?.[1];
+  return !!ext && TEXT_EXTENSIONS.has(ext);
+}
diff --git a/lib/outgoing/quick-reply.ts b/lib/outgoing/quick-reply.ts
index 41bf5cf84..d0a6ed207 100644
--- a/lib/outgoing/quick-reply.ts
+++ b/lib/outgoing/quick-reply.ts
@@ -4,6 +4,8 @@ import { currentSignatureIdentity } from '@/lib/org/signature-state';
 import { findUnfilledPlaceholders, type PlaceholderWords } from '@/lib/placeholder-check';
 import { finalizeOutgoing, runPreSendChecks, type OutgoingBodies } from './send-pipeline';
 import { runPluginSendCheck, type PluginSendCheckOutcome } from './plugin-send-check';
+import { externalRecipientsFor } from './send-check-payload';
+import { emailHooks } from '@/lib/plugin-hooks';
 // Registers the organisation signature check and the disclaimer.
 import '@/lib/org/outgoing';
 
@@ -111,6 +113,9 @@ export async function prepareQuickReply(input: {
     inReplyTo: input.inReplyTo,
     surface: 'quick-reply',
     mode: 'reply',
+    // The quote isn't part of a quick reply: the typed text is all the user wrote.
+    authoredText: body,
+    externalRecipients: emailHooks.onBeforeEmailSend.size > 0 ? await externalRecipientsFor(context) : [],
   });
   if (outcome !== 'allowed') {
     input.onSendCheckStopped?.(outcome);
diff --git a/lib/outgoing/send-check-payload.ts b/lib/outgoing/send-check-payload.ts
new file mode 100644
index 000000000..c4799a7ce
--- /dev/null
+++ b/lib/outgoing/send-check-payload.ts
@@ -0,0 +1,99 @@
+/**
+ * What plugins' send checks (onBeforeEmailSend) get beyond the message
+ * itself, so a rule such as "warn about an IBAN, only when the mail leaves
+ * the organisation" works without exposing the policy:
+ *
+ * - `externalRecipients`: the recipients outside the organisation of the
+ *   account the mail goes out from (its identity domains plus the admin's
+ *   organisation domains), filled whether or not the admin's recipient
+ *   warning is on;
+ * - per attachment the blobId, whether it is inline, the type its first
+ *   bytes say (sniffedType) and, for text files, the first megabyte as text
+ *   (textExcerpt; only plugins with `email:blob-read` see it, see
+ *   lib/plugin-sandbox/hook-payload.ts).
+ *
+ * Attachments are read only while a plugin listens, and a file that can't
+ * be read is passed on without the two fields.
+ */
+
+import type { OutgoingAttachment } from '@/lib/plugin-types';
+import { addressDomain, addressKey, contextInternalDomains, externalMailContextFor, externalRecipients } from '@/lib/external-mail';
+import { debug } from '@/lib/debug';
+import { isTextAttachment, sniffType, SNIFF_BYTES } from './attachment-sniff';
+import type { OutgoingContext } from './send-pipeline';
+
+/** Most of a text attachment a plugin gets as text. */
+export const TEXT_EXCERPT_BYTES = 1024 * 1024;
+
+/** The recipients outside the sending account's organisation, as bare lowercase addresses. */
+export async function externalRecipientsFor(context: OutgoingContext): Promise<string[]> {
+  const account = await externalMailContextFor(context.sender?.accountId);
+  const internal = contextInternalDomains(account);
+  // As the recipient warning: the identity's own domain is internal, a From
+  // typed over it in the composer is not.
+  const identityEmail = context.sender?.email ?? (context.surface === 'composer' ? undefined : context.fromEmail);
+  const identityDomain = addressDomain(identityEmail);
+  if (identityDomain && !internal.includes(identityDomain)) internal.push(identityDomain);
+  return externalRecipients(context, internal).map((r) => addressKey(r.address));
+}
+
+export interface SendCheckAttachmentSource {
+  name: string;
+  type: string;
+  size: number;
+  blobId?: string;
+  inline?: boolean;
+  /** The bytes, when the browser still has them (a file the user picked). */
+  file?: Blob;
+  /** Reads up to `bytes` bytes of the blob from the server otherwise. */
+  load?: (bytes: number) => Promise<ArrayBuffer>;
+}
+
+async function headOf(source: SendCheckAttachmentSource, bytes: number): Promise<Uint8Array | null> {
+  try {
+    if (source.file) return new Uint8Array(await source.file.slice(0, bytes).arrayBuffer());
+    if (source.load) return new Uint8Array((await source.load(bytes)).slice(0, bytes));
+  } catch (error) {
+    debug.warn('email', `Could not read ${source.name} for the send checks:`, error);
+  }
+  return null;
+}
+
+function decodeExcerpt(bytes: Uint8Array): string {
+  return new TextDecoder('utf-8').decode(bytes).replace(/\uFFFD+$/, '');
+}
+
+/** The attachment list for onBeforeEmailSend, with sniffedType and text excerpts. */
+export async function inspectAttachments(sources: readonly SendCheckAttachmentSource[]): Promise<OutgoingAttachment[]> {
+  const out: OutgoingAttachment[] = [];
+  // One at a time: a send rarely has many, and downloads share the
+  // server's request slots with everything else.
+  for (const source of sources) {
+    const entry: OutgoingAttachment = {
+      name: source.name,
+      type: source.type || 'application/octet-stream',
+      size: source.size,
+      ...(source.blobId ? { blobId: source.blobId } : {}),
+      ...(source.inline ? { inline: true } : {}),
+    };
+    const text = !source.inline && isTextAttachment(source.name, source.type);
+    const head = await headOf(source, text ? TEXT_EXCERPT_BYTES : SNIFF_BYTES);
+    if (head) {
+      const sniffed = sniffType(head);
+      if (sniffed) entry.sniffedType = sniffed;
+      // A "text" file whose bytes say it is a program is not read as text.
+      if (text && (!sniffed || sniffed.startsWith('text/'))) entry.textExcerpt = decodeExcerpt(head);
+    }
+    out.push(entry);
+  }
+  return out;
+}
+
+/** sniffedType of a file about to be attached (onBeforeAttachmentUpload). */
+export async function sniffFile(file: Blob): Promise<string | undefined> {
+  try {
+    return sniffType(new Uint8Array(await file.slice(0, SNIFF_BYTES).arrayBuffer()));
+  } catch {
+    return undefined;
+  }
+}
diff --git a/lib/plugin-sandbox/hook-payload.ts b/lib/plugin-sandbox/hook-payload.ts
new file mode 100644
index 000000000..9847a8c6a
--- /dev/null
+++ b/lib/plugin-sandbox/hook-payload.ts
@@ -0,0 +1,26 @@
+// What one plugin gets of a hook's arguments. The bus hands every handler
+// the same value; a part that needs a permission beyond the hook's own is
+// cut here, per plugin, before it crosses into the sandbox.
+
+import type { InstalledPlugin, OutgoingEmail } from '../plugin-types';
+import { pluginHasPermission } from './permissions';
+
+/** onBeforeEmailSend without the text of attachments, for a plugin that may not read files. */
+function withoutTextExcerpts(email: OutgoingEmail): OutgoingEmail {
+  if (!Array.isArray(email?.attachments) || !email.attachments.some((a) => a && 'textExcerpt' in a)) return email;
+  return {
+    ...email,
+    attachments: email.attachments.map((attachment) => {
+      const { textExcerpt: _omit, ...rest } = attachment;
+      void _omit;
+      return rest;
+    }),
+  };
+}
+
+export function hookArgsFor(plugin: InstalledPlugin, hookName: string, args: unknown[]): unknown[] {
+  if (hookName === 'onBeforeEmailSend' && !pluginHasPermission(plugin, 'email:blob-read') && args[0]) {
+    return [withoutTextExcerpts(args[0] as OutgoingEmail), ...args.slice(1)];
+  }
+  return args;
+}
diff --git a/lib/plugin-sandbox/host-api-forward.ts b/lib/plugin-sandbox/host-api-forward.ts
index 98ae6c4ef..aeeec84d3 100644
--- a/lib/plugin-sandbox/host-api-forward.ts
+++ b/lib/plugin-sandbox/host-api-forward.ts
@@ -26,6 +26,8 @@ import { emailHooks } from '../plugin-hooks';
 import { announceSent } from '../plugin-after-send';
 import { buildForwardSubject } from '../subject-prefix';
 import { finalizeOutgoing, runPreSendChecks } from '../outgoing/send-pipeline';
+import { runPluginSendCheck } from '../outgoing/plugin-send-check';
+import { externalRecipientsFor, inspectAttachments } from '../outgoing/send-check-payload';
 import { automaticLabel, classifyOutgoing } from '../outgoing/classification';
 import { whenPolicySettled } from '@/stores/policy-store';
 import { toast } from '@/stores/toast-store';
@@ -193,9 +195,21 @@ export async function doEmailForward(
       textBody: body,
       identityId: identity.id,
       fromEmail: identity.email,
-      attachments: attachments.map((a) => ({ name: a.name || 'attachment', type: a.type || 'application/octet-stream', size: a.size })),
+      // The original's parts, read where they are (the message's own account).
+      attachments: await inspectAttachments(attachments.map((a) => ({
+        name: a.name || 'attachment',
+        type: a.type || 'application/octet-stream',
+        size: a.size,
+        blobId: a.blobId,
+        load: (bytes: number) => client.fetchBlobArrayBuffer(a.blobId, a.name || undefined, a.type || undefined, sourceAccountId, bytes),
+      }))),
+      surface: 'plugin-forward',
+      mode: 'forward',
+      // The plugin's note is the only text written for this forward.
+      authoredText: note,
+      externalRecipients: await externalRecipientsFor(context),
     };
-    if ((await emailHooks.onBeforeEmailSend.interceptOutcome(outgoing)) !== 'allowed') return { sent: false, reason: 'stopped' };
+    if ((await runPluginSendCheck(outgoing)) !== 'allowed') return { sent: false, reason: 'stopped' };
   }
 
   // The attachments are blobs of the account the original is in; a message
diff --git a/lib/plugin-sandbox/loader.ts b/lib/plugin-sandbox/loader.ts
index 2fee26ee0..4db15dc85 100644
--- a/lib/plugin-sandbox/loader.ts
+++ b/lib/plugin-sandbox/loader.ts
@@ -33,6 +33,7 @@ import { clearSectionTitle } from './section-titles';
 import { cancelPluginProxyRequests } from './proxy-client';
 import { cancelConnectFor } from './connect-dialog';
 import { isHookHandedOver } from './host-features';
+import { hookArgsFor } from './hook-payload';
 import type { SlotName } from '../plugin-types';
 import { PLUGIN_REFUSED_ERROR, pluginAllowed } from '../outgoing-hosts';
 
@@ -294,8 +295,10 @@ async function startSandboxedPlugin(plugin: InstalledPlugin): Promise<void> {
       // hook is skipped: copies older than the release that steps back on
       // its own would ask twice (host-features.ts). Asked per call, so
       // turning the core switch off gives the plugin its hook back.
+      // Parts of the arguments that need another permission are cut per
+      // plugin (hook-payload.ts).
       const pluginId = plugin.id;
-      const proxy = (...args: unknown[]) => (isHookHandedOver(pluginId, hookName) ? undefined : bg.invokeHook(hookName, args));
+      const proxy = (...args: unknown[]) => (isHookHandedOver(pluginId, hookName) ? undefined : bg.invokeHook(hookName, hookArgsFor(plugin, hookName, args)));
       hookDisposables.push(bus.register(plugin.id, proxy as (...a: unknown[]) => unknown));
       if (hookName === 'onEmailOpen') openHandler = proxy;
     }
diff --git a/lib/plugin-types.ts b/lib/plugin-types.ts
index ee62206d8..746fe09e2 100644
--- a/lib/plugin-types.ts
+++ b/lib/plugin-types.ts
@@ -1076,6 +1076,30 @@ export interface MailtoContext {
  * copy. Use to inject signatures, rewrite links, strip tracking pixels from
  * forwards, encrypt the body, etc. Return undefined to pass through unchanged.
  */
+/** An attachment of an OutgoingEmail. */
+export interface OutgoingAttachment {
+  name: string;
+  /** The type the file was attached with (often the browser's guess from the extension). */
+  type: string;
+  size: number;
+  /** onBeforeEmailSend, 1.20 and later: the uploaded blob. */
+  blobId?: string;
+  /** onBeforeEmailSend, 1.20 and later: an image shown in the body (pasted or quoted). */
+  inline?: boolean;
+  /**
+   * onBeforeEmailSend, 1.20 and later: the type the file's first bytes say
+   * it is (application/x-msdownload for a program, application/zip, ...);
+   * absent when Bulwark knows no signature for them or couldn't read them.
+   */
+  sniffedType?: string;
+  /**
+   * onBeforeEmailSend, 1.20 and later, plugins with `email:blob-read` only:
+   * up to the first megabyte of a text attachment (text/*, CSV, JSON, XML,
+   * calendar and contact files) as text.
+   */
+  textExcerpt?: string;
+}
+
 export interface OutgoingEmail {
   to: string[];
   cc: string[];
@@ -1086,7 +1110,7 @@ export interface OutgoingEmail {
   identityId: string;
   /** Sender email derived from the active identity (incl. sub-address tag, when set) */
   fromEmail?: string;
-  attachments: { name: string; type: string; size: number }[];
+  attachments: OutgoingAttachment[];
   /** Original message id when this is a reply or forward */
   inReplyTo?: string;
   /** Free-form custom headers added by the composer or earlier handlers */
@@ -1098,6 +1122,21 @@ export interface OutgoingEmail {
   surface?: 'composer' | 'quick-reply' | 'plugin-forward';
   /** compose, reply, replyAll or forward (onBeforeEmailSend, 1.20 and later). */
   mode?: 'compose' | 'reply' | 'replyAll' | 'forward';
+  /**
+   * onBeforeEmailSend, 1.20 and later: what the user wrote, as plain text,
+   * without the quoted original of a reply or forward and without the
+   * signature. Check this rather than the bodies, or a number in the quoted
+   * mail warns on every reply.
+   */
+  authoredText?: string;
+  /**
+   * onBeforeEmailSend, 1.20 and later: the recipients (To, Cc and Bcc)
+   * outside the organisation of the account the mail goes out from, as bare
+   * lowercase addresses. The host works it out from the account's identity
+   * domains and the admin's organisation domains, also when the admin's
+   * recipient warning is off. Empty when every recipient is internal.
+   */
+  externalRecipients?: string[];
 }
 /**
  * Passed to onBeforeDraftAutoSave handlers as a transform value.
@@ -1184,6 +1223,11 @@ export interface AttachmentInfo {
   blobId?: string;
   /** The email this attachment belongs to (download / preview) */
   emailId?: string;
+  /**
+   * onBeforeAttachmentUpload, 1.20 and later, for a file from this device:
+   * the type its first bytes say it is (see OutgoingAttachment.sniffedType).
+   */
+  sniffedType?: string;
 }
 
 /**

From c004587158983df0819d72a9772e7c1436e2f2ad Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 08:22:32 +0100
Subject: [PATCH 03/17] feat: keep sending blocked while a required send check
 isn't running

---
 .../composer-send-check-payload.test.tsx      |  30 +++-
 components/email/email-composer.tsx           |   2 +
 components/mail/mail-app.tsx                  |   1 +
 lib/__tests__/plugin-send-guards.test.ts      | 122 +++++++++++++++
 lib/outgoing/plugin-send-check.ts             |  13 +-
 lib/plugin-sandbox/host-api-forward.ts        |   4 +-
 lib/plugin-sandbox/loader.ts                  |   3 +
 lib/plugin-send-guards.ts                     | 146 ++++++++++++++++++
 locales/ar/common.json                        |   3 +
 locales/ca/common.json                        |   3 +
 locales/cs/common.json                        |   3 +
 locales/da/common.json                        |   3 +
 locales/de/common.json                        |   3 +
 locales/en/common.json                        |   3 +
 locales/es/common.json                        |   3 +
 locales/et/common.json                        |   3 +
 locales/fa/common.json                        |   3 +
 locales/fr/common.json                        |   3 +
 locales/he/common.json                        |   3 +
 locales/hu/common.json                        |   3 +
 locales/it/common.json                        |   3 +
 locales/ja/common.json                        |   3 +
 locales/ko/common.json                        |   3 +
 locales/lv/common.json                        |   3 +
 locales/mn/common.json                        |   3 +
 locales/nb/common.json                        |   3 +
 locales/nl/common.json                        |   3 +
 locales/pl/common.json                        |   3 +
 locales/pt/common.json                        |   3 +
 locales/ro/common.json                        |   3 +
 locales/ru/common.json                        |   3 +
 locales/sk/common.json                        |   3 +
 locales/th/common.json                        |   3 +
 locales/tr/common.json                        |   3 +
 locales/uk/common.json                        |   3 +
 locales/vi/common.json                        |   3 +
 locales/zh-TW/common.json                     |   3 +
 locales/zh/common.json                        |   3 +
 stores/plugin-store.ts                        |  14 ++
 39 files changed, 420 insertions(+), 5 deletions(-)
 create mode 100644 lib/__tests__/plugin-send-guards.test.ts
 create mode 100644 lib/plugin-send-guards.ts

diff --git a/components/email/__tests__/composer-send-check-payload.test.tsx b/components/email/__tests__/composer-send-check-payload.test.tsx
index a8986b788..3db8388d8 100644
--- a/components/email/__tests__/composer-send-check-payload.test.tsx
+++ b/components/email/__tests__/composer-send-check-payload.test.tsx
@@ -6,7 +6,8 @@ import { usePolicyStore } from '@/stores/policy-store';
 import { resetSendPipeline } from '@/lib/outgoing/send-pipeline';
 import { DEFAULT_POLICY, type SettingsPolicy } from '@/lib/admin/types';
 import { DEFAULT_ORGANISATION_POLICY } from '@/lib/admin/organisation-policy';
-import type { OutgoingEmail } from '@/lib/plugin-types';
+import type { InstalledPlugin, OutgoingEmail } from '@/lib/plugin-types';
+import { setSendGuardSource } from '@/lib/plugin-send-guards';
 
 // ─── Heavy component mocks (mirrors composer-reply-signature.test.tsx) ─
 
@@ -175,8 +176,9 @@ vi.mock('@/stores/template-store', () => {
 
 // ─── Misc dependency mocks ────────────────────────────────────────────────────
 
+const toasts = vi.hoisted(() => ({ error: [] as string[] }));
 vi.mock('@/stores/toast-store', () => ({
-  toast: { info: () => {}, error: () => {}, success: () => {} },
+  toast: { info: () => {}, error: (message: string) => { toasts.error.push(message); }, success: () => {} },
 }));
 
 vi.mock('@/lib/plugin-hooks', () => ({
@@ -311,3 +313,27 @@ describe('composer: what a send check plugin gets', () => {
     expect((sendChecks.seen[0] as OutgoingEmail).externalRecipients).toEqual(['mallory@evil.test']);
   });
 });
+
+// A send check the admin requires that isn't running holds the send.
+describe('composer: a required send check that is down', () => {
+  afterEach(() => {
+    setSendGuardSource(null);
+    toasts.error = [];
+    vi.clearAllMocks();
+  });
+
+  it('sends nothing and says why', async () => {
+    const down = {
+      id: 'send-checks', name: 'Send checks', version: '1.0.0', permissions: ['email:send'],
+      status: 'error', error: 'auto-disabled', enabled: false, forceEnabled: true, managed: true,
+    } as unknown as InstalledPlugin;
+    setSendGuardSource({ snapshot: () => ({ plugins: [down], forced: () => true }), subscribe: () => () => {} });
+    sendChecks.seen = [];
+    const onSend = vi.fn();
+    render(<EmailComposer initialData={DRAFT} onSend={onSend} />);
+    fireEvent.click(screen.getAllByTestId('composer-send')[0]);
+    await waitFor(() => expect(toasts.error).toContain('not_running'));
+    expect(onSend).not.toHaveBeenCalled();
+    expect(sendChecks.seen).toEqual([]);
+  });
+});
diff --git a/components/email/email-composer.tsx b/components/email/email-composer.tsx
index 6febe2b36..eedd3d713 100644
--- a/components/email/email-composer.tsx
+++ b/components/email/email-composer.tsx
@@ -489,6 +489,7 @@ export function EmailComposer({
   const tQuote = useTranslations('quote_header');
   const tViewer = useTranslations('email_viewer');
   const tClassification = useTranslations('classification');
+  const tSendGuards = useTranslations('send_guards');
   const timeFormat = useSettingsStore((state) => state.timeFormat);
   const plainTextModeDefault = useSettingsStore((state) => state.plainTextMode);
   // Per-message format (#1022). Seeded from the "plain text only" setting -
@@ -3660,6 +3661,7 @@ export function EmailComposer({
         // A guard that crashed or never answered showed nothing; say why
         // the message is still here.
         if (sendCheck === 'failed') toast.error(t('send_guard_failed'));
+        if (sendCheck === 'guard-down') toast.error(tSendGuards('not_running'));
         return;
       }
 
diff --git a/components/mail/mail-app.tsx b/components/mail/mail-app.tsx
index e04c7186d..0bccfb3e0 100644
--- a/components/mail/mail-app.tsx
+++ b/components/mail/mail-app.tsx
@@ -4118,6 +4118,7 @@ export function MailApp({ linkSegments: routeSegments }: MailAppProps = {}) {
       // A plugin that said no told the user; one that crashed didn't.
       onSendCheckStopped: (outcome) => {
         if (outcome === 'failed') toast.error(t('email_composer.send_guard_failed'));
+        if (outcome === 'guard-down') toast.error(t('send_guards.not_running'));
       },
       questions: {
         // The fill-in words of the UI language and of English, as the composer.
diff --git a/lib/__tests__/plugin-send-guards.test.ts b/lib/__tests__/plugin-send-guards.test.ts
new file mode 100644
index 000000000..8b53f4496
--- /dev/null
+++ b/lib/__tests__/plugin-send-guards.test.ts
@@ -0,0 +1,122 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  awaitSendGuards,
+  downSendGuards,
+  guardsSending,
+  rememberDeclaredHooks,
+  setSendGuardSource,
+} from '@/lib/plugin-send-guards';
+import { runPluginSendCheck } from '@/lib/outgoing/plugin-send-check';
+import { emailHooks } from '@/lib/plugin-hooks';
+import type { InstalledPlugin, OutgoingEmail } from '@/lib/plugin-types';
+import { usePluginStore } from '@/stores/plugin-store';
+import { usePolicyStore } from '@/stores/policy-store';
+
+vi.mock('@/lib/debug', () => ({ debug: { log: () => {}, warn: () => {}, error: () => {} } }));
+
+// A send check the admin force-enabled that is starting, failed to start or
+// was turned off after errors used to let every message through.
+
+const guard = (patch: Partial<InstalledPlugin> = {}): InstalledPlugin => ({
+  id: 'send-checks', name: 'Send checks', version: '1.0.0', author: '', description: '', type: 'hook',
+  permissions: ['email:send', 'email:read'], entrypoint: 'index.js', enabled: true, status: 'running',
+  settings: {}, managed: true, forceEnabled: true, bundleHash: 'abc', ...patch,
+});
+
+const email: OutgoingEmail = { to: ['x@example.org'], cc: [], bcc: [], subject: 's', htmlBody: '', textBody: 't', identityId: 'i', attachments: [] };
+
+beforeEach(() => {
+  localStorage.clear();
+});
+afterEach(() => {
+  usePluginStore.setState({ plugins: [] });
+  emailHooks.onBeforeEmailSend.clear();
+  vi.useRealTimers();
+});
+
+describe('downSendGuards', () => {
+  it('counts a required guard that is starting, failed to start or was turned off after errors', () => {
+    usePluginStore.setState({
+      plugins: [
+        guard({ id: 'a', status: 'enabled' }),
+        guard({ id: 'b', status: 'error', error: 'Bundle integrity mismatch: expected x, got y' }),
+        guard({ id: 'c', status: 'error', error: 'auto-disabled', enabled: false }),
+        guard({ id: 'd', status: 'running' }),
+      ],
+    });
+    expect(downSendGuards().map((g) => [g.id, g.state])).toEqual([['a', 'loading'], ['b', 'failed'], ['c', 'failed']]);
+  });
+
+  it("doesn't count a plugin Bulwark refused on purpose, nor one the user turned on", () => {
+    usePluginStore.setState({
+      plugins: [
+        guard({ id: 'a', status: 'error', error: 'third-party-off' }),
+        guard({ id: 'b', status: 'error', error: 'approval-denied' }),
+        guard({ id: 'c', status: 'error', error: 'Privileged tier requires the "crypto:full" permission' }),
+        guard({ id: 'd', status: 'enabled', forceEnabled: false, managed: false }),
+      ],
+    });
+    expect(downSendGuards()).toEqual([]);
+  });
+
+  it('counts a plugin the policy forces on', () => {
+    const spy = vi.spyOn(usePolicyStore.getState(), 'isPluginForceEnabled').mockImplementation((id: string) => id === 'p');
+    usePluginStore.setState({ plugins: [guard({ id: 'p', forceEnabled: false, status: 'enabled' })] });
+    expect(downSendGuards().map((g) => g.id)).toEqual(['p']);
+    spy.mockRestore();
+  });
+
+  it('knows a guard by the hooks of its last start, else by the email:send permission', () => {
+    expect(guardsSending(guard())).toBe(true);
+    expect(guardsSending(guard({ permissions: ['email:read'] }))).toBe(false);
+    rememberDeclaredHooks(guard(), 'abc', ['onComposeSend']);
+    expect(guardsSending(guard())).toBe(false);
+    // Another bundle: what the old one did no longer says anything.
+    expect(guardsSending(guard({ bundleHash: '"DEF"' }))).toBe(true);
+    rememberDeclaredHooks(guard({ bundleHash: 'def' }), 'def', ['onBeforeEmailSend']);
+    expect(guardsSending(guard({ bundleHash: '"DEF"' }))).toBe(true);
+  });
+});
+
+describe('awaitSendGuards', () => {
+  it('waits for a guard that is starting and goes on once it runs', async () => {
+    usePluginStore.setState({ plugins: [guard({ status: 'enabled' })] });
+    const waiting = awaitSendGuards(5000);
+    usePluginStore.setState({ plugins: [guard({ status: 'running' })] });
+    expect(await waiting).toEqual([]);
+  });
+
+  it('gives up after the wait and reports it down', async () => {
+    vi.useFakeTimers();
+    usePluginStore.setState({ plugins: [guard({ status: 'enabled' })] });
+    const waiting = awaitSendGuards(5000);
+    await vi.advanceTimersByTimeAsync(5000);
+    expect(await waiting).toEqual([{ id: 'send-checks', name: 'Send checks', state: 'loading' }]);
+  });
+
+  it('sees nothing without a source (no plugin store, as in Lite)', async () => {
+    setSendGuardSource(null);
+    try {
+      usePluginStore.setState({ plugins: [guard({ status: 'error', error: 'auto-disabled' })] });
+      expect(await awaitSendGuards(10)).toEqual([]);
+    } finally {
+      setSendGuardSource({
+        snapshot: () => ({ plugins: usePluginStore.getState().plugins, forced: (p) => !!p.forceEnabled }),
+        subscribe: (l) => usePluginStore.subscribe(l),
+      });
+    }
+  });
+});
+
+describe('runPluginSendCheck', () => {
+  it('holds the send while a required guard is down, without asking the others', async () => {
+    const handler = vi.fn(() => undefined);
+    emailHooks.onBeforeEmailSend.register('other', handler);
+    usePluginStore.setState({ plugins: [guard({ status: 'error', error: 'auto-disabled', enabled: false })] });
+    expect(await runPluginSendCheck(email)).toBe('guard-down');
+    expect(handler).not.toHaveBeenCalled();
+    usePluginStore.setState({ plugins: [guard()] });
+    expect(await runPluginSendCheck(email)).toBe('allowed');
+    expect(handler).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/lib/outgoing/plugin-send-check.ts b/lib/outgoing/plugin-send-check.ts
index 919657290..4bbdfe8a6 100644
--- a/lib/outgoing/plugin-send-check.ts
+++ b/lib/outgoing/plugin-send-check.ts
@@ -11,13 +11,22 @@
 
 import { emailHooks } from '@/lib/plugin-hooks';
 import type { OutgoingEmail } from '@/lib/plugin-types';
+import { awaitSendGuards } from '@/lib/plugin-send-guards';
+import { debug } from '@/lib/debug';
 
 /**
  * allowed: send. vetoed: a plugin said no and told the user. failed: a
- * handler threw or ran out of time (nobody told the user yet).
+ * handler threw or ran out of time. guard-down: a send check the admin
+ * requires isn't running (lib/plugin-send-guards.ts). Nobody told the user
+ * about the last two yet.
  */
-export type PluginSendCheckOutcome = 'allowed' | 'vetoed' | 'failed';
+export type PluginSendCheckOutcome = 'allowed' | 'vetoed' | 'failed' | 'guard-down';
 
 export async function runPluginSendCheck(email: OutgoingEmail): Promise<PluginSendCheckOutcome> {
+  const down = await awaitSendGuards();
+  if (down.length > 0) {
+    debug.warn('email', `Send held: required send checks not running: ${down.map((g) => `${g.id} (${g.state})`).join(', ')}`);
+    return 'guard-down';
+  }
   return emailHooks.onBeforeEmailSend.interceptOutcome(email);
 }
diff --git a/lib/plugin-sandbox/host-api-forward.ts b/lib/plugin-sandbox/host-api-forward.ts
index aeeec84d3..212a108f8 100644
--- a/lib/plugin-sandbox/host-api-forward.ts
+++ b/lib/plugin-sandbox/host-api-forward.ts
@@ -209,7 +209,9 @@ export async function doEmailForward(
       authoredText: note,
       externalRecipients: await externalRecipientsFor(context),
     };
-    if ((await runPluginSendCheck(outgoing)) !== 'allowed') return { sent: false, reason: 'stopped' };
+    const outcome = await runPluginSendCheck(outgoing);
+    if (outcome === 'guard-down') toast.error(text(messages, 'send_guards.not_running'));
+    if (outcome !== 'allowed') return { sent: false, reason: 'stopped' };
   }
 
   // The attachments are blobs of the account the original is in; a message
diff --git a/lib/plugin-sandbox/loader.ts b/lib/plugin-sandbox/loader.ts
index 4db15dc85..ec61ff6e7 100644
--- a/lib/plugin-sandbox/loader.ts
+++ b/lib/plugin-sandbox/loader.ts
@@ -34,6 +34,7 @@ import { cancelPluginProxyRequests } from './proxy-client';
 import { cancelConnectFor } from './connect-dialog';
 import { isHookHandedOver } from './host-features';
 import { hookArgsFor } from './hook-payload';
+import { rememberDeclaredHooks } from '../plugin-send-guards';
 import type { SlotName } from '../plugin-types';
 import { PLUGIN_REFUSED_ERROR, pluginAllowed } from '../outgoing-hosts';
 
@@ -316,6 +317,8 @@ async function startSandboxedPlugin(plugin: InstalledPlugin): Promise<void> {
 
     const slotOffers = permittedOffers(plugin, info.slots, true);
     writeSlotOffers(plugin.id, hash, info.slots);
+    // Whether it checks mail before sending, for the next start (plugin-send-guards.ts).
+    rememberDeclaredHooks(plugin, hash, info.hooks);
 
     registerActive({
       plugin,
diff --git a/lib/plugin-send-guards.ts b/lib/plugin-send-guards.ts
new file mode 100644
index 000000000..ee6f27643
--- /dev/null
+++ b/lib/plugin-send-guards.ts
@@ -0,0 +1,146 @@
+/**
+ * Send guards the admin requires that aren't running (enterprise pack R8).
+ *
+ * A plugin's onBeforeEmailSend can only stop mail while it runs. One the
+ * admin force-enabled that is still starting, failed to start or was turned
+ * off after errors (the hook bus's three-strikes breaker) used to let every
+ * message through. While such a guard is down, sending waits a few seconds
+ * for it and then stays blocked.
+ *
+ * Doesn't count: a plugin that never runs on purpose, because Bulwark
+ * refused it (the no-third-party mode, the admin's approval or user-plugin
+ * rules, a tier it may not have). The Security page lists those for the
+ * admin. And a plugin the user turned on themselves: that is their choice.
+ *
+ * Which plugins guard sending: those the last start saw registering
+ * onBeforeEmailSend (remembered per bundle), and before any start a plugin
+ * with the `email:send` permission, to be safe.
+ *
+ * The plugin store hands in its state through setSendGuardSource, so the
+ * send paths need no import of it (lib/outgoing/plugin-send-check.ts).
+ */
+
+import type { InstalledPlugin } from './plugin-types';
+
+export interface SendGuardSource {
+  /** The installed plugins and whether the admin forces each on. */
+  snapshot(): { plugins: readonly InstalledPlugin[]; forced: (plugin: InstalledPlugin) => boolean };
+  subscribe(listener: () => void): () => void;
+}
+
+export type SendGuardState = 'loading' | 'failed';
+
+export interface DownSendGuard {
+  id: string;
+  name: string;
+  state: SendGuardState;
+}
+
+/** Errors that mean Bulwark refused to start the plugin, not that it broke. */
+const REFUSALS = new Set([
+  'third-party-off',
+  'user-plugins-off',
+  'approval-unavailable',
+  'approval-denied',
+  'approval-pending',
+]);
+const TIER_REFUSAL = /^Privileged tier requires /;
+
+/** How long a send waits for guards that are still starting. */
+export const SEND_GUARD_WAIT_MS = 8000;
+
+let source: SendGuardSource | null = null;
+
+export function setSendGuardSource(next: SendGuardSource | null): void {
+  source = next;
+}
+
+// ─── Hooks seen at the last start ─────────────────────────────
+
+const HOOKS_KEY_PREFIX = 'plugin-declared-hooks:';
+
+const normalHash = (hash: string | null | undefined) => (hash ?? '').replace(/^"|"$/g, '').trim().toLowerCase();
+
+/** Called by the loader once a plugin has started: the hooks it registered. */
+export function rememberDeclaredHooks(plugin: Pick<InstalledPlugin, 'id' | 'version'>, hash: string, hooks: readonly string[]): void {
+  try {
+    localStorage.setItem(HOOKS_KEY_PREFIX + plugin.id, JSON.stringify({ hash: normalHash(hash), version: plugin.version, hooks }));
+  } catch {
+    // Storage blocked or full: the permission decides until next time.
+  }
+}
+
+export function forgetDeclaredHooks(pluginId: string): void {
+  try { localStorage.removeItem(HOOKS_KEY_PREFIX + pluginId); } catch { /* ignore */ }
+}
+
+function rememberedHooks(plugin: InstalledPlugin): string[] | null {
+  try {
+    const raw = localStorage.getItem(HOOKS_KEY_PREFIX + plugin.id);
+    if (!raw) return null;
+    const rec = JSON.parse(raw) as { hash?: unknown; version?: unknown; hooks?: unknown };
+    const same = plugin.bundleHash ? rec.hash === normalHash(plugin.bundleHash) : rec.version === plugin.version;
+    if (!same || !Array.isArray(rec.hooks)) return null;
+    return rec.hooks.filter((h): h is string => typeof h === 'string');
+  } catch {
+    return null;
+  }
+}
+
+/** Whether a plugin checks mail before it is sent. */
+export function guardsSending(plugin: InstalledPlugin): boolean {
+  if (!plugin.permissions?.includes('email:send')) return false;
+  const hooks = rememberedHooks(plugin);
+  return hooks === null || hooks.includes('onBeforeEmailSend');
+}
+
+/** The state of one required guard, or null when it runs or doesn't count. */
+export function guardState(plugin: InstalledPlugin): SendGuardState | null {
+  switch (plugin.status) {
+    case 'running':
+      return null;
+    case 'error': {
+      const error = plugin.error ?? '';
+      if (REFUSALS.has(error) || TIER_REFUSAL.test(error)) return null;
+      return 'failed';
+    }
+    default:
+      // Enabled and not running yet, or waiting for the server sync to turn it on.
+      return 'loading';
+  }
+}
+
+/** The force-enabled send guards that aren't running now. */
+export function downSendGuards(): DownSendGuard[] {
+  if (!source) return [];
+  const { plugins, forced } = source.snapshot();
+  const out: DownSendGuard[] = [];
+  for (const plugin of plugins) {
+    if (!forced(plugin) || !guardsSending(plugin)) continue;
+    const state = guardState(plugin);
+    if (state) out.push({ id: plugin.id, name: plugin.name, state });
+  }
+  return out;
+}
+
+/**
+ * The required guards that are still down after waiting up to `waitMs` for
+ * those that are starting. Empty: sending may go on.
+ */
+export async function awaitSendGuards(waitMs: number = SEND_GUARD_WAIT_MS): Promise<DownSendGuard[]> {
+  const down = downSendGuards();
+  if (!source || !down.some((guard) => guard.state === 'loading')) return down;
+  const current = source;
+  return new Promise((resolve) => {
+    let unsubscribe = () => {};
+    const timer = setTimeout(() => finish(), waitMs);
+    const finish = () => {
+      clearTimeout(timer);
+      unsubscribe();
+      resolve(downSendGuards());
+    };
+    unsubscribe = current.subscribe(() => {
+      if (!downSendGuards().some((guard) => guard.state === 'loading')) finish();
+    });
+  });
+}
diff --git a/locales/ar/common.json b/locales/ar/common.json
index e68debcc5..af0a02f95 100644
--- a/locales/ar/common.json
+++ b/locales/ar/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "تعذّر الحفظ: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "لم تُرسل. هناك فحص تشترطه مؤسستك لا يعمل حاليًا. حاول مرة أخرى بعد قليل."
+  },
   "plugin_list": {
     "filters": "المرشحات",
     "remove_filter": "إزالة المرشح {label}"
diff --git a/locales/ca/common.json b/locales/ca/common.json
index c29e04d6d..e7d195f3f 100644
--- a/locales/ca/common.json
+++ b/locales/ca/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "No s'ha pogut desar: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "No s'ha enviat. Una comprovació que exigeix la vostra organització no s'està executant. Torneu-ho a provar d'aquí a un moment."
+  },
   "plugin_list": {
     "filters": "Filtres",
     "remove_filter": "Treu el filtre {label}"
diff --git a/locales/cs/common.json b/locales/cs/common.json
index 8ff06fa62..42841c483 100644
--- a/locales/cs/common.json
+++ b/locales/cs/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Uložení se nezdařilo: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Neodesláno. Kontrola, kterou vaše organizace vyžaduje, právě neběží. Zkuste to za chvíli znovu."
+  },
   "plugin_list": {
     "filters": "Filtry",
     "remove_filter": "Odebrat filtr {label}"
diff --git a/locales/da/common.json b/locales/da/common.json
index 721ff04c3..c8ede86b8 100644
--- a/locales/da/common.json
+++ b/locales/da/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Kunne ikke gemme: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Ikke sendt. En kontrol, som din organisation kræver, kører ikke. Prøv igen om et øjeblik."
+  },
   "plugin_list": {
     "filters": "Filtre",
     "remove_filter": "Fjern filteret {label}"
diff --git a/locales/de/common.json b/locales/de/common.json
index e82dd8086..dadd10d1c 100644
--- a/locales/de/common.json
+++ b/locales/de/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Speichern fehlgeschlagen: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Nicht gesendet. Eine Prüfung, die Ihre Organisation vorschreibt, läuft gerade nicht. Versuchen Sie es gleich noch einmal."
+  },
   "plugin_list": {
     "filters": "Filter",
     "remove_filter": "Filter {label} entfernen"
diff --git a/locales/en/common.json b/locales/en/common.json
index 89d25e3c8..637e6e7bb 100644
--- a/locales/en/common.json
+++ b/locales/en/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Could not save: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Not sent. A check your organisation requires isn't running. Try again in a moment."
+  },
   "plugin_list": {
     "filters": "Filters",
     "remove_filter": "Remove filter {label}"
diff --git a/locales/es/common.json b/locales/es/common.json
index 71e689bda..0b0ffcfa9 100644
--- a/locales/es/common.json
+++ b/locales/es/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "No se pudo guardar: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "No enviado. Una comprobación que exige tu organización no está en marcha. Vuelve a intentarlo en un momento."
+  },
   "plugin_list": {
     "filters": "Filtros",
     "remove_filter": "Quitar el filtro {label}"
diff --git a/locales/et/common.json b/locales/et/common.json
index d0fc45749..4f941156c 100644
--- a/locales/et/common.json
+++ b/locales/et/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Salvestamine ebaõnnestus: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Ei saadetud. Teie organisatsiooni nõutud kontroll praegu ei tööta. Proovige hetke pärast uuesti."
+  },
   "plugin_list": {
     "filters": "Filtrid",
     "remove_filter": "Eemalda filter {label}"
diff --git a/locales/fa/common.json b/locales/fa/common.json
index 120bf77a9..6d33d0d9d 100644
--- a/locales/fa/common.json
+++ b/locales/fa/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "ذخیره نشد: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "ارسال نشد. بررسی‌ای که سازمان شما الزامی کرده در حال اجرا نیست. چند لحظه دیگر دوباره تلاش کنید."
+  },
   "plugin_list": {
     "filters": "فیلترها",
     "remove_filter": "حذف فیلتر {label}"
diff --git a/locales/fr/common.json b/locales/fr/common.json
index 187cbadbc..61c388afb 100644
--- a/locales/fr/common.json
+++ b/locales/fr/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Impossible d'enregistrer : {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Non envoyé. Une vérification exigée par votre organisation ne fonctionne pas. Réessayez dans un instant."
+  },
   "plugin_list": {
     "filters": "Filtres",
     "remove_filter": "Retirer le filtre {label}"
diff --git a/locales/he/common.json b/locales/he/common.json
index 9a9471d72..c924bb9f1 100644
--- a/locales/he/common.json
+++ b/locales/he/common.json
@@ -6002,6 +6002,9 @@
       "error_save": "השמירה נכשלה: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "לא נשלח. בדיקה שהארגון שלך מחייב לא פועלת כרגע. נסו שוב בעוד רגע."
+  },
   "plugin_list": {
     "filters": "מסננים",
     "remove_filter": "הסר את המסנן {label}"
diff --git a/locales/hu/common.json b/locales/hu/common.json
index 50ce8a1e6..af40c1100 100644
--- a/locales/hu/common.json
+++ b/locales/hu/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Nem sikerült menteni: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Nincs elküldve. Egy, a szervezete által előírt ellenőrzés most nem fut. Próbálja újra egy pillanat múlva."
+  },
   "plugin_list": {
     "filters": "Szűrők",
     "remove_filter": "{label} szűrő eltávolítása"
diff --git a/locales/it/common.json b/locales/it/common.json
index c643485f0..2d4bc8a88 100644
--- a/locales/it/common.json
+++ b/locales/it/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Impossibile salvare: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Non inviato. Un controllo richiesto dalla tua organizzazione non è attivo. Riprova tra un momento."
+  },
   "plugin_list": {
     "filters": "Filtri",
     "remove_filter": "Rimuovi il filtro {label}"
diff --git a/locales/ja/common.json b/locales/ja/common.json
index 0c1c3767f..f4728eb48 100644
--- a/locales/ja/common.json
+++ b/locales/ja/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "保存できませんでした: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "送信されませんでした。組織で必須のチェックが動作していません。しばらくしてからもう一度お試しください。"
+  },
   "plugin_list": {
     "filters": "フィルター",
     "remove_filter": "フィルター「{label}」を解除"
diff --git a/locales/ko/common.json b/locales/ko/common.json
index 6d5b983ef..2447ec2b2 100644
--- a/locales/ko/common.json
+++ b/locales/ko/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "저장하지 못했어요: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "보내지 않았습니다. 조직에서 요구하는 검사가 실행되고 있지 않습니다. 잠시 후 다시 시도하세요."
+  },
   "plugin_list": {
     "filters": "필터",
     "remove_filter": "{label} 필터 제거"
diff --git a/locales/lv/common.json b/locales/lv/common.json
index 41c0fd87d..f7ee1227e 100644
--- a/locales/lv/common.json
+++ b/locales/lv/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Neizdevās saglabāt: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Nav nosūtīts. Jūsu organizācijas pieprasītā pārbaude pašlaik nedarbojas. Mēģiniet vēlreiz pēc brīža."
+  },
   "plugin_list": {
     "filters": "Filtri",
     "remove_filter": "Noņemt filtru {label}"
diff --git a/locales/mn/common.json b/locales/mn/common.json
index c25d9cc2c..a25d7c1ab 100644
--- a/locales/mn/common.json
+++ b/locales/mn/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Хадгалж чадсангүй: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Илгээгдсэнгүй. Танай байгууллагын шаарддаг шалгалт одоогоор ажиллахгүй байна. Хэсэг хугацааны дараа дахин оролдоно уу."
+  },
   "plugin_list": {
     "filters": "Шүүлтүүр",
     "remove_filter": "{label} шүүлтүүрийг хасах"
diff --git a/locales/nb/common.json b/locales/nb/common.json
index f0c843b6f..12bea3c7e 100644
--- a/locales/nb/common.json
+++ b/locales/nb/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Kunne ikke lagre: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Ikke sendt. En kontroll organisasjonen din krever, kjører ikke. Prøv igjen om et øyeblikk."
+  },
   "plugin_list": {
     "filters": "Filtre",
     "remove_filter": "Fjern filteret {label}"
diff --git a/locales/nl/common.json b/locales/nl/common.json
index cd0d8acb3..d1b377ab6 100644
--- a/locales/nl/common.json
+++ b/locales/nl/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Opslaan mislukt: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Niet verzonden. Een controle die je organisatie verplicht stelt, draait niet. Probeer het zo meteen opnieuw."
+  },
   "plugin_list": {
     "filters": "Filters",
     "remove_filter": "Filter {label} verwijderen"
diff --git a/locales/pl/common.json b/locales/pl/common.json
index dda8917a2..629244756 100644
--- a/locales/pl/common.json
+++ b/locales/pl/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Nie udało się zapisać: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Nie wysłano. Kontrola wymagana przez Twoją organizację nie działa. Spróbuj ponownie za chwilę."
+  },
   "plugin_list": {
     "filters": "Filtry",
     "remove_filter": "Usuń filtr {label}"
diff --git a/locales/pt/common.json b/locales/pt/common.json
index 1a07a0714..56cd5a626 100644
--- a/locales/pt/common.json
+++ b/locales/pt/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Não foi possível salvar: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Não enviado. Uma verificação exigida pela sua organização não está em execução. Tente novamente daqui a pouco."
+  },
   "plugin_list": {
     "filters": "Filtros",
     "remove_filter": "Remover o filtro {label}"
diff --git a/locales/ro/common.json b/locales/ro/common.json
index 9b26d94d2..47000dcb5 100644
--- a/locales/ro/common.json
+++ b/locales/ro/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Nu s-a putut salva: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Nu a fost trimis. O verificare cerută de organizația ta nu rulează. Încearcă din nou peste o clipă."
+  },
   "plugin_list": {
     "filters": "Filtre",
     "remove_filter": "Eliminați filtrul {label}"
diff --git a/locales/ru/common.json b/locales/ru/common.json
index ad2517e4b..5d6d20b6e 100644
--- a/locales/ru/common.json
+++ b/locales/ru/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Не удалось сохранить: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Не отправлено. Проверка, которую требует ваша организация, сейчас не работает. Повторите попытку через минуту."
+  },
   "plugin_list": {
     "filters": "Фильтры",
     "remove_filter": "Убрать фильтр {label}"
diff --git a/locales/sk/common.json b/locales/sk/common.json
index 34e7791cb..0709c73bc 100644
--- a/locales/sk/common.json
+++ b/locales/sk/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Uloženie zlyhalo: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Neodoslané. Kontrola, ktorú vyžaduje vaša organizácia, práve nebeží. Skúste to o chvíľu znova."
+  },
   "plugin_list": {
     "filters": "Filtre",
     "remove_filter": "Odstrániť filter {label}"
diff --git a/locales/th/common.json b/locales/th/common.json
index 0c7a1c589..ae6aa2b6a 100644
--- a/locales/th/common.json
+++ b/locales/th/common.json
@@ -2945,6 +2945,9 @@
       "error_save": "บันทึกไม่สำเร็จ: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "ยังไม่ได้ส่ง การตรวจสอบที่องค์กรของคุณกำหนดไม่ได้ทำงานอยู่ ลองอีกครั้งในอีกสักครู่"
+  },
   "plugin_list": {
     "filters": "ตัวกรอง",
     "remove_filter": "นำตัวกรอง {label} ออก"
diff --git a/locales/tr/common.json b/locales/tr/common.json
index 11d0a04cc..12bfd09c1 100644
--- a/locales/tr/common.json
+++ b/locales/tr/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Kaydedilemedi: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Gönderilmedi. Kuruluşunuzun zorunlu tuttuğu bir denetim şu anda çalışmıyor. Biraz sonra yeniden deneyin."
+  },
   "plugin_list": {
     "filters": "Filtreler",
     "remove_filter": "{label} filtresini kaldır"
diff --git a/locales/uk/common.json b/locales/uk/common.json
index 587e9b6af..918367fd7 100644
--- a/locales/uk/common.json
+++ b/locales/uk/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "Не вдалося зберегти: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Не надіслано. Перевірка, якої вимагає ваша організація, зараз не працює. Спробуйте ще раз за мить."
+  },
   "plugin_list": {
     "filters": "Фільтри",
     "remove_filter": "Прибрати фільтр {label}"
diff --git a/locales/vi/common.json b/locales/vi/common.json
index af8be5861..b5dba61d7 100644
--- a/locales/vi/common.json
+++ b/locales/vi/common.json
@@ -6013,6 +6013,9 @@
       "error_save": "Không thể lưu: {error}"
     }
   },
+  "send_guards": {
+    "not_running": "Chưa gửi. Một bước kiểm tra mà tổ chức của bạn yêu cầu hiện không chạy. Hãy thử lại sau giây lát."
+  },
   "plugin_list": {
     "filters": "Bộ lọc",
     "remove_filter": "Xóa bộ lọc {label}"
diff --git a/locales/zh-TW/common.json b/locales/zh-TW/common.json
index b6fe8d43c..bd463b83c 100644
--- a/locales/zh-TW/common.json
+++ b/locales/zh-TW/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "無法儲存：{error}"
     }
   },
+  "send_guards": {
+    "not_running": "未傳送。貴組織要求的一項檢查目前未執行。請稍後再試。"
+  },
   "plugin_list": {
     "filters": "篩選",
     "remove_filter": "移除篩選條件 {label}"
diff --git a/locales/zh/common.json b/locales/zh/common.json
index 96d9ac219..c014c081e 100644
--- a/locales/zh/common.json
+++ b/locales/zh/common.json
@@ -6001,6 +6001,9 @@
       "error_save": "无法保存：{error}"
     }
   },
+  "send_guards": {
+    "not_running": "未发送。你的组织要求的一项检查当前未运行。请稍后再试。"
+  },
   "plugin_list": {
     "filters": "筛选",
     "remove_filter": "移除筛选条件 {label}"
diff --git a/stores/plugin-store.ts b/stores/plugin-store.ts
index 7f894689b..9fb26514c 100644
--- a/stores/plugin-store.ts
+++ b/stores/plugin-store.ts
@@ -27,6 +27,7 @@ import { IMPLICIT_PERMISSIONS } from '@/lib/plugin-types';
 import type { Permission } from '@/lib/plugin-types';
 import { IS_LITE } from '@/lib/lite';
 import { onFullSignOut } from '@/lib/sign-out-cleanup';
+import { forgetDeclaredHooks, setSendGuardSource } from '@/lib/plugin-send-guards';
 
 let pluginInitializationPromise: Promise<void> | null = null;
 // One-time guard so we attach the locale and regional subscriptions only once.
@@ -427,6 +428,7 @@ function removePluginData(id: string): void {
   deactivatePlugin(id);
   removeAllPluginHooks(id);
   forgetSlotOffers(id);
+  forgetDeclaredHooks(id);
   void pluginStorage.deleteCode(id).catch(() => {});
   void pluginStorage.deletePreview(id).catch(() => {});
   // Accounts the user connected for it live on the server (this mail account's).
@@ -838,3 +840,15 @@ onFullSignOut(() => {
     }),
   });
 });
+
+// Send guards the admin requires hold sends while they aren't running
+// (lib/plugin-send-guards.ts). No plugins run in Lite.
+if (!IS_LITE) {
+  setSendGuardSource({
+    snapshot: () => ({
+      plugins: usePluginStore.getState().plugins,
+      forced: (plugin) => !!plugin.forceEnabled || usePolicyStore.getState().isPluginForceEnabled(plugin.id),
+    }),
+    subscribe: (listener) => usePluginStore.subscribe(listener),
+  });
+}

From b3369c7e783270073bc50847ca13c443ac36c3e7 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 08:31:27 +0100
Subject: [PATCH 04/17] feat: send every link click through the link check

---
 .../__tests__/link-check-surfaces.test.tsx    | 130 ++++++++++++++++++
 components/calendar/event-detail-popover.tsx  |   5 +
 components/calendar/event-modal.tsx           |   5 +-
 components/contacts/contact-detail.tsx        |  11 +-
 .../thread-conversation-link-gate.test.tsx    |  13 ++
 .../__tests__/unsubscribe-banner.test.tsx     |  30 ++++
 components/email/email-viewer.tsx             |   8 +-
 components/email/reader-view-dialog.tsx       |   4 +
 .../email/structured-mail/card-parts.tsx      |  14 +-
 components/email/thread-conversation-view.tsx |  12 +-
 components/email/unsubscribe-banner.tsx       |   9 +-
 .../notifications/notification-center.tsx     |   4 +-
 components/ui/linkified-text.tsx              |   7 +-
 lib/plugin-hook-result.ts                     |  52 ++++++-
 lib/plugin-hooks.ts                           |  15 +-
 lib/plugin-sandbox/host-api.ts                |   8 +-
 lib/plugin-types.ts                           |   6 +
 17 files changed, 299 insertions(+), 34 deletions(-)
 create mode 100644 components/__tests__/link-check-surfaces.test.tsx

diff --git a/components/__tests__/link-check-surfaces.test.tsx b/components/__tests__/link-check-surfaces.test.tsx
new file mode 100644
index 000000000..39f615287
--- /dev/null
+++ b/components/__tests__/link-check-surfaces.test.tsx
@@ -0,0 +1,130 @@
+// Links outside message bodies opened without the plugins' link check
+// (onBeforeExternalLink): the reader view, event descriptions, locations
+// and meeting links, contact addresses, notification links, the
+// List-Unsubscribe page, a middle-click, and other plugins'
+// ui.openExternalUrl. A link check that warned in the reader was no check.
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { clearAllHooks, pluginErrorTracker, uiHooks } from '@/lib/plugin-hooks';
+import { gateLinkClick, linkText, openExternalLink, resolveExternalLink } from '@/lib/plugin-hook-result';
+import { LinkifiedText } from '@/components/ui/linkified-text';
+import { ReaderViewDialog } from '@/components/email/reader-view-dialog';
+import type { ExternalLinkContext } from '@/lib/plugin-types';
+
+vi.mock('@/hooks/use-focus-trap', () => ({ useFocusTrap: () => ({ current: null }) }));
+
+afterEach(() => {
+  cleanup();
+  clearAllHooks();
+  pluginErrorTracker.resetAll();
+  vi.restoreAllMocks();
+});
+
+function watchLinks(answer: (ctx: ExternalLinkContext) => unknown = () => undefined) {
+  const seen: ExternalLinkContext[] = [];
+  uiHooks.onBeforeExternalLink.register('link-check', (ctx: ExternalLinkContext) => { seen.push(ctx); return answer(ctx); });
+  const open = vi.spyOn(window, 'open').mockReturnValue(null);
+  return { seen, open };
+}
+
+describe('gateLinkClick', () => {
+  it('sends a click on a web link through the check with the link text, then opens it', async () => {
+    const { seen, open } = watchLinks();
+    render(<div onClick={gateLinkClick}><a href="https://evil.example/x">https://bank.example</a></div>);
+    expect(fireEvent.click(screen.getByRole('link'))).toBe(false);
+    await waitFor(() => expect(open).toHaveBeenCalledWith('https://evil.example/x', '_blank', 'noopener,noreferrer'));
+    expect(seen).toEqual([{ href: 'https://evil.example/x', target: '_blank', text: 'https://bank.example' }]);
+  });
+
+  it('opens nothing when the check says no', async () => {
+    const { seen, open } = watchLinks(() => false);
+    render(<div onClick={gateLinkClick}><a href="https://evil.example/x">x</a></div>);
+    fireEvent.click(screen.getByRole('link'));
+    await waitFor(() => expect(seen).toHaveLength(1));
+    await new Promise((r) => setTimeout(r, 10));
+    expect(open).not.toHaveBeenCalled();
+  });
+
+  it('gates a middle-click, and leaves right-clicks, mailto: and tel: to the browser', async () => {
+    const { seen } = watchLinks(() => false);
+    render(
+      <div onClick={gateLinkClick} onAuxClick={gateLinkClick}>
+        <a href="https://evil.example/m">m</a>
+        <a href="mailto:a@example.org">mail</a>
+        <a href="tel:+491">call</a>
+      </div>,
+    );
+    const [web, mail, tel] = screen.getAllByRole('link');
+    expect(fireEvent(web, new MouseEvent('auxclick', { bubbles: true, cancelable: true, button: 1 }))).toBe(false);
+    expect(fireEvent(web, new MouseEvent('auxclick', { bubbles: true, cancelable: true, button: 2 }))).toBe(true);
+    expect(fireEvent.click(mail)).toBe(true);
+    expect(fireEvent.click(tel)).toBe(true);
+    await waitFor(() => expect(seen.map((c) => c.href)).toEqual(['https://evil.example/m']));
+  });
+
+  it('names an image link by its alt text', () => {
+    const a = document.createElement('a');
+    a.innerHTML = '<img alt="  Sign in to   PayPal ">';
+    expect(linkText(a)).toBe('Sign in to PayPal');
+    a.textContent = 'x'.repeat(300);
+    expect(linkText(a)).toHaveLength(200);
+  });
+});
+
+describe('resolveExternalLink and openExternalLink', () => {
+  it("doesn't ask the plugin that opens the link itself", async () => {
+    const own = vi.fn(() => false);
+    const other = vi.fn(() => undefined);
+    uiHooks.onBeforeExternalLink.register('link-check', own);
+    uiHooks.onBeforeExternalLink.register('other', other);
+    expect(await resolveExternalLink({ href: 'https://a.example/' }, { skipPluginId: 'link-check' })).toBe('https://a.example/');
+    expect(own).not.toHaveBeenCalled();
+    expect(other).toHaveBeenCalledTimes(1);
+    expect(await resolveExternalLink({ href: 'https://a.example/' })).toBeNull();
+  });
+
+  it('opens only web addresses', async () => {
+    const { open } = watchLinks();
+    expect(await openExternalLink({ href: 'javascript:alert(1)' })).toBe(false);
+    expect(await openExternalLink({ href: 'https://a.example/' })).toBe(true);
+    expect(open).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('surfaces', () => {
+  it('event descriptions (LinkifiedText)', async () => {
+    const { seen, open } = watchLinks(() => false);
+    render(<LinkifiedText text="Join: https://meet.example/abc" />);
+    expect(fireEvent.click(screen.getByRole('link'))).toBe(false);
+    await waitFor(() => expect(seen.map((c) => c.href)).toEqual(['https://meet.example/abc']));
+    expect(open).not.toHaveBeenCalled();
+  });
+
+  it('the reader view', async () => {
+    const { seen } = watchLinks(() => false);
+    render(
+      <ReaderViewDialog isOpen onClose={() => {}} title="t" html={'<a href="https://evil.example/r" target="_blank">click</a>'} />,
+    );
+    const link = screen.getByTestId('reader-view-body').querySelector('a')!;
+    expect(fireEvent.click(link)).toBe(false);
+    await waitFor(() => expect(seen).toEqual([expect.objectContaining({ href: 'https://evil.example/r', text: 'click' })]));
+  });
+});
+
+describe("other plugins' ui.openExternalUrl", () => {
+  it('goes through the link check, except for the plugin asking', async () => {
+    const { dispatchApiCall } = await import('@/lib/plugin-sandbox/host-api');
+    const { seen, open } = watchLinks(() => false);
+    const caller = (id: string) => ({
+      id, name: id, version: '1', author: '', description: '', type: 'hook', permissions: [], entrypoint: 'index.js',
+      enabled: true, status: 'running', settings: {},
+    }) as never;
+    await dispatchApiCall(caller('other'), 'ui.openExternalUrl', ['https://evil.example/p']);
+    expect(seen.map((c) => c.href)).toEqual(['https://evil.example/p']);
+    expect(open).not.toHaveBeenCalled();
+    // The link check opening the link after its own dialog.
+    await dispatchApiCall(caller('link-check'), 'ui.openExternalUrl', ['https://evil.example/p']);
+    expect(seen).toHaveLength(1);
+    expect(open).toHaveBeenCalledWith('https://evil.example/p', '_blank', 'noopener,noreferrer');
+  });
+});
diff --git a/components/calendar/event-detail-popover.tsx b/components/calendar/event-detail-popover.tsx
index 4c995ab3b..2d3def25a 100644
--- a/components/calendar/event-detail-popover.tsx
+++ b/components/calendar/event-detail-popover.tsx
@@ -34,6 +34,7 @@ import type { AnswerTarget } from "@/lib/calendar-delegate";
 import { isEditableEventTarget } from "@/lib/keyboard";
 import { isSingleKeyShortcutOff } from "@/lib/single-key-shortcuts";
 import { useCvdColor } from "@/hooks/use-cvd-color";
+import { gateLinkClick } from "@/lib/plugin-hook-result";
 
 interface EventDetailPopoverProps {
   event: CalendarEvent;
@@ -524,6 +525,8 @@ export function EventDetailPopover({
               href={locationHref ?? undefined}
               target="_blank"
               rel="noreferrer"
+              onClick={gateLinkClick}
+              onAuxClick={gateLinkClick}
               className={cn("text-sm min-w-0 break-words", locationHref ? "text-primary hover:underline" : "text-foreground")}
               dir="auto"
               title={locationName}
@@ -554,6 +557,8 @@ export function EventDetailPopover({
               href={virtualLocation}
               target="_blank"
               rel="noreferrer"
+              onClick={gateLinkClick}
+              onAuxClick={gateLinkClick}
               className="text-sm text-primary hover:underline truncate"
               title={virtualLocation}
             >
diff --git a/components/calendar/event-modal.tsx b/components/calendar/event-modal.tsx
index 71d61d6f7..08a70b9ef 100644
--- a/components/calendar/event-modal.tsx
+++ b/components/calendar/event-modal.tsx
@@ -53,6 +53,7 @@ import { ConfirmDialog } from "@/components/ui/confirm-dialog";
 import { useConfirmDialog } from "@/hooks/use-confirm-dialog";
 import { useFocusTrap } from "@/hooks/use-focus-trap";
 import { useCvdColor } from "@/hooks/use-cvd-color";
+import { gateLinkClick } from "@/lib/plugin-hook-result";
 
 export interface PendingEventPreview {
   start: Date;
@@ -1128,7 +1129,7 @@ export function EventModal({
               <div className="flex items-start gap-2.5">
                 <MapPin className="w-4 h-4 text-muted-foreground mt-0.5 flex-shrink-0" />
                 {/* A URL opens as a link, a postal address in the maps, as on the card. */}
-                <a href={locationHref ?? undefined} target="_blank" rel="noreferrer" className="text-sm text-primary hover:underline min-w-0 break-words" title={locationName}>
+                <a href={locationHref ?? undefined} target="_blank" rel="noreferrer" onClick={gateLinkClick} onAuxClick={gateLinkClick} className="text-sm text-primary hover:underline min-w-0 break-words" title={locationName}>
                   {/^https?:\/\//i.test(locationName)
                     ? (() => { try { return new URL(locationName).hostname; } catch { return locationName; } })()
                     : locationName}
@@ -1140,7 +1141,7 @@ export function EventModal({
             {virtualLoc && (
               <div className="flex items-start gap-2.5">
                 <Video className="w-4 h-4 text-muted-foreground mt-0.5 flex-shrink-0" />
-                <a href={virtualLoc} target="_blank" rel="noreferrer" className="text-sm text-primary hover:underline truncate" title={virtualLoc}>
+                <a href={virtualLoc} target="_blank" rel="noreferrer" onClick={gateLinkClick} onAuxClick={gateLinkClick} className="text-sm text-primary hover:underline truncate" title={virtualLoc}>
                   {(() => { try { return new URL(virtualLoc).hostname; } catch { return virtualLoc; } })()}
                 </a>
               </div>
diff --git a/components/contacts/contact-detail.tsx b/components/contacts/contact-detail.tsx
index a2f1ea4e4..2b0b382d3 100644
--- a/components/contacts/contact-detail.tsx
+++ b/components/contacts/contact-detail.tsx
@@ -19,6 +19,7 @@ import { usePluginSlotOffers } from "@/hooks/use-plugin-slot-offers";
 import { PluginSlot } from "@/components/plugins/plugin-slot";
 import { contactHooks } from "@/lib/plugin-hooks";
 import { contactToView } from "@/lib/plugin-projection";
+import { gateLinkClick } from "@/lib/plugin-hook-result";
 
 interface ContactDetailProps {
   contact: ContactCard | null;
@@ -283,7 +284,7 @@ export function ContactDetail({ contact, onEdit, onDelete, onAddToGroup, onDupli
                 >
                   <div className="flex items-center gap-2 group">
                     {typeof svc.uri === 'string' && svc.uri.startsWith("http") ? (
-                      <a href={svc.uri} target="_blank" rel="noopener noreferrer" className="text-sm text-primary hover:underline break-all">
+                      <a href={svc.uri} target="_blank" rel="noopener noreferrer" onClick={gateLinkClick} onAuxClick={gateLinkClick} className="text-sm text-primary hover:underline break-all">
                         {svc.user || svc.uri}
                       </a>
                     ) : (
@@ -419,7 +420,7 @@ export function ContactDetail({ contact, onEdit, onDelete, onAddToGroup, onDupli
                   <div className="flex items-start gap-2 text-sm break-all">
                     <KeyRound className="w-4 h-4 text-muted-foreground mt-0.5 flex-shrink-0" />
                     {typeof key.uri === 'string' && key.uri.startsWith("http") ? (
-                      <a href={key.uri} target="_blank" rel="noopener noreferrer" className="text-primary hover:underline">
+                      <a href={key.uri} target="_blank" rel="noopener noreferrer" onClick={gateLinkClick} onAuxClick={gateLinkClick} className="text-primary hover:underline">
                         {key.uri}
                       </a>
                     ) : (
@@ -437,21 +438,21 @@ export function ContactDetail({ contact, onEdit, onDelete, onAddToGroup, onDupli
             <div className="space-y-3">
               {contact.calendarUri && (
                 <FieldRow icon={Calendar} label={t("detail.calendar_uri")}>
-                  <a href={contact.calendarUri} target="_blank" rel="noopener noreferrer" className="text-sm text-primary hover:underline break-all">
+                  <a href={contact.calendarUri} target="_blank" rel="noopener noreferrer" onClick={gateLinkClick} onAuxClick={gateLinkClick} className="text-sm text-primary hover:underline break-all">
                     {contact.calendarUri}
                   </a>
                 </FieldRow>
               )}
               {contact.schedulingUri && (
                 <FieldRow icon={Calendar} label={t("detail.scheduling_uri")}>
-                  <a href={contact.schedulingUri} target="_blank" rel="noopener noreferrer" className="text-sm text-primary hover:underline break-all">
+                  <a href={contact.schedulingUri} target="_blank" rel="noopener noreferrer" onClick={gateLinkClick} onAuxClick={gateLinkClick} className="text-sm text-primary hover:underline break-all">
                     {contact.schedulingUri}
                   </a>
                 </FieldRow>
               )}
               {contact.freeBusyUri && (
                 <FieldRow icon={Calendar} label={t("detail.freebusy_uri")}>
-                  <a href={contact.freeBusyUri} target="_blank" rel="noopener noreferrer" className="text-sm text-primary hover:underline break-all">
+                  <a href={contact.freeBusyUri} target="_blank" rel="noopener noreferrer" onClick={gateLinkClick} onAuxClick={gateLinkClick} className="text-sm text-primary hover:underline break-all">
                     {contact.freeBusyUri}
                   </a>
                 </FieldRow>
diff --git a/components/email/__tests__/thread-conversation-link-gate.test.tsx b/components/email/__tests__/thread-conversation-link-gate.test.tsx
index 00bef1b12..870003337 100644
--- a/components/email/__tests__/thread-conversation-link-gate.test.tsx
+++ b/components/email/__tests__/thread-conversation-link-gate.test.tsx
@@ -75,6 +75,19 @@ describe('conversation view link gate', () => {
     expect(hook).toHaveBeenCalledTimes(1);
   }, 30_000);
 
+  it('sends a middle-click through the check too, with the link text', async () => {
+    const open = vi.spyOn(window, 'open').mockReturnValue(null);
+    const hook = vi.fn(() => false);
+    uiHooks.onBeforeExternalLink.register('p1', hook);
+    const doc = renderBody();
+
+    const ev = new MouseEvent('auxclick', { bubbles: true, cancelable: true, button: 1 });
+    doc.getElementById('web')!.dispatchEvent(ev);
+    expect(ev.defaultPrevented).toBe(true);
+    await waitFor(() => expect(hook).toHaveBeenCalledWith(expect.objectContaining({ href: 'https://site.example/a', text: 'web' })));
+    expect(open).not.toHaveBeenCalled();
+  }, 30_000);
+
   it('opens nothing when a plugin stops the link', async () => {
     const open = vi.spyOn(window, 'open').mockReturnValue(null);
     const hook = vi.fn(() => false);
diff --git a/components/email/__tests__/unsubscribe-banner.test.tsx b/components/email/__tests__/unsubscribe-banner.test.tsx
index 6ca90a263..28d4ace65 100644
--- a/components/email/__tests__/unsubscribe-banner.test.tsx
+++ b/components/email/__tests__/unsubscribe-banner.test.tsx
@@ -50,3 +50,33 @@ describe('UnsubscribeBanner mailto', () => {
     expect(container.textContent).toBe('');
   });
 });
+
+// The https unsubscribe page is a link from the sender like any other in
+// the mail: it opened without the plugins' link check.
+describe('UnsubscribeBanner https', () => {
+  it('opens the page through the link check and stays put when the check says no', async () => {
+    const { uiHooks, clearAllHooks } = await import('@/lib/plugin-hooks');
+    const open = vi.spyOn(window, 'open').mockReturnValue(null);
+    const check = vi.fn(() => false);
+    uiHooks.onBeforeExternalLink.register('link-check', check);
+    try {
+      render(
+        <UnsubscribeBanner
+          listUnsubscribe={{ http: 'https://evil.example/unsub?u=1', preferred: 'http' }}
+          senderEmail="news@evil.example"
+          onSendMailtoUnsubscribe={vi.fn()}
+          onDismiss={() => {}}
+        />,
+      );
+      fireEvent.click(screen.getByText('email_viewer.unsubscribe_banner.button'));
+      fireEvent.click(screen.getByText('email_viewer.unsubscribe_banner.confirm_button'));
+      await waitFor(() => expect(check).toHaveBeenCalledWith(expect.objectContaining({ href: 'https://evil.example/unsub?u=1' })));
+      await new Promise((r) => setTimeout(r, 10));
+      expect(open).not.toHaveBeenCalled();
+      expect(screen.queryByText('email_viewer.unsubscribe_banner.success')).toBeNull();
+    } finally {
+      clearAllHooks();
+      open.mockRestore();
+    }
+  });
+});
diff --git a/components/email/email-viewer.tsx b/components/email/email-viewer.tsx
index ae8b25a55..16cd5dfc1 100644
--- a/components/email/email-viewer.tsx
+++ b/components/email/email-viewer.tsx
@@ -169,7 +169,7 @@ import { usePluginSlotOffers } from "@/hooks/use-plugin-slot-offers";
 import { ResizeHandle } from "@/components/layout/resize-handle";
 import { emailHooks, renderHooks } from "@/lib/plugin-hooks";
 import { emitThreadExpand } from "@/lib/plugin-thread-expand";
-import { resolveExternalLink } from "@/lib/plugin-hook-result";
+import { linkText, resolveExternalLink } from "@/lib/plugin-hook-result";
 import type { AttachmentInfo, AttachmentPreview } from "@/lib/plugin-types";
 import { useAttachmentDrag, isDragOutSupported, type AttachmentDragSource } from "@/hooks/use-attachment-drag";
 import type { IJMAPClient } from "@/lib/jmap/client-interface";
@@ -3521,7 +3521,9 @@ export function EmailViewer({
         // Plugin intercept: let plugins cancel or rewrite external links inside
         // the email body before navigation happens. Bound on the iframe doc so
         // it survives later DOM mutations.
-        const onLinkClick = async (ev: Event) => {
+        const onLinkClick = async (ev: MouseEvent) => {
+          // A middle-click opens a link too; other buttons are left alone.
+          if (ev.type === 'auxclick' && ev.button !== 1) return;
           const targetEl = (ev.target as Element | null)?.closest?.('a[href], area[href]') as HTMLAnchorElement | HTMLAreaElement | null;
           if (!targetEl) return;
           const href = targetEl.getAttribute('href') || '';
@@ -3567,6 +3569,7 @@ export function EmailViewer({
             href,
             target: targetEl.getAttribute('target') ?? undefined,
             emailId: email?.id,
+            text: linkText(targetEl),
           };
           // A plugin returns false to stop the link or { href } to send it
           // somewhere else (a web address only).
@@ -3575,6 +3578,7 @@ export function EmailViewer({
           window.open(target, '_blank', 'noopener,noreferrer');
         };
         doc.addEventListener('click', onLinkClick, true);
+        doc.addEventListener('auxclick', onLinkClick, true);
         // A press in the body closes a mention's card. The page never sees
         // it: the focus is already inside the iframe, so there is no blur.
         doc.addEventListener('mousedown', () => setBodyMention(null), true);
diff --git a/components/email/reader-view-dialog.tsx b/components/email/reader-view-dialog.tsx
index cde105f44..7e1a55c1c 100644
--- a/components/email/reader-view-dialog.tsx
+++ b/components/email/reader-view-dialog.tsx
@@ -9,6 +9,7 @@ import { useMailReading } from "@/hooks/use-mail-reading";
 import { useReadAloud } from "@/hooks/use-read-aloud";
 import { sanitizePlainTextRenderedHtml } from "@/lib/email-sanitization";
 import { ReadAloudBar } from "./read-aloud-bar";
+import { gateLinkClick } from "@/lib/plugin-hook-result";
 
 interface ReaderViewDialogProps {
   isOpen: boolean;
@@ -85,6 +86,9 @@ export function ReaderViewDialog({ isOpen, onClose, title, description, html, la
             ...(reading.comfortableWidth && { maxWidth: '80ch' }),
           }}
           data-testid="reader-view-body"
+          // Links open through the plugins' link check, as in the message.
+          onClick={gateLinkClick}
+          onAuxClick={gateLinkClick}
           dangerouslySetInnerHTML={body}
         />
       </div>
diff --git a/components/email/structured-mail/card-parts.tsx b/components/email/structured-mail/card-parts.tsx
index 4c3b30323..95b5c077e 100644
--- a/components/email/structured-mail/card-parts.tsx
+++ b/components/email/structured-mail/card-parts.tsx
@@ -3,7 +3,7 @@
 import type { ComponentType, ReactNode } from "react";
 import { useLocale, useTranslations } from "next-intl";
 import { ExternalLink } from "@/components/icons";
-import { resolveExternalLink } from "@/lib/plugin-hook-result";
+import { openExternalLink } from "@/lib/plugin-hook-result";
 import { formatMoment, formatMomentTime, isOtherZone, isWebLink, type FormatOptions } from "@/lib/structured-mail/format";
 import type { Link, Moment, ReservationStatus } from "@/lib/structured-mail/types";
 import { resolveTimeZone } from "@/lib/timezone";
@@ -89,12 +89,16 @@ export function CardLink({ link, label, icon: Icon = ExternalLink, emailId }: {
       rel="noopener noreferrer"
       className={cn(ACTION_CLASS, "flex-wrap gap-y-0")}
       data-testid="structured-mail-link"
-      onClick={async (e) => {
+      onClick={(e) => {
         e.preventDefault();
         e.stopPropagation();
-        const target = await resolveExternalLink({ href: link.url, target: "_blank", emailId });
-        if (!target) return;
-        window.open(target, "_blank", "noopener,noreferrer");
+        void openExternalLink({ href: link.url, target: "_blank", emailId, text: label });
+      }}
+      onAuxClick={(e) => {
+        if (e.button !== 1) return;
+        e.preventDefault();
+        e.stopPropagation();
+        void openExternalLink({ href: link.url, target: "_blank", emailId, text: label });
       }}
     >
       <Icon aria-hidden="true" className="w-3.5 h-3.5 flex-shrink-0" />
diff --git a/components/email/thread-conversation-view.tsx b/components/email/thread-conversation-view.tsx
index 83fe608f2..84efe4078 100644
--- a/components/email/thread-conversation-view.tsx
+++ b/components/email/thread-conversation-view.tsx
@@ -4,7 +4,7 @@ import React, { useState, useEffect, useLayoutEffect, useMemo, useRef, useCallba
 import DOMPurify from "dompurify";
 import { Email, ThreadGroup } from "@/lib/jmap/types";
 import { EMAIL_SANITIZE_CONFIG, TRANSPARENT_BLOCKED_PIXEL, blockExternalResourcesOnNode, collapseBlockedImageContainers, emailIframeCsp, isOpenableLinkHref, plainTextToSafeHtml, restrictDataUriResourcesOnNode, sanitizeEmailBodyForIframe, sanitizePlainTextRenderedHtml } from "@/lib/email-sanitization";
-import { resolveExternalLink } from "@/lib/plugin-hook-result";
+import { linkText, resolveExternalLink } from "@/lib/plugin-hook-result";
 import { stripBidiControls } from "@/lib/bidi";
 import { requestInternalMailto } from "@/lib/protocol-handlers/mailto";
 import { emailDisplayDate } from "@/lib/email-date";
@@ -879,7 +879,9 @@ export function ConversationEmailBody({
       // through onBeforeExternalLink, and nothing resolving inside our own
       // origin (a relative path, data:) is opened. mailto: is written here
       // when the mail page takes it; the blob: URLs of cid: parts are inert.
-      doc.addEventListener('click', (ev) => {
+      const onLinkClick = (ev: MouseEvent) => {
+        // A middle-click opens a link too; other buttons are left alone.
+        if (ev.type === 'auxclick' && ev.button !== 1) return;
         const link = (ev.target as Element | null)?.closest?.('a[href], area[href]');
         if (!link) return;
         const href = link.getAttribute('href') || '';
@@ -891,9 +893,11 @@ export function ConversationEmailBody({
         ev.preventDefault();
         ev.stopPropagation();
         if (!isOpenableLinkHref(href)) return;
-        void resolveExternalLink({ href, target: link.getAttribute('target') ?? undefined, emailId: email.id })
+        void resolveExternalLink({ href, target: link.getAttribute('target') ?? undefined, emailId: email.id, text: linkText(link) })
           .then((target) => { if (target) window.open(target, '_blank', 'noopener,noreferrer'); });
-      }, true);
+      };
+      doc.addEventListener('click', onLinkClick, true);
+      doc.addEventListener('auxclick', onLinkClick, true);
       // Selected text: the onTextSelectionChange hook and the right-click
       // menu plugins may add entries to.
       watchBodySelection(doc, iframe, {
diff --git a/components/email/unsubscribe-banner.tsx b/components/email/unsubscribe-banner.tsx
index 361332080..14d0b6247 100644
--- a/components/email/unsubscribe-banner.tsx
+++ b/components/email/unsubscribe-banner.tsx
@@ -6,6 +6,7 @@ import { useTranslations } from 'next-intl';
 import { isValidUnsubscribeUrl, parseUnsubscribeMailto } from '@/lib/validation';
 import { ConfirmDialog } from '@/components/ui/confirm-dialog';
 import { useIsDesktop } from '@/hooks/use-media-query';
+import { openExternalLink } from '@/lib/plugin-hook-result';
 
 interface UnsubscribeBannerProps {
   listUnsubscribe: {
@@ -83,7 +84,13 @@ export function UnsubscribeBanner({
 
     try {
       if (unsubMethod === 'http') {
-        window.open(unsubUrl, '_blank', 'noopener,noreferrer');
+        // Through the plugins' link check like any other link in the mail;
+        // a check that stops it leaves the banner as it was.
+        if (!(await openExternalLink({ href: unsubUrl, target: '_blank' }))) {
+          setProcessing(false);
+          setShowConfirm(false);
+          return;
+        }
         setSuccess(true);
         setProcessing(false);
         setShowConfirm(false);
diff --git a/components/notifications/notification-center.tsx b/components/notifications/notification-center.tsx
index 2fa8d0474..34204bf66 100644
--- a/components/notifications/notification-center.tsx
+++ b/components/notifications/notification-center.tsx
@@ -8,6 +8,7 @@ import { useConfig } from "@/hooks/use-config";
 import { useFocusTrap } from "@/hooks/use-focus-trap";
 import { isDocumentRTL } from "@/i18n/direction";
 import { toastHooks } from "@/lib/plugin-hooks";
+import { gateLinkClick } from "@/lib/plugin-hook-result";
 import { cn } from "@/lib/utils";
 import { Button } from "@/components/ui/button";
 import { IconButton } from "@/components/ui/icon-button";
@@ -125,7 +126,8 @@ export function NotificationPanel({ onClose, className, sheet = false }: { onClo
                     href={entry.action.url}
                     target="_blank"
                     rel="noopener noreferrer"
-                    onClick={() => markRead(entry.id)}
+                    onClick={(event) => { markRead(entry.id); gateLinkClick(event); }}
+                    onAuxClick={(event) => { markRead(entry.id); gateLinkClick(event); }}
                     className="-mt-1 mb-1 ms-[38px] inline-flex items-center gap-1 rounded text-xs font-medium text-primary hover:underline focus-visible:outline-hidden"
                   >
                     {entry.action.label}
diff --git a/components/ui/linkified-text.tsx b/components/ui/linkified-text.tsx
index f86bd3c0e..d44dc711e 100644
--- a/components/ui/linkified-text.tsx
+++ b/components/ui/linkified-text.tsx
@@ -2,6 +2,7 @@
 
 import { useMemo } from "react";
 import { plainTextToSafeHtml, sanitizePlainTextRenderedHtml } from "@/lib/email-sanitization";
+import { gateLinkClick } from "@/lib/plugin-hook-result";
 
 interface LinkifiedTextProps {
   /** Plain text, as stored on the object (no markup is interpreted). */
@@ -21,7 +22,9 @@ interface LinkifiedTextProps {
  * whole string and emits nothing but `<a href="http(s)://...">`, then
  * `sanitizePlainTextRenderedHtml` re-checks the result. That second pass is
  * defense in depth - unlike message bodies this renders into the main
- * document, not the sandboxed iframe.
+ * document, not the sandboxed iframe. A click or middle-click on a link goes
+ * through the plugins' link check (onBeforeExternalLink) like a link in a
+ * message.
  */
 export function LinkifiedText({ text, className }: LinkifiedTextProps) {
   const html = useMemo(
@@ -29,5 +32,5 @@ export function LinkifiedText({ text, className }: LinkifiedTextProps) {
     [text],
   );
 
-  return <span className={className} dangerouslySetInnerHTML={{ __html: html }} />;
+  return <span className={className} onClick={gateLinkClick} onAuxClick={gateLinkClick} dangerouslySetInnerHTML={{ __html: html }} />;
 }
diff --git a/lib/plugin-hook-result.ts b/lib/plugin-hook-result.ts
index b7f1ed017..3540a920f 100644
--- a/lib/plugin-hook-result.ts
+++ b/lib/plugin-hook-result.ts
@@ -45,14 +45,56 @@ export function acceptLinkRewrite<T extends { href: string }>(result: unknown, c
 }
 
 /**
- * Ask onBeforeExternalLink about a click on a link in a message. Resolves to
- * the address to open: the original, the one a plugin rewrote it to, or null
- * when a plugin stopped it.
+ * Ask onBeforeExternalLink about a link the user opens. Resolves to the
+ * address to open: the original, the one a plugin rewrote it to, or null
+ * when a plugin stopped it. `skipPluginId`: a plugin opening a link itself
+ * (ui.openExternalUrl) isn't asked about it again, so a link check can open
+ * the link after its own dialog.
  */
-export async function resolveExternalLink(ctx: ExternalLinkContext): Promise<string | null> {
+export async function resolveExternalLink(ctx: ExternalLinkContext, opts: { skipPluginId?: string } = {}): Promise<string | null> {
   const outcome = uiHooks.onBeforeExternalLink.size > 0
-    ? await uiHooks.onBeforeExternalLink.interceptWithValue(ctx, acceptLinkRewrite)
+    ? await uiHooks.onBeforeExternalLink.interceptWithValue(ctx, acceptLinkRewrite, { skipPluginId: opts.skipPluginId })
     : { allowed: true as const, value: ctx };
   if (!outcome.allowed || !isOpenableLinkHref(outcome.value.href)) return null;
   return outcome.value.href;
 }
+
+/** Longest link text handed to plugins. */
+const MAX_LINK_TEXT = 200;
+
+/** What a link says, for ExternalLinkContext.text: its text, else an image's alt text. */
+export function linkText(link: Element): string | undefined {
+  const own = (link.textContent ?? '').replace(/\s+/g, ' ').trim();
+  const text = own || (link.querySelector('img[alt]')?.getAttribute('alt') ?? '').replace(/\s+/g, ' ').trim();
+  return text ? text.slice(0, MAX_LINK_TEXT) : undefined;
+}
+
+/**
+ * Open an outside link the way every link in the app opens: through
+ * onBeforeExternalLink, then in a new tab. Resolves true when it opened.
+ */
+export async function openExternalLink(ctx: ExternalLinkContext, opts: { skipPluginId?: string } = {}): Promise<boolean> {
+  if (!isOpenableLinkHref(ctx.href)) return false;
+  const target = await resolveExternalLink(ctx, opts);
+  if (!target) return false;
+  window.open(target, '_blank', 'noopener,noreferrer');
+  return true;
+}
+
+/**
+ * A click or middle-click on a web link inside `event.currentTarget`
+ * (rendered text with links, an anchor of our own): the browser's own
+ * navigation is stopped and the link goes through openExternalLink. Other
+ * links (mailto:, tel:, in-app paths) and other buttons are left alone.
+ * "Copy link address" and the browser's context menu stay out of reach.
+ */
+export function gateLinkClick(event: { target: EventTarget | null; button: number; type: string; preventDefault(): void; stopPropagation(): void }, extra: Partial<ExternalLinkContext> = {}): void {
+  if (event.type === 'auxclick' ? event.button !== 1 : event.button !== 0) return;
+  const link = (event.target as Element | null)?.closest?.('a[href]') as HTMLAnchorElement | null;
+  if (!link) return;
+  const href = link.getAttribute('href') ?? '';
+  if (!/^https?:/i.test(href.trim())) return;
+  event.preventDefault();
+  event.stopPropagation();
+  void openExternalLink({ href: href.trim(), target: link.getAttribute('target') ?? '_blank', text: linkText(link), ...extra });
+}
diff --git a/lib/plugin-hooks.ts b/lib/plugin-hooks.ts
index b46b5ba01..0c9059d5f 100644
--- a/lib/plugin-hooks.ts
+++ b/lib/plugin-hooks.ts
@@ -285,16 +285,18 @@ export class HookBus<T extends (...args: any[]) => any> {
    * with the intercept budget; `accept` turns a return value into the next
    * value, or returns undefined to ignore it. A handler that throws or runs
    * out of time is skipped (fail open), and counts as a failure like any
-   * other hook error.
+   * other hook error. `skipPluginId` leaves one plugin's handlers out (a
+   * plugin opening a link itself isn't asked about it again).
    */
   async interceptWithValue<V>(
     initial: V,
     accept: (result: unknown, current: V) => V | undefined,
-    opts: { timeoutMs?: number } = {},
+    opts: { timeoutMs?: number; skipPluginId?: string } = {},
   ): Promise<{ allowed: false } | { allowed: true; value: V }> {
     const budget = opts.timeoutMs ?? Math.max(this.timeoutMs, INTERCEPT_TIMEOUT_MS);
     let value = initial;
     for (const { pluginId, handler } of this.handlers) {
+      if (pluginId === opts.skipPluginId) continue;
       if (pluginErrorTracker.isDisabled(pluginId)) continue;
       let result: unknown;
       try {
@@ -737,10 +739,11 @@ export const uiHooks = {
   onDeviceTypeChange: new HookBus(),
   onColumnResize: new HookBus(),
   onMobileBack: new HookBus(),
-  // Intercept hook - fires when the user clicks an external link inside the
-  // app (typically inside an email body iframe). Handler receives
-  // ExternalLinkContext; return false to cancel the navigation. Mutate
-  // `href` in place to rewrite (e.g. strip UTM params, route via a proxy).
+  // Intercept hook - fires when the user opens an outside link anywhere in
+  // the app (message bodies, the reader view, events, contacts,
+  // notifications, unsubscribe links, other plugins' ui.openExternalUrl;
+  // lib/plugin-hook-result.ts). Handler receives ExternalLinkContext; return
+  // false to cancel the navigation or { href } to send it elsewhere.
   onBeforeExternalLink: new HookBus(),
   // Observer (debounced) fired when the user changes the active text
   // selection inside an app surface. Receives SelectionContext.
diff --git a/lib/plugin-sandbox/host-api.ts b/lib/plugin-sandbox/host-api.ts
index 4b727dc50..1319cf2c6 100644
--- a/lib/plugin-sandbox/host-api.ts
+++ b/lib/plugin-sandbox/host-api.ts
@@ -68,6 +68,7 @@ import { requestPageNavigation } from './page-navigation';
 import { requestOpenEmail } from './open-email';
 import { doComposerAttach, doComposerGetBody, doComposerGetSelection, doComposerReplaceBody, doComposerReplaceSelection } from './host-api-composer';
 import { pluginAllowed, wkdAllowed } from '../outgoing-hosts';
+import { resolveExternalLink } from '../plugin-hook-result';
 
 /**
  * Methods only callable from the privileged (same-origin) tier. These expose
@@ -2211,9 +2212,14 @@ export async function dispatchApiCall(
       if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
         throw new Error(`ui.openExternalUrl: ${parsed.protocol} not allowed`);
       }
+      // Other plugins' link checks (onBeforeExternalLink) see it like a
+      // click in a message; the plugin's own handler isn't asked again, so a
+      // link check opens the link after its dialog.
+      const target = await resolveExternalLink({ href: parsed.toString(), target: '_blank' }, { skipPluginId: plugin.id });
+      if (!target) return undefined;
       // Always open in a new tab; plugins must not be able to navigate the
       // host window (_self/_top/_parent) to an attacker-controlled origin.
-      window.open(parsed.toString(), '_blank', 'noopener,noreferrer');
+      window.open(target, '_blank', 'noopener,noreferrer');
       return undefined;
     }
     case 'ui.print': return doUiPrint(plugin, args[0]);
diff --git a/lib/plugin-types.ts b/lib/plugin-types.ts
index 746fe09e2..0fcdd15a0 100644
--- a/lib/plugin-types.ts
+++ b/lib/plugin-types.ts
@@ -1267,6 +1267,12 @@ export interface ExternalLinkContext {
   target?: string;
   /** Email currently in view, when the click came from an email body */
   emailId?: string;
+  /**
+   * What the link says (its text, else an image's alt text), trimmed to 200
+   * characters, when the host knows it (Bulwark 1.20 and later). A link
+   * whose text names another address than its target is a phishing sign.
+   */
+  text?: string;
 }
 
 /**

From e73a1b375f1b0e07fac8a889310a7894906a4872 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 08:39:35 +0100
Subject: [PATCH 05/17] feat: let link-check plugins reach an admin-set service
 with no third-party traffic

The plugin host tests compared api.host.features with an object of two
flags; they now include the new noThirdPartyTraffic flag.
---
 app/api/admin/outgoing-hosts/route.ts         | 24 ++++++--
 app/api/plugin-proxy/route.ts                 | 15 ++++-
 app/api/plugins/route.ts                      |  7 ++-
 .../org/sections/third-party-section.tsx      |  7 +++
 lib/__tests__/no-third-party-client.test.ts   | 15 ++++-
 lib/__tests__/no-third-party-server.test.ts   | 58 ++++++++++++++++++-
 lib/__tests__/plugin-host-features.test.ts    | 33 ++++++++---
 lib/admin/reachable-hosts.ts                  | 12 +++-
 lib/outgoing-hosts.ts                         | 40 ++++++++++++-
 lib/plugin-sandbox/host-api.ts                |  8 ++-
 lib/plugin-sandbox/host-features.ts           | 19 +++---
 lib/plugin-sandbox/runtime.tsx                |  5 +-
 lib/plugin-secrets/proxy.ts                   | 20 +++++++
 lib/plugin-types.ts                           |  8 +++
 14 files changed, 238 insertions(+), 33 deletions(-)

diff --git a/app/api/admin/outgoing-hosts/route.ts b/app/api/admin/outgoing-hosts/route.ts
index d7eaeccce..67597c3ac 100644
--- a/app/api/admin/outgoing-hosts/route.ts
+++ b/app/api/admin/outgoing-hosts/route.ts
@@ -5,7 +5,9 @@ import { isConfigReadOnly } from '@/lib/admin/paths';
 import { getPluginRegistry } from '@/lib/admin/plugin-registry';
 import { noThirdPartyTrafficState } from '@/lib/admin/third-party-mode';
 import { listReachableHosts } from '@/lib/admin/reachable-hosts';
-import { pluginDeclaresNetwork } from '@/lib/outgoing-hosts';
+import { pluginAllowedInMode, pluginDeclaresNetwork } from '@/lib/outgoing-hosts';
+import { adminEnteredOrigins } from '@/lib/plugin-secrets/proxy';
+import type { CredentialSpec } from '@/lib/plugin-secrets/credentials';
 import { OUTGOING_HOSTS } from '@/lib/admin/outgoing-hosts-registry';
 import { logger } from '@/lib/logger';
 
@@ -25,6 +27,17 @@ export async function GET(request: NextRequest) {
     const state = noThirdPartyTrafficState();
     const policy = configManager.getPolicy();
     const registry = await getPluginRegistry().catch(() => ({ plugins: [] }));
+    const enabled = registry.plugins.filter((plugin) => plugin.enabled);
+    // Plugins that run in the mode with the servers the admin entered for
+    // them; their manifest-fixed servers (Google Safe Browsing) stay off.
+    const modePlugins = enabled.filter((plugin) => pluginDeclaresNetwork(plugin) && pluginAllowedInMode(plugin));
+    const pluginHosts = await Promise.all(modePlugins.map(async (plugin) => ({
+      id: plugin.id,
+      name: plugin.name,
+      origins: await adminEnteredOrigins(plugin.id).catch(() => [] as string[]),
+      fixed: [...new Set(Object.values((plugin as { credentials?: Record<string, CredentialSpec> }).credentials ?? {})
+        .flatMap((spec) => (spec.origin ? [new URL(spec.origin).host] : [])))],
+    })));
 
     return NextResponse.json(
       {
@@ -35,10 +48,13 @@ export async function GET(request: NextRequest) {
         readOnly: isConfigReadOnly(),
         envLocked: state.source === 'env',
         builtIn: OUTGOING_HOSTS,
-        reachable: listReachableHosts({ get: (key) => configManager.get(key), policy, env: process.env }),
-        networkPlugins: registry.plugins
-          .filter((plugin) => plugin.enabled && pluginDeclaresNetwork(plugin))
+        reachable: listReachableHosts({ get: (key) => configManager.get(key), policy, env: process.env, plugins: pluginHosts }),
+        networkPlugins: enabled
+          .filter((plugin) => pluginDeclaresNetwork(plugin) && !pluginAllowedInMode(plugin))
           .map((plugin) => ({ id: plugin.id, name: plugin.name })),
+        partlyOffPlugins: pluginHosts
+          .filter((plugin) => plugin.fixed.length > 0)
+          .map(({ id, name, fixed }) => ({ id, name, hosts: fixed })),
       },
       { headers: { 'Cache-Control': 'no-store' } },
     );
diff --git a/app/api/plugin-proxy/route.ts b/app/api/plugin-proxy/route.ts
index 979eb4c26..3bf248e6f 100644
--- a/app/api/plugin-proxy/route.ts
+++ b/app/api/plugin-proxy/route.ts
@@ -3,7 +3,9 @@ import { configManager } from '@/lib/admin/config-manager';
 import { isNoThirdPartyTrafficOn, thirdPartyRefusal } from '@/lib/admin/third-party-mode';
 import { rejectCrossOriginRequest } from '@/lib/security/same-origin';
 import { getStalwartCredentials } from '@/lib/stalwart/credentials';
-import { CREDENTIAL_ID_RE } from '@/lib/plugin-secrets/credentials';
+import { CREDENTIAL_ID_RE, type CredentialSpec } from '@/lib/plugin-secrets/credentials';
+import { credentialAllowedInMode } from '@/lib/outgoing-hosts';
+import { getPlugin } from '@/lib/admin/plugin-registry';
 import { ProxyError, proxyRequest, type CaptureSpec } from '@/lib/plugin-secrets/proxy';
 import { bootGateResponse } from '@/lib/shared-store/boot-gate';
 
@@ -46,8 +48,7 @@ export async function POST(request: NextRequest) {
   if (!configManager.getPolicy().features.pluginsEnabled) {
     return NextResponse.json({ error: 'Plugins are turned off', code: 'disabled' }, { status: 403 });
   }
-  // Every proxied request goes to a host outside this deployment (#903).
-  if (await isNoThirdPartyTrafficOn()) return thirdPartyRefusal('The plugin proxy');
+  const thirdPartyOff = await isNoThirdPartyTrafficOn();
 
   const creds = await getStalwartCredentials(request);
   if (!creds) return NextResponse.json({ error: 'Not authenticated', code: 'unauthenticated' }, { status: 401 });
@@ -59,6 +60,14 @@ export async function POST(request: NextRequest) {
   if (!PLUGIN_ID_RE.test(pluginId) || !CREDENTIAL_ID_RE.test(credentialId) || !url) {
     return NextResponse.json({ error: 'plugin, credential and url are required', code: 'bad_request' }, { status: 400 });
   }
+  // With third-party traffic off only a server the admin entered on the
+  // plugin's admin page stays reachable (a company link check); servers
+  // fixed in a manifest and accounts users connect are outside hosts (#903).
+  if (thirdPartyOff) {
+    const plugin = await getPlugin(pluginId);
+    const spec = (plugin as { credentials?: Record<string, CredentialSpec> } | null)?.credentials?.[credentialId];
+    if (!credentialAllowedInMode(spec)) return thirdPartyRefusal('The plugin proxy');
+  }
   const capture = parseCapture(request.headers.get('x-bulwark-capture'));
   if (capture === null) {
     return NextResponse.json({ error: 'Invalid X-Bulwark-Capture header', code: 'bad_capture' }, { status: 400 });
diff --git a/app/api/plugins/route.ts b/app/api/plugins/route.ts
index 39dd01460..8a91d2e4b 100644
--- a/app/api/plugins/route.ts
+++ b/app/api/plugins/route.ts
@@ -6,7 +6,7 @@ import { configManager } from '@/lib/admin/config-manager';
 import { logger } from '@/lib/logger';
 import { storeUnavailableResponse } from '@/lib/admin/store-unavailable-response';
 import { isNoThirdPartyTrafficOn } from '@/lib/admin/third-party-mode';
-import { pluginDeclaresNetwork } from '@/lib/outgoing-hosts';
+import { pluginAllowedInMode } from '@/lib/outgoing-hosts';
 
 /**
  * GET /api/plugins - Public endpoint for clients to discover server-managed plugins & themes
@@ -36,13 +36,14 @@ export async function GET(request: NextRequest) {
     const devIds = new Set(devEntries.map(e => e.plugin.id));
     const installedEnabled = pluginRegistry.plugins.filter(p => p.enabled && !devIds.has(p.id));
     // Plugins that declare network access never reach a browser while the
-    // server must stay off outside hosts (#903); the rest run as usual.
+    // server must stay off outside hosts (#903); the rest run as usual, and
+    // so do those that reach only servers the admin entered for them.
     const noThirdParty = await isNoThirdPartyTrafficOn();
 
     const plugins = [
       ...devEntries.map(e => ({ ...e.plugin, dev: true })),
       ...installedEnabled.map(p => ({ ...p, dev: false })),
-    ].filter(p => !(noThirdParty && pluginDeclaresNetwork(p))).map(p => ({
+    ].filter(p => !noThirdParty || pluginAllowedInMode(p)).map(p => ({
       id: p.id,
       name: p.name,
       version: p.version,
diff --git a/components/admin/org/sections/third-party-section.tsx b/components/admin/org/sections/third-party-section.tsx
index 9280d8b48..7dc8ec34b 100644
--- a/components/admin/org/sections/third-party-section.tsx
+++ b/components/admin/org/sections/third-party-section.tsx
@@ -18,6 +18,8 @@ interface OutgoingHostsState {
   builtIn: OutgoingHost[];
   reachable: ReachableHost[];
   networkPlugins: { id: string; name: string }[];
+  /** Running in the mode with the servers entered on their admin page; these manifest servers stay off. */
+  partlyOffPlugins?: { id: string; name: string; hosts: string[] }[];
 }
 
 const SIDE_LABEL: Record<ReachableHost['side'], string> = {
@@ -146,6 +148,11 @@ export function ThirdPartySection({ draft }: { draft: OrgPolicyDraft }) {
               Not running because they declare network access: {state.networkPlugins.map((p) => p.name).join(', ')}.
             </ConfigNote>
           )}
+          {on && (state.partlyOffPlugins?.length ?? 0) > 0 && (
+            <ConfigNote>
+              Running with only the servers entered on their admin page: {state.partlyOffPlugins!.map((p) => `${p.name} (${p.hosts.join(', ')} stays off)`).join('; ')}.
+            </ConfigNote>
+          )}
 
           <div data-testid="third-party-reachable">
             <h4 className="text-sm font-medium text-foreground">{on ? 'Still reachable' : 'Stays reachable with the switch on'}</h4>
diff --git a/lib/__tests__/no-third-party-client.test.ts b/lib/__tests__/no-third-party-client.test.ts
index 0445d9468..0aee3a27b 100644
--- a/lib/__tests__/no-third-party-client.test.ts
+++ b/lib/__tests__/no-third-party-client.test.ts
@@ -4,7 +4,7 @@ import { resyncWebPush, revokePushDevice, type PushDevice } from '@/lib/web-push
 import { doGetPublicKeyFromWKD } from '@/lib/plugin-sandbox/host-api';
 import { applyLiteConfig } from '@/lib/lite-config';
 import { setNoThirdPartyTraffic, noThirdPartyTraffic, parseNoThirdPartyEnv } from '@/lib/third-party-mode';
-import { isBuiltInHost, pluginAllowed, pluginDeclaresNetwork } from '@/lib/outgoing-hosts';
+import { credentialAllowedInMode, isBuiltInHost, pluginAllowed, pluginDeclaresNetwork } from '@/lib/outgoing-hosts';
 import { isPlaceholderHost } from '@/lib/admin/outgoing-hosts-registry';
 import type { IJMAPClient } from '@/lib/jmap/client-interface';
 
@@ -116,6 +116,19 @@ describe('plugins', () => {
 });
 
 describe('config', () => {
+  it('lets a plugin run that reaches only servers the admin entered, and no other', () => {
+    setNoThirdPartyTraffic(true);
+    const admin = (extra: Record<string, unknown>) => ({ label: 'x', scope: 'admin', secretKey: 's', ...extra });
+    const linkCheck = { permissions: ['http:proxy'], credentials: { company: admin({ originKey: 'url' }), google: admin({ origin: 'https://safebrowsing.googleapis.com' }) } };
+    const fixedOnly = { permissions: ['http:proxy'], credentials: { google: admin({ origin: 'https://safebrowsing.googleapis.com' }) } };
+    const userAccount = { permissions: ['http:proxy'], credentials: { company: admin({ originKey: 'url' }), own: { label: 'x', scope: 'user' } } };
+    const alsoFetches = { permissions: ['http:proxy', 'http:fetch'], httpOrigins: ['https://api.vendor.example'], credentials: { company: admin({ originKey: 'url' }) } };
+    expect([linkCheck, fixedOnly, userAccount, alsoFetches].map(pluginAllowed)).toEqual([true, false, false, false]);
+    expect(credentialAllowedInMode(linkCheck.credentials.company)).toBe(true);
+    expect(credentialAllowedInMode(linkCheck.credentials.google)).toBe(false);
+    setNoThirdPartyTraffic(false);
+  });
+
   it('reads noThirdPartyTraffic from the Lite config.json', () => {
     expect(applyLiteConfig({}).noThirdPartyTraffic).toBe(false);
     expect(applyLiteConfig({ noThirdPartyTraffic: true }).noThirdPartyTraffic).toBe(true);
diff --git a/lib/__tests__/no-third-party-server.test.ts b/lib/__tests__/no-third-party-server.test.ts
index 16c7b136a..67cf93742 100644
--- a/lib/__tests__/no-third-party-server.test.ts
+++ b/lib/__tests__/no-third-party-server.test.ts
@@ -26,7 +26,7 @@ const registryPlugins: Record<string, unknown>[] = [];
 vi.mock('@/lib/admin/plugin-registry', () => ({
   getPluginRegistry: vi.fn(async () => ({ plugins: registryPlugins })),
   getThemeRegistry: vi.fn(async () => ({ themes: [] })),
-  getPlugin: vi.fn(async () => null),
+  getPlugin: vi.fn(async (id: string) => registryPlugins.find((p) => p.id === id) ?? null),
   getTheme: vi.fn(async () => null),
 }));
 vi.mock('@/lib/admin/plugin-dev', () => ({ listDevPlugins: vi.fn(async () => []) }));
@@ -358,3 +358,59 @@ describe('review follow-ups', () => {
     }
   });
 });
+
+// A company link check is a server the admin entered on the plugin's admin
+// page: it stays reachable with the switch on, like the JMAP server. The
+// plugin used to be refused completely, and its domain warning with it.
+describe('plugins reaching only servers the admin entered', () => {
+  const linkCheck = {
+    id: 'link-check', name: 'Link Check', version: '2.0.0', enabled: true, permissions: ['http:proxy'],
+    configSchema: { endpointUrl: { type: 'string', label: 'URL' }, token: { type: 'secret', label: 'Token' }, key: { type: 'secret', label: 'Key' } },
+    credentials: {
+      company: { label: 'Company', scope: 'admin', inject: { type: 'none' }, secretKey: 'token', originKey: 'endpointUrl' },
+      google: { label: 'Google', scope: 'admin', inject: { type: 'header', name: 'X-Goog-Api-Key' }, secretKey: 'key', origin: 'https://safebrowsing.googleapis.com' },
+    },
+  };
+  const googleOnly = {
+    id: 'google-only', name: 'Google Only', version: '1.0.0', enabled: true, permissions: ['http:proxy'],
+    configSchema: { key: { type: 'secret', label: 'Key' } },
+    credentials: { google: { label: 'Google', scope: 'admin', inject: { type: 'bearer' }, secretKey: 'key', origin: 'https://safebrowsing.googleapis.com' } },
+  };
+
+  it('reach the browser in the mode, unlike one with only fixed servers', async () => {
+    registryPlugins.push(linkCheck, googleOnly);
+    const { GET } = await import('@/app/api/plugins/route');
+    await setMode(true);
+    const on = await (await GET(new NextRequest('https://webmail.example/api/plugins'))).json();
+    expect(on.plugins.map((p: { id: string }) => p.id)).toEqual(['link-check']);
+  });
+
+  it('get the proxy for the admin-entered server only', async () => {
+    registryPlugins.push(linkCheck);
+    const { setPluginConfig } = await import('@/lib/admin/plugin-config');
+    await setPluginConfig('link-check', 'endpointUrl', 'https://linkcheck.corp.example/check');
+    fetchMock.mockResolvedValueOnce(new Response('{"verdict":"safe"}', { headers: { 'content-type': 'application/json' } }));
+    const { POST } = await import('@/app/api/plugin-proxy/route');
+    await setMode(true, { features: { pluginsEnabled: true } });
+    const company = await POST(new NextRequest('https://webmail.example/api/plugin-proxy?plugin=link-check&credential=company&url=https%3A%2F%2Flinkcheck.corp.example%2Fcheck', { method: 'POST' }));
+    expect((await company.clone().json().catch(() => ({}))).code).not.toBe('no-third-party-traffic');
+    const google = await POST(new NextRequest('https://webmail.example/api/plugin-proxy?plugin=link-check&credential=google&url=https%3A%2F%2Fsafebrowsing.googleapis.com%2Fv5%2Fhashes%3Asearch', { method: 'POST' }));
+    expect(google.status).toBe(403);
+    expect((await google.json()).code).toBe('no-third-party-traffic');
+    expect(calledHosts()).not.toContain('safebrowsing.googleapis.com');
+  });
+
+  it('are listed on the Security page with the server the admin entered and the one that stays off', async () => {
+    registryPlugins.push(linkCheck, googleOnly);
+    const { setPluginConfig } = await import('@/lib/admin/plugin-config');
+    await setPluginConfig('link-check', 'endpointUrl', 'https://linkcheck.corp.example/check');
+    const { GET } = await import('@/app/api/admin/outgoing-hosts/route');
+    await setMode(true);
+    const body = await (await GET(new NextRequest('https://webmail.example/api/admin/outgoing-hosts'))).json();
+    expect(body.reachable).toEqual(expect.arrayContaining([
+      expect.objectContaining({ kind: 'Plugin Link Check', host: 'linkcheck.corp.example', side: 'server' }),
+    ]));
+    expect(body.networkPlugins).toEqual([{ id: 'google-only', name: 'Google Only' }]);
+    expect(body.partlyOffPlugins).toEqual([{ id: 'link-check', name: 'Link Check', hosts: ['safebrowsing.googleapis.com'] }]);
+  });
+});
diff --git a/lib/__tests__/plugin-host-features.test.ts b/lib/__tests__/plugin-host-features.test.ts
index 3ed2adae4..5c76a65d5 100644
--- a/lib/__tests__/plugin-host-features.test.ts
+++ b/lib/__tests__/plugin-host-features.test.ts
@@ -10,6 +10,7 @@ import { render, cleanup, waitFor } from '@testing-library/react';
 import { DEFAULT_ORGANISATION_POLICY } from '@/lib/admin/organisation-policy';
 import { DEFAULT_POLICY } from '@/lib/admin/types';
 import { usePolicyStore } from '@/stores/policy-store';
+import { setNoThirdPartyTraffic } from '@/lib/third-party-mode';
 import {
   EXTERNAL_MAIL_WARNING_PLUGIN_ID,
   isHookHandedOver,
@@ -30,11 +31,22 @@ beforeEach(() => setExternalMail({}));
 
 describe('snapshotHostFeatures', () => {
   it('has one flag per switch', () => {
-    expect(snapshotHostFeatures()).toEqual({ externalSenderLabel: false, externalRecipientWarning: false });
+    expect(snapshotHostFeatures()).toEqual({ externalSenderLabel: false, externalRecipientWarning: false, noThirdPartyTraffic: false });
     setExternalMail({ senderLabel: true });
-    expect(snapshotHostFeatures()).toEqual({ externalSenderLabel: true, externalRecipientWarning: false });
+    expect(snapshotHostFeatures()).toEqual({ externalSenderLabel: true, externalRecipientWarning: false, noThirdPartyTraffic: false });
     setExternalMail({ recipientWarning: true });
-    expect(snapshotHostFeatures()).toEqual({ externalSenderLabel: false, externalRecipientWarning: true });
+    expect(snapshotHostFeatures()).toEqual({ externalSenderLabel: false, externalRecipientWarning: true, noThirdPartyTraffic: false });
+  });
+
+  // A link check switches Google Safe Browsing off in the mode instead of
+  // taking the refused requests for a service that is down.
+  it('says when third-party traffic is off, and while that is not known yet', () => {
+    setNoThirdPartyTraffic(true);
+    expect(snapshotHostFeatures().noThirdPartyTraffic).toBe(true);
+    setNoThirdPartyTraffic('unknown');
+    expect(snapshotHostFeatures().noThirdPartyTraffic).toBe(true);
+    setNoThirdPartyTraffic(false);
+    expect(snapshotHostFeatures().noThirdPartyTraffic).toBe(false);
   });
 });
 
@@ -69,18 +81,22 @@ describe('host bridge', () => {
     const plugin = { id: 'p', name: 'P', version: '1.0.0', permissions: [], settings: {}, settingsSchema: {} } as never;
     const instance = createBackgroundInstance({ plugin, tier: 'privileged', code: '', locale: 'en' });
     const pending = (instance as unknown as { pendingInit: { hostFeatures?: unknown } | null }).pendingInit;
-    expect(pending?.hostFeatures).toEqual({ externalSenderLabel: true, externalRecipientWarning: false });
+    expect(pending?.hostFeatures).toEqual({ externalSenderLabel: true, externalRecipientWarning: false, noThirdPartyTraffic: false });
 
     // Before init has gone out a change lands in the payload ...
     setExternalMail({});
-    expect(pending?.hostFeatures).toEqual({ externalSenderLabel: false, externalRecipientWarning: false });
+    expect(pending?.hostFeatures).toEqual({ externalSenderLabel: false, externalRecipientWarning: false, noThirdPartyTraffic: false });
 
     // ... after it, as a host-change message.
     const sent: unknown[] = [];
     (instance as unknown as { pendingInit: unknown }).pendingInit = null;
     (instance as unknown as { send: (m: unknown) => void }).send = (m) => sent.push(m);
     setExternalMail({ recipientWarning: true });
-    expect(sent).toEqual([{ type: 'host-change', features: { externalSenderLabel: false, externalRecipientWarning: true } }]);
+    expect(sent).toEqual([{ type: 'host-change', features: { externalSenderLabel: false, externalRecipientWarning: true, noThirdPartyTraffic: false } }]);
+    // The admin turns third-party traffic off: running plugins hear it.
+    setNoThirdPartyTraffic(true);
+    expect(sent[1]).toEqual({ type: 'host-change', features: { externalSenderLabel: false, externalRecipientWarning: true, noThirdPartyTraffic: true } });
+    setNoThirdPartyTraffic(false);
     instance.destroy();
   }, 30_000);
 });
@@ -140,9 +156,10 @@ describe('api.host in the sandbox runtime', () => {
     const kept = api.host.features;
     const changes: unknown[] = [];
     api.host.onFeaturesChange((f) => changes.push({ ...(f as object) }));
-    post(hostWindow, HOST_ORIGIN, { type: 'host-change', features: { externalSenderLabel: true, externalRecipientWarning: false } });
+    post(hostWindow, HOST_ORIGIN, { type: 'host-change', features: { externalSenderLabel: true, externalRecipientWarning: false, noThirdPartyTraffic: true } });
     expect(kept.externalRecipientWarning).toBe(false);
     expect(kept.externalSenderLabel).toBe(true);
-    expect(changes).toEqual([{ externalSenderLabel: true, externalRecipientWarning: false }]);
+    expect((kept as { noThirdPartyTraffic?: boolean }).noThirdPartyTraffic).toBe(true);
+    expect(changes).toEqual([{ externalSenderLabel: true, externalRecipientWarning: false, noThirdPartyTraffic: true }]);
   }, 30_000);
 });
diff --git a/lib/admin/reachable-hosts.ts b/lib/admin/reachable-hosts.ts
index 5782d6211..f801f0c1c 100644
--- a/lib/admin/reachable-hosts.ts
+++ b/lib/admin/reachable-hosts.ts
@@ -44,6 +44,11 @@ export interface ReachableInput {
   env: Record<string, string | undefined>;
   /** The relay the browser bundle was built with (NEXT_PUBLIC_PUSH_RELAY_URL inlined at build time). */
   buildRelayUrl?: string;
+  /**
+   * Plugins that run in the mode and the servers the admin entered on their
+   * admin page (credentials with an originKey; lib/outgoing-hosts.ts).
+   */
+  plugins?: { name: string; origins: string[] }[];
 }
 
 const BRANDING_KEYS = [
@@ -51,7 +56,7 @@ const BRANDING_KEYS = [
   'appLogoLightUrl', 'appLogoDarkUrl', 'loginLogoLightUrl', 'loginLogoDarkUrl',
 ] as const;
 
-export function listReachableHosts({ get, policy, env, buildRelayUrl = DEFAULT_RELAY_BASE_URL }: ReachableInput): ReachableHost[] {
+export function listReachableHosts({ get, policy, env, buildRelayUrl = DEFAULT_RELAY_BASE_URL, plugins = [] }: ReachableInput): ReachableHost[] {
   const out: ReachableHost[] = [];
   const seen = new Set<string>();
   const add = (kind: string, url: unknown, setIn: string, side: ReachableHost['side'], note?: string) => {
@@ -92,6 +97,11 @@ export function listReachableHosts({ get, policy, env, buildRelayUrl = DEFAULT_R
   // Company calendars of Everyone and of every scope: this server fetches
   // them (app/api/fetch-ical by feed id), whatever the switch says.
   for (const feed of allFeeds(policy)) add('Company calendar', feed.url, `Organisation > Calendars (${feed.name})`, 'server');
+  // A plugin's server the admin entered (a company link check): this server
+  // proxies its requests (app/api/plugin-proxy).
+  for (const plugin of plugins) {
+    for (const origin of plugin.origins) add(`Plugin ${plugin.name}`, origin, "The plugin's admin page", 'server');
+  }
   for (const app of policy.defaultSidebarApps ?? []) add('Sidebar app', app?.url, `User policy > Sidebar apps (${app?.name ?? ''})`, 'browser');
   add('Document editor (WOPI)', get('wopiClientUrl'), 'WOPI_CLIENT_URL', 'both');
   add('Translation (LibreTranslate)', env.LIBRETRANSLATE_URL, 'LIBRETRANSLATE_URL', 'server');
diff --git a/lib/outgoing-hosts.ts b/lib/outgoing-hosts.ts
index 514e203c4..c58c8608b 100644
--- a/lib/outgoing-hosts.ts
+++ b/lib/outgoing-hosts.ts
@@ -80,10 +80,43 @@ export function avatarUrlAllowed(url: string | null | undefined, origin?: string
   }
 }
 
+/** The parts of a manifest credential (lib/plugin-secrets/credentials.ts) the mode looks at. */
+export interface ModeCredential {
+  scope?: string;
+  origin?: string;
+  originKey?: string;
+}
+
 export interface NetworkDeclaringPlugin {
   permissions?: readonly string[];
   httpOrigins?: readonly string[];
   frameOrigins?: readonly string[];
+  credentials?: Readonly<Record<string, ModeCredential>>;
+}
+
+/**
+ * A proxied credential stays usable in the no-third-party mode when the
+ * admin entered its server on the plugin's admin page (`originKey`): a host
+ * the deployment configured itself, like the JMAP server. A server fixed in
+ * the manifest (Google Safe Browsing) and the accounts users connect are
+ * outside hosts and stay off.
+ */
+export function credentialAllowedInMode(spec: ModeCredential | undefined): boolean {
+  return !!spec && spec.scope === 'admin' && typeof spec.originKey === 'string' && !spec.origin;
+}
+
+/**
+ * A plugin whose only network access is the credential proxy with admin
+ * credentials, at least one of them on a server the admin entered. It runs
+ * in the mode; the proxy refuses its other credentials there.
+ */
+export function pluginReachesOnlyAdminHosts(plugin: NetworkDeclaringPlugin): boolean {
+  const permissions = plugin.permissions ?? [];
+  if (permissions.includes('http:fetch') || (plugin.httpOrigins?.length ?? 0) > 0 || (plugin.frameOrigins?.length ?? 0) > 0) return false;
+  const specs = Object.values(plugin.credentials ?? {});
+  return specs.length > 0
+    && specs.every((spec) => spec?.scope === 'admin')
+    && specs.some(credentialAllowedInMode);
 }
 
 /**
@@ -102,7 +135,12 @@ export function pluginDeclaresNetwork(plugin: NetworkDeclaringPlugin): boolean {
 /** Error code a refused plugin carries (shown translated in Settings > Plugins). */
 export const PLUGIN_REFUSED_ERROR = 'third-party-off';
 
+/** Whether a plugin may run while the mode is on (see pluginReachesOnlyAdminHosts). */
+export function pluginAllowedInMode(plugin: NetworkDeclaringPlugin): boolean {
+  return !pluginDeclaresNetwork(plugin) || pluginReachesOnlyAdminHosts(plugin);
+}
+
 /** Whether a plugin may run in this browser. */
 export function pluginAllowed(plugin: NetworkDeclaringPlugin): boolean {
-  return !(noThirdPartyTraffic() && pluginDeclaresNetwork(plugin));
+  return !noThirdPartyTraffic() || pluginAllowedInMode(plugin);
 }
diff --git a/lib/plugin-sandbox/host-api.ts b/lib/plugin-sandbox/host-api.ts
index 1319cf2c6..893727ea1 100644
--- a/lib/plugin-sandbox/host-api.ts
+++ b/lib/plugin-sandbox/host-api.ts
@@ -67,7 +67,8 @@ import { requestPanel } from './panel-requests';
 import { requestPageNavigation } from './page-navigation';
 import { requestOpenEmail } from './open-email';
 import { doComposerAttach, doComposerGetBody, doComposerGetSelection, doComposerReplaceBody, doComposerReplaceSelection } from './host-api-composer';
-import { pluginAllowed, wkdAllowed } from '../outgoing-hosts';
+import { wkdAllowed } from '../outgoing-hosts';
+import { noThirdPartyTraffic } from '../third-party-mode';
 import { resolveExternalLink } from '../plugin-hook-result';
 
 /**
@@ -698,8 +699,9 @@ async function readCapped(res: Response, limit: number): Promise<ArrayBuffer> {
 
 async function doHttpFetch(plugin: InstalledPlugin, rawUrl: string, init?: PluginFetchInit) {
   // Such a plugin isn't started in the no-third-party mode; this is the
-  // second lock in case one runs anyway (#903).
-  if (!pluginAllowed(plugin)) throw new Error('Outside requests are off: this server does not contact outside services');
+  // second lock in case one runs anyway (#903). A plugin the mode lets run
+  // (admin-entered servers through the proxy) has no outside fetch either.
+  if (noThirdPartyTraffic()) throw new Error('Outside requests are off: this server does not contact outside services');
   if (typeof rawUrl !== 'string') throw new Error('url must be a string');
   let url: URL;
   try { url = new URL(rawUrl); } catch { throw new Error('url must be absolute https://'); }
diff --git a/lib/plugin-sandbox/host-features.ts b/lib/plugin-sandbox/host-features.ts
index 488a9b7a1..63edc8cb3 100644
--- a/lib/plugin-sandbox/host-features.ts
+++ b/lib/plugin-sandbox/host-features.ts
@@ -9,22 +9,24 @@
 // plugin id, one switch at a time.
 
 import { usePolicyStore } from '@/stores/policy-store';
+import { noThirdPartyTraffic, subscribeThirdPartyMode } from '@/lib/third-party-mode';
 import type { HostFeaturesView } from '../plugin-types';
 import type { OrganisationPolicy } from '@/lib/admin/organisation-policy';
 
 /** The external-mail-warning plugin, retired in favour of organisation.externalMail. */
 export const EXTERNAL_MAIL_WARNING_PLUGIN_ID = 'external-mail-warning';
 
-/** The flags for an externalMail policy section (missing = both off). */
-export function hostFeaturesFor(externalMail: OrganisationPolicy['externalMail'] | undefined): HostFeaturesView {
+/** The flags for an externalMail policy section (missing = both off) and the third-party mode. */
+export function hostFeaturesFor(externalMail: OrganisationPolicy['externalMail'] | undefined, thirdPartyOff = false): HostFeaturesView {
   return {
     externalSenderLabel: externalMail?.senderLabel === true,
     externalRecipientWarning: externalMail?.recipientWarning === true,
+    noThirdPartyTraffic: thirdPartyOff,
   };
 }
 
 export function snapshotHostFeatures(): HostFeaturesView {
-  return hostFeaturesFor(usePolicyStore.getState().getOrganisation().externalMail);
+  return hostFeaturesFor(usePolicyStore.getState().getOrganisation().externalMail, noThirdPartyTraffic());
 }
 
 /**
@@ -32,11 +34,11 @@ export function snapshotHostFeatures(): HostFeaturesView {
  * with the recipient warning, the banner and the new-mail toast (both about
  * incoming mail from outside) with the sender label.
  */
-const HOOK_FLAGS: Record<string, keyof HostFeaturesView> = {
+const HOOK_FLAGS: Record<string, 'externalSenderLabel' | 'externalRecipientWarning'> = {
   onBeforeEmailSend: 'externalRecipientWarning',
   onNewEmailReceived: 'externalSenderLabel',
 };
-const SLOT_FLAGS: Record<string, keyof HostFeaturesView> = {
+const SLOT_FLAGS: Record<string, 'externalSenderLabel' | 'externalRecipientWarning'> = {
   'email-banner': 'externalSenderLabel',
 };
 
@@ -62,11 +64,14 @@ export function watchHostFeatures(onChange: (features: HostFeaturesView) => void
   if (watching) return;
   watching = true;
   lastKey = JSON.stringify(snapshotHostFeatures());
-  usePolicyStore.subscribe(() => {
+  const check = () => {
     const features = snapshotHostFeatures();
     const key = JSON.stringify(features);
     if (key === lastKey) return;
     lastKey = key;
     onChange(features);
-  });
+  };
+  usePolicyStore.subscribe(check);
+  // The mode is known once the config has been read, and an admin may turn it on later.
+  subscribeThirdPartyMode(check);
 }
diff --git a/lib/plugin-sandbox/runtime.tsx b/lib/plugin-sandbox/runtime.tsx
index 95f3cca62..eba4da5a2 100644
--- a/lib/plugin-sandbox/runtime.tsx
+++ b/lib/plugin-sandbox/runtime.tsx
@@ -150,13 +150,16 @@ function applySettings(next: Record<string, unknown>): void {
 }
 // What api.host.features says: one object for the iframe's lifetime,
 // updated in place on 'host-change' like the settings.
-const hostFeaturesState: HostFeaturesView = { externalSenderLabel: false, externalRecipientWarning: false };
+// noThirdPartyTraffic starts on, as the host's own mode does until it knows.
+const hostFeaturesState: HostFeaturesView = { externalSenderLabel: false, externalRecipientWarning: false, noThirdPartyTraffic: true };
 const hostFeatureListeners = new Set<(features: HostFeaturesView) => void>();
 
 function applyHostFeatures(next: HostFeaturesView | undefined): void {
   if (!next) return;
   hostFeaturesState.externalSenderLabel = next.externalSenderLabel === true;
   hostFeaturesState.externalRecipientWarning = next.externalRecipientWarning === true;
+  // A host older than 1.20 doesn't send it, and never let such a plugin run in the mode.
+  hostFeaturesState.noThirdPartyTraffic = next.noThirdPartyTraffic === true;
   for (const listener of hostFeatureListeners) {
     try { listener(hostFeaturesState); } catch (err) { console.error('[plugin] host feature listener failed', err); }
   }
diff --git a/lib/plugin-secrets/proxy.ts b/lib/plugin-secrets/proxy.ts
index 766b49dd7..7130e0c0d 100644
--- a/lib/plugin-secrets/proxy.ts
+++ b/lib/plugin-secrets/proxy.ts
@@ -13,6 +13,7 @@ import { authHeaderFor, credentialOrigin, privateProxyOrigins, type CredentialIn
 import { getUserCredential, setUserCredentialSecret, userKey, type VaultUser } from './vault';
 import { declaredUserCredential } from './known-plugins';
 import { isStoredDataUnavailable } from '@/lib/stored-data-errors';
+import { credentialAllowedInMode } from '@/lib/outgoing-hosts';
 
 /** Largest request body the proxy forwards (one upload chunk). */
 export const MAX_PROXY_REQUEST_BYTES = 100 * 1024 * 1024;
@@ -119,6 +120,25 @@ export async function adminCredentialOrigins(pluginId: string): Promise<string[]
   return (await adminCredentials(pluginId)).flatMap(({ origin }) => (origin ? [origin] : []));
 }
 
+/**
+ * The servers the admin entered for a plugin's credentials (originKey), set
+ * or not yet set up with a secret: what stays reachable for it with
+ * third-party traffic off (Organisation > Security).
+ */
+export async function adminEnteredOrigins(pluginId: string): Promise<string[]> {
+  const plugin = await getPlugin(pluginId);
+  const specs = (plugin as { credentials?: Record<string, CredentialSpec> } | null)?.credentials;
+  if (!plugin || !plugin.enabled || !specs) return [];
+  const config = await getPluginConfig(pluginId);
+  const out = new Set<string>();
+  for (const spec of Object.values(specs)) {
+    if (spec.scope !== 'admin' || !credentialAllowedInMode(spec) || !spec.originKey) continue;
+    const origin = credentialOrigin(config[spec.originKey]);
+    if (origin) out.add(origin);
+  }
+  return [...out];
+}
+
 async function adminCredentials(pluginId: string): Promise<{ credentialId: string; origin: string | null }[]> {
   const plugin = await getPlugin(pluginId);
   const specs = (plugin as { credentials?: Record<string, CredentialSpec> } | null)?.credentials;
diff --git a/lib/plugin-types.ts b/lib/plugin-types.ts
index 0fcdd15a0..1e8527570 100644
--- a/lib/plugin-types.ts
+++ b/lib/plugin-types.ts
@@ -876,6 +876,14 @@ export interface HostFeaturesView {
   externalSenderLabel: boolean;
   /** The admin turned on the confirm before sending outside the organisation (organisation.externalMail.recipientWarning). */
   externalRecipientWarning: boolean;
+  /**
+   * Bulwark 1.20 and later: "no third-party traffic" is on (or not known
+   * yet). Outside services are off: the proxy refuses servers fixed in a
+   * manifest and only reaches those the admin entered on the plugin's admin
+   * page. A plugin switches such a service off instead of treating it as
+   * down.
+   */
+  noThirdPartyTraffic: boolean;
 }
 
 /** One setting `api.app.searchSettings` found, in the user's language. */

From 50bb4e4c37937e703d8cacd37e0286269105fa39 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 08:40:32 +0100
Subject: [PATCH 06/17] fix: keep secret plugin settings out of plugins when
 the user is also signed in as admin

---
 .../plugin-admin-config-secrets.test.ts       | 31 +++++++++++++++++++
 lib/plugin-sandbox/host-api.ts                |  8 ++++-
 2 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 lib/__tests__/plugin-admin-config-secrets.test.ts

diff --git a/lib/__tests__/plugin-admin-config-secrets.test.ts b/lib/__tests__/plugin-admin-config-secrets.test.ts
new file mode 100644
index 000000000..1592c86f2
--- /dev/null
+++ b/lib/__tests__/plugin-admin-config-secrets.test.ts
@@ -0,0 +1,31 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { dispatchApiCall } from '@/lib/plugin-sandbox/host-api';
+import type { InstalledPlugin } from '@/lib/plugin-types';
+
+// api.admin.getConfig asked the config route without ?public=1. The route
+// hands an admin session every field, secrets included, so a plugin running
+// for a user who was also signed in to the admin console got its own API
+// keys (the Safe Browsing key of the link check). Secrets are for the server
+// proxy only.
+
+const plugin = {
+  id: 'external-link-warning', name: 'Link check', version: '2.0.0', author: '', description: '', type: 'hook',
+  permissions: ['admin:config'], grantedPermissions: ['admin:config'], managed: true, entrypoint: 'index.js',
+  enabled: true, status: 'running', settings: {},
+} as unknown as InstalledPlugin;
+
+afterEach(() => vi.unstubAllGlobals());
+
+describe('api.admin config reads', () => {
+  it('ask for the fields without secrets', async () => {
+    const urls: string[] = [];
+    vi.stubGlobal('fetch', vi.fn(async (url: RequestInfo | URL) => {
+      urls.push(String(url));
+      return new Response(JSON.stringify({ trustedDomains: 'example.com' }), { headers: { 'content-type': 'application/json' } });
+    }));
+    expect(await dispatchApiCall(plugin, 'admin.getAllConfig', [])).toEqual({ trustedDomains: 'example.com' });
+    expect(await dispatchApiCall(plugin, 'admin.getConfig', ['trustedDomains'])).toBe('example.com');
+    expect(urls).toHaveLength(2);
+    for (const url of urls) expect(url).toMatch(/\/api\/admin\/plugins\/external-link-warning\/config\?public=1$/);
+  });
+});
diff --git a/lib/plugin-sandbox/host-api.ts b/lib/plugin-sandbox/host-api.ts
index 893727ea1..d00099d15 100644
--- a/lib/plugin-sandbox/host-api.ts
+++ b/lib/plugin-sandbox/host-api.ts
@@ -1894,8 +1894,14 @@ async function doSieveRegenerate(): Promise<void> {
 
 // ─── admin config (same as before) ────────────────────────────
 
+/**
+ * The plugin's admin settings without its secrets, also when this browser
+ * holds an admin session: the route hands an admin every field, and a
+ * plugin read the Safe Browsing key that way. Secrets go only to the server
+ * proxy (api.proxy), never into a plugin frame.
+ */
 async function adminGetAll(pluginId: string): Promise<Record<string, unknown>> {
-  const res = await apiFetch(`/api/admin/plugins/${encodeURIComponent(pluginId)}/config`);
+  const res = await apiFetch(`/api/admin/plugins/${encodeURIComponent(pluginId)}/config?public=1`);
   if (!res.ok) return {};
   return res.json();
 }

From 6e3d98ec0d0f33937d142a81e1f5692b626e0b9f Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 08:48:33 +0100
Subject: [PATCH 07/17] docs: list every place the link check hook covers in
 the plugin hook catalogue

---
 lib/plugin-hook-catalog.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/plugin-hook-catalog.ts b/lib/plugin-hook-catalog.ts
index a9dae89ef..0b4a7febd 100644
--- a/lib/plugin-hook-catalog.ts
+++ b/lib/plugin-hook-catalog.ts
@@ -57,7 +57,7 @@ export const HOOK_CATALOG = {
   onBeforeReply: H('mail-read', 'intercept', 'email:read', 'ReplyContext', 'when Reply is chosen, before the composer opens'),
   onBeforeReplyAll: H('mail-read', 'intercept', 'email:read', 'ReplyContext', 'when Reply all is chosen, before the composer opens'),
   onBeforeForward: H('mail-read', 'intercept', 'email:read', 'ReplyContext', 'when Forward is chosen, before the composer opens'),
-  onBeforeExternalLink: H('mail-read', 'intercept', 'ui:observe', 'ExternalLinkContext', 'when a link in a message is clicked; return false to stop it or { href } to change it'),
+  onBeforeExternalLink: H('mail-read', 'intercept', 'ui:observe', 'ExternalLinkContext', 'when a link is opened (mail, reader view, events, contacts, notifications, the unsubscribe link, links other plugins open); return false to stop it or { href } to change it'),
   onAvatarResolve: H('mail-read', 'transform', 'email:read', 'string | null (avatar URL), { email, name }', 'when a sender avatar is needed'),
 
   // ─── Mail: composing ───────────────────────────────────────

From 7e901cb96b9654b515d254ecf98da8abc0f723f9 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 08:57:20 +0100
Subject: [PATCH 08/17] test: cover the link check and the send checks plugins
 on the test servers

---
 integration/tests/22-ent-plugins.spec.ts | 542 +++++++++++++++++++++++
 1 file changed, 542 insertions(+)
 create mode 100644 integration/tests/22-ent-plugins.spec.ts

diff --git a/integration/tests/22-ent-plugins.spec.ts b/integration/tests/22-ent-plugins.spec.ts
new file mode 100644
index 000000000..8d597fac2
--- /dev/null
+++ b/integration/tests/22-ent-plugins.spec.ts
@@ -0,0 +1,542 @@
+import { test, expect, type Browser, type BrowserContext, type Page } from '@playwright/test';
+import { createServer, type Server } from 'node:http';
+import { existsSync, readFileSync } from 'node:fs';
+import {
+  ENT,
+  adminContext,
+  deliver,
+  getPolicy,
+  jmapAs,
+  putPolicy,
+  requireEntEnv,
+  shot,
+  userPage,
+} from './helpers/ent';
+
+/**
+ * Enterprise pack, package E (official plugins and the host API they need),
+ * through the real UI on a VM 106 test Stalwart with the ent-* accounts:
+ * - item 4: external-link-warning 2.0.0 asks a company link-check service
+ *   (a mock started by this spec) at click time: an "unsafe" verdict warns,
+ *   a "safe" link opens, the dialog names the real target domain, a service
+ *   that is down follows the admin's fail-open / fail-closed choice, and the
+ *   service stays reachable with "no third-party traffic" on;
+ * - item 5: send-checks 1.0.0 warns about an IBAN or a card number, blocks a
+ *   blocked rule, ignores internal recipients for an external-only rule
+ *   (with an organisation domain set in a group scope only), refuses a
+ *   disallowed attachment type, and runs on quick reply too;
+ * - both dialogs at 390 px, and the send-checks admin page.
+ *
+ * Both plugins are installed from the local builds of the plugins worktree
+ * (IT_PLUGINS_DIR) through the admin API and removed at the end. The server
+ * must run with PLUGIN_PROXY_PRIVATE_ORIGINS=http://127.0.0.1:3195 (the
+ * mock is plain HTTP on this PC) and NEXT_PUBLIC_APP_VERSION=1.20.0 (both
+ * plugins need 1.20.0). No request goes to Google: the lookup mode is
+ * "endpoint", the Safe Browsing key is a fake.
+ */
+
+test.describe.configure({ mode: 'serial' });
+test.setTimeout(240_000);
+
+const PLUGINS_DIR = process.env.IT_PLUGINS_DIR ?? 'C:/Users/info/worktrees/plugins-enterprise';
+const LINK_ZIP = `${PLUGINS_DIR}/external-link-warning/external-link-warning.zip`;
+const SEND_ZIP = `${PLUGINS_DIR}/send-checks/send-checks.zip`;
+const LINK = 'external-link-warning';
+const SEND = 'send-checks';
+const MOCK_PORT = 3195;
+const TOKEN = 'it-link-check-token';
+const RUN = Date.now().toString(36);
+const LINK_HOST = 'ent-link.example.org';
+
+let original: Record<string, unknown>;
+let mock: Server;
+const endpoint = { up: true, requests: [] as { url: string; host: string; auth: string }[] };
+
+// ─── Setup ───────────────────────────────────────────────────
+
+async function installPlugin(admin: BrowserContext, id: string, zip: string): Promise<void> {
+  await admin.request.delete('/api/admin/plugins', { data: { id } });
+  const installed = await admin.request.post('/api/admin/plugins', {
+    multipart: { file: { name: `${id}.zip`, mimeType: 'application/zip', buffer: readFileSync(zip) } },
+  });
+  expect(installed.ok(), await installed.text()).toBe(true);
+}
+
+async function setConfig(browser: Browser, id: string, values: Record<string, unknown>): Promise<void> {
+  const admin = await adminContext(browser);
+  for (const [key, value] of Object.entries(values)) {
+    const res = await admin.request.put(`/api/admin/plugins/${id}/config`, { data: { key, value } });
+    expect(res.ok(), `${id}.${key}: ${await res.text()}`).toBe(true);
+  }
+  await admin.close();
+}
+
+async function setPolicy(browser: Browser, patch: Record<string, unknown>): Promise<void> {
+  const admin = await adminContext(browser);
+  await putPolicy(admin, { ...original, ...patch });
+  await admin.close();
+}
+
+function startMock(): Promise<Server> {
+  return new Promise((resolve) => {
+    const server = createServer((req, res) => {
+      let body = '';
+      req.on('data', (chunk) => { body += chunk; });
+      req.on('end', () => {
+        if (!endpoint.up) {
+          res.writeHead(503, { 'content-type': 'application/json' });
+          res.end('{"error":"down"}');
+          return;
+        }
+        let parsed: { url?: string; host?: string } = {};
+        try { parsed = JSON.parse(body); } catch { /* bad request below */ }
+        endpoint.requests.push({ url: parsed.url ?? '', host: parsed.host ?? '', auth: String(req.headers.authorization ?? '') });
+        const unsafe = (parsed.url ?? '').includes('/unsafe');
+        res.writeHead(200, { 'content-type': 'application/json' });
+        res.end(JSON.stringify(unsafe
+          ? { verdict: 'unsafe', reason: 'Known phishing page', cacheSeconds: 0 }
+          : { verdict: 'safe', cacheSeconds: 0 }));
+      });
+    });
+    server.listen(MOCK_PORT, '127.0.0.1', () => resolve(server));
+  });
+}
+
+test.beforeAll(async ({ browser }) => {
+  test.setTimeout(300_000);
+  requireEntEnv();
+  test.skip(!existsSync(LINK_ZIP) || !existsSync(SEND_ZIP), `build the plugins first: ${LINK_ZIP}, ${SEND_ZIP}`);
+  mock = await startMock();
+  const admin = await adminContext(browser);
+  original = await getPolicy(admin);
+  await admin.request.get('/plugin-sandbox', { timeout: 120_000 });
+  await installPlugin(admin, LINK, LINK_ZIP);
+  await installPlugin(admin, SEND, SEND_ZIP);
+  const features = { ...(original.features as Record<string, unknown>), pluginsEnabled: true };
+  const forced = [...new Set([...((original.forceEnabledPlugins as string[] | undefined) ?? []), LINK, SEND])];
+  original = { ...original, features, forceEnabledPlugins: forced };
+  await putPolicy(admin, original);
+  await admin.close();
+  await setConfig(browser, LINK, {
+    trustedDomains: '',
+    lookup: 'endpoint',
+    endpointUrl: `http://127.0.0.1:${MOCK_PORT}/check`,
+    endpointToken: TOKEN,
+    // A fake: the lookup mode never asks Google.
+    safeBrowsingKey: 'it-fake-safe-browsing-key',
+    onFailure: 'open',
+    onUnsafe: 'warn',
+    skipTrusted: true,
+  });
+  await setConfig(browser, SEND, {
+    ibanAction: 'warn', ibanExternalOnly: false,
+    cardAction: 'warn', cardExternalOnly: false,
+    keywords: `TOPSECRET-${RUN}`, keywordAction: 'block', keywordExternalOnly: false,
+    patterns: '', patternAction: 'warn', patternExternalOnly: false,
+    blockedTypes: 'exe, bat, application/x-msdownload', allowedTypes: '', maxSizeMb: 0,
+    attachmentAction: 'block', attachmentExternalOnly: false,
+  });
+});
+
+test.afterAll(async ({ browser }) => {
+  test.setTimeout(120_000);
+  mock?.close();
+  // Our messages go, in every ent account the spec wrote to.
+  for (const account of [ENT.alice, ENT.bob, ENT.carol]) {
+    const client = await jmapAs(account);
+    const r = await client.request([['Email/query', { accountId: client.accountId, filter: { text: RUN }, limit: 100 }, '0']]);
+    const ids = r.methodResponses?.[0]?.[1]?.ids ?? [];
+    if (ids.length) await client.request([['Email/set', { accountId: client.accountId, destroy: ids }, '0']]).catch(() => {});
+  }
+  if (!original) return;
+  const admin = await adminContext(browser);
+  const forced = ((original.forceEnabledPlugins as string[] | undefined) ?? []).filter((id) => id !== LINK && id !== SEND);
+  await putPolicy(admin, { ...original, forceEnabledPlugins: forced });
+  await admin.request.patch('/api/admin/config', { data: { noThirdPartyTraffic: false } }).catch(() => {});
+  await admin.request.delete('/api/admin/plugins', { data: { id: LINK } });
+  await admin.request.delete('/api/admin/plugins', { data: { id: SEND } });
+  await admin.close();
+});
+
+// ─── Helpers ─────────────────────────────────────────────────
+
+async function messages(account: string, needle: string): Promise<{ id: string; subject: string }[]> {
+  const client = await jmapAs(account);
+  const r = await client.request([
+    ['Email/query', { accountId: client.accountId, filter: { text: needle }, limit: 50 }, '0'],
+    ['Email/get', { accountId: client.accountId, '#ids': { resultOf: '0', name: 'Email/query', path: '/ids' }, properties: ['id', 'subject'] }, '1'],
+  ]);
+  return r.methodResponses[1][1].list;
+}
+
+async function waitForMessage(account: string, subject: string, timeoutMs = 60_000): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (!(await messages(account, RUN)).some((m) => m.subject === subject)) {
+    if (Date.now() > deadline) throw new Error(`${account}: no "${subject}"`);
+    await new Promise((r) => setTimeout(r, 1000));
+  }
+}
+
+/** Nothing with `subject` arrived within a few seconds. */
+async function expectNotSent(account: string, subject: string): Promise<void> {
+  await new Promise((r) => setTimeout(r, 4000));
+  expect((await messages(account, RUN)).filter((m) => m.subject === subject)).toEqual([]);
+}
+
+/** Both plugins started: their background frames are there, and a moment for init. */
+async function pluginsReady(page: Page): Promise<void> {
+  await expect(page.locator('iframe[src*="/plugin-sandbox"]')).toHaveCount(2, { timeout: 60_000 });
+  await page.waitForTimeout(1500);
+}
+
+async function openMessage(page: Page, subject: string): Promise<void> {
+  const row = page.locator('[data-testid="email-list-item"], [data-thread-keys]', { hasText: subject }).first();
+  await expect(row).toBeVisible({ timeout: 60_000 });
+  await row.click();
+  await expect(page.getByRole('heading', { name: subject }).first()).toBeVisible({ timeout: 20_000 });
+}
+
+const linkDialog = (page: Page) => page.locator(`[data-plugin-dialog="${LINK}"]`);
+const sendDialog = (page: Page) => page.locator(`[data-plugin-dialog="${SEND}"]`);
+// The message body: the reader's iframe carries the mail in srcdoc (plugin frames load a URL).
+const body = (page: Page) => page.frameLocator('iframe[srcdoc]:visible').first();
+
+/** Answers every request to the test link host, so an opened tab lands somewhere. */
+async function routeLinks(context: BrowserContext): Promise<void> {
+  await context.route(`https://*.${LINK_HOST}/**`, (route) => route.fulfill({ status: 200, contentType: 'text/html', body: '<h1>Target</h1>' }));
+}
+
+/** A mail to ent-alice with the three links. */
+async function deliverLinks(subject: string): Promise<void> {
+  await deliver({
+    from: ENT.bob,
+    to: [ENT.alice],
+    subject,
+    text: 'Links',
+    html: [
+      `<p><a href="https://bad.${LINK_HOST}/unsafe/${RUN}">https://bank.example.com/login</a></p>`,
+      `<p><a href="https://good.${LINK_HOST}/safe/${RUN}">Safe page</a></p>`,
+    ].join(''),
+  });
+  await waitForMessage(ENT.alice, subject);
+}
+
+async function compose(page: Page, to: string[], subject: string, text: string): Promise<void> {
+  await page.keyboard.press('c');
+  const composer = page.locator('[data-testid="email-composer"]');
+  await composer.waitFor({ state: 'visible', timeout: 15_000 });
+  const input = page.locator('[data-testid="composer-to"] input').first();
+  for (const address of to) {
+    await input.click();
+    await input.fill(address);
+    await input.press('Enter');
+  }
+  await page.locator('[data-testid="composer-subject"]').first().fill(subject);
+  await composer.locator('[contenteditable="true"]').first().click();
+  await page.keyboard.type(text);
+}
+
+async function pressSend(page: Page): Promise<void> {
+  await page.locator('[data-testid="composer-subject"]').first().focus();
+  await page.keyboard.press('Control+Enter');
+}
+
+const IBAN = 'DE89 3704 0044 0532 0130 00';
+const CARD = '4242 4242 4242 4242';
+
+// ─── Item 4: link check ──────────────────────────────────────
+
+test('item 4: an unsafe verdict warns, with the real target domain and what the link text claims', async ({ browser }) => {
+  const subject = `Links unsafe ${RUN}`;
+  await deliverLinks(subject);
+  const alice = await userPage(browser, ENT.alice);
+  await routeLinks(alice.context());
+  await pluginsReady(alice);
+  await openMessage(alice, subject);
+  endpoint.requests = [];
+  await body(alice).getByRole('link', { name: 'https://bank.example.com/login' }).click();
+  const dialog = linkDialog(alice);
+  await expect(dialog).toBeVisible({ timeout: 20_000 });
+  await expect(dialog).toContainText('This link may be dangerous');
+  await expect(dialog).toContainText(`bad.${LINK_HOST}`);
+  await expect(dialog).toContainText('Known phishing page');
+  await expect(dialog).toContainText(`The link text says bank.example.com, but the link goes to bad.${LINK_HOST}.`);
+  // The service got the full URL, with the admin's token.
+  expect(endpoint.requests).toEqual([{ url: `https://bad.${LINK_HOST}/unsafe/${RUN}`, host: `bad.${LINK_HOST}`, auth: `Bearer ${TOKEN}` }]);
+  await shot(alice, 'e-link-unsafe');
+  await dialog.getByRole('button', { name: 'Go back' }).click();
+  await expect(dialog).toBeHidden();
+  expect(alice.context().pages()).toHaveLength(1);
+  await alice.context().close();
+});
+
+test('item 4: a safe link opens after the domain warning, and a middle-click goes through the check too', async ({ browser }) => {
+  const subject = `Links safe ${RUN}`;
+  await deliverLinks(subject);
+  const alice = await userPage(browser, ENT.alice);
+  await routeLinks(alice.context());
+  await pluginsReady(alice);
+  await openMessage(alice, subject);
+  await body(alice).getByRole('link', { name: 'Safe page' }).click();
+  const dialog = linkDialog(alice);
+  await expect(dialog).toContainText('Open external link?', { timeout: 20_000 });
+  await expect(dialog).toContainText(`good.${LINK_HOST}`);
+  await expect(dialog).toContainText('Checked: no known threats.');
+  const opened = alice.context().waitForEvent('page');
+  await dialog.getByRole('button', { name: 'Continue' }).click();
+  // "Always trust" comes next; this once only.
+  const trust = linkDialog(alice).getByRole('button', { name: 'Just this once' });
+  await trust.click({ timeout: 10_000 }).catch(() => {});
+  const tab = await opened;
+  expect(tab.url()).toBe(`https://good.${LINK_HOST}/safe/${RUN}`);
+  await tab.close();
+
+  // A middle-click used to open the link in a new tab with no check.
+  await body(alice).getByRole('link', { name: 'https://bank.example.com/login' }).click({ button: 'middle' });
+  await expect(linkDialog(alice)).toContainText('This link may be dangerous', { timeout: 20_000 });
+  await linkDialog(alice).getByRole('button', { name: 'Go back' }).click();
+  expect(alice.context().pages()).toHaveLength(1);
+  await alice.context().close();
+});
+
+test('item 4: with the service down, fail open lets the user go on and fail closed does not', async ({ browser }) => {
+  const subject = `Links down ${RUN}`;
+  await deliverLinks(subject);
+  endpoint.up = false;
+  try {
+    const alice = await userPage(browser, ENT.alice);
+    await routeLinks(alice.context());
+    await pluginsReady(alice);
+    await openMessage(alice, subject);
+    await body(alice).getByRole('link', { name: 'Safe page' }).click();
+    const dialog = linkDialog(alice);
+    await expect(dialog).toContainText("Couldn't check this link.", { timeout: 20_000 });
+    await expect(dialog).toContainText(`good.${LINK_HOST}`);
+    await expect(dialog.getByRole('button', { name: 'Continue' })).toBeEnabled();
+    await shot(alice, 'e-link-fail-open');
+    await dialog.getByRole('button', { name: 'Cancel' }).click();
+    await alice.context().close();
+
+    await setConfig(browser, LINK, { onFailure: 'closed' });
+    const again = await userPage(browser, ENT.alice);
+    await routeLinks(again.context());
+    await pluginsReady(again);
+    await openMessage(again, subject);
+    await body(again).getByRole('link', { name: 'Safe page' }).click();
+    const closed = linkDialog(again);
+    await expect(closed).toContainText("Link couldn't be checked", { timeout: 20_000 });
+    await expect(closed).toContainText(`good.${LINK_HOST}`);
+    await expect(closed.getByRole('button', { name: 'Continue' })).toHaveCount(0);
+    await shot(again, 'e-link-fail-closed');
+    await closed.getByRole('button', { name: 'Close' }).click();
+    expect(again.context().pages()).toHaveLength(1);
+    await again.context().close();
+  } finally {
+    endpoint.up = true;
+    await setConfig(browser, LINK, { onFailure: 'open' });
+  }
+});
+
+test('item 4: with no third-party traffic the company service still answers, and Security lists it', async ({ browser }) => {
+  const subject = `Links mode ${RUN}`;
+  await deliverLinks(subject);
+  const admin = await adminContext(browser);
+  const on = await admin.request.patch('/api/admin/config', { data: { noThirdPartyTraffic: true } });
+  expect(on.ok(), await on.text()).toBe(true);
+  try {
+    const page = await admin.newPage();
+    await page.goto('/admin/org-security');
+    const reachable = page.getByTestId('third-party-reachable');
+    await expect(reachable).toContainText(`127.0.0.1:${MOCK_PORT}`, { timeout: 20_000 });
+    await expect(reachable).toContainText('Plugin External Link Warning');
+    await expect(page.locator('[data-settings-section="third-party"]')).toContainText('safebrowsing.googleapis.com stays off');
+    await shot(page, 'e-link-admin-security');
+
+    const alice = await userPage(browser, ENT.alice);
+    await routeLinks(alice.context());
+    await pluginsReady(alice);
+    await openMessage(alice, subject);
+    endpoint.requests = [];
+    await body(alice).getByRole('link', { name: 'https://bank.example.com/login' }).click();
+    await expect(linkDialog(alice)).toContainText('This link may be dangerous', { timeout: 20_000 });
+    expect(endpoint.requests).toHaveLength(1);
+    await linkDialog(alice).getByRole('button', { name: 'Go back' }).click();
+    await alice.context().close();
+  } finally {
+    await admin.request.patch('/api/admin/config', { data: { noThirdPartyTraffic: false } });
+    await admin.close();
+  }
+});
+
+test('item 4: the link dialog fits at 390 px', async ({ browser }) => {
+  const subject = `Links phone ${RUN}`;
+  await deliverLinks(subject);
+  const alice = await userPage(browser, ENT.alice, true);
+  await routeLinks(alice.context());
+  await pluginsReady(alice);
+  await openMessage(alice, subject);
+  await body(alice).getByRole('link', { name: 'https://bank.example.com/login' }).click();
+  const dialog = linkDialog(alice);
+  await expect(dialog).toContainText('This link may be dangerous', { timeout: 20_000 });
+  const box = await dialog.boundingBox();
+  expect(box!.x).toBeGreaterThanOrEqual(0);
+  expect(box!.x + box!.width).toBeLessThanOrEqual(390);
+  expect(await alice.evaluate(() => document.documentElement.scrollWidth - window.innerWidth)).toBeLessThanOrEqual(0);
+  await shot(alice, 'e-link-phone');
+  await alice.keyboard.press('Escape');
+  await expect(dialog).toBeHidden();
+  await alice.context().close();
+});
+
+// ─── Item 5: send checks ─────────────────────────────────────
+
+test('item 5: an IBAN and a card number warn, masked; Go back keeps the mail, Send anyway sends it', async ({ browser }) => {
+  const subject = `Send IBAN ${RUN}`;
+  const alice = await userPage(browser, ENT.alice);
+  await pluginsReady(alice);
+  await compose(alice, [ENT.bob], subject, `Please pay to ${IBAN}, card ${CARD}.`);
+  await pressSend(alice);
+  const dialog = sendDialog(alice);
+  await expect(dialog).toContainText('Check before sending', { timeout: 20_000 });
+  await expect(dialog).toContainText('IBAN DE89');
+  await expect(dialog).toContainText('Card number ending 4242');
+  await expect(dialog).not.toContainText('0532 0130');
+  await expect(dialog).not.toContainText(CARD);
+  await shot(alice, 'e-send-warn');
+  await dialog.getByRole('button', { name: 'Go back' }).click();
+  await expect(alice.locator('[data-testid="email-composer"]')).toBeVisible();
+  await expectNotSent(ENT.bob, subject);
+
+  await pressSend(alice);
+  await expect(dialog).toContainText('Check before sending', { timeout: 20_000 });
+  await dialog.getByRole('button', { name: 'Send anyway' }).click();
+  await waitForMessage(ENT.bob, subject);
+  await alice.context().close();
+});
+
+test('item 5: a block rule stops the send', async ({ browser }) => {
+  const subject = `Send block ${RUN}`;
+  const alice = await userPage(browser, ENT.alice);
+  await pluginsReady(alice);
+  await compose(alice, [ENT.bob], subject, `This is TOPSECRET-${RUN} material.`);
+  await pressSend(alice);
+  const dialog = sendDialog(alice);
+  await expect(dialog).toContainText("This message can't be sent", { timeout: 20_000 });
+  await expect(dialog).toContainText(`TOPSECRET-${RUN}`);
+  await expect(dialog.getByRole('button', { name: 'Send anyway' })).toHaveCount(0);
+  await shot(alice, 'e-send-block');
+  await alice.keyboard.press('Escape');
+  await expect(alice.locator('[data-testid="email-composer"]')).toBeVisible();
+  await expectNotSent(ENT.bob, subject);
+  await alice.context().close();
+});
+
+test('item 5: an external-only rule ignores internal recipients, with the domain from a group scope for its members only', async ({ browser }) => {
+  await setConfig(browser, SEND, { ibanExternalOnly: true });
+  // partner.example.net is internal for ent-team (ent-alice) only.
+  await setPolicy(browser, {
+    scopes: [{ id: 'ent-e-partner', label: 'Partner', match: { groups: [ENT.team] }, policy: { organisation: { externalMail: { domains: ['partner.example.net'] } } } }],
+  });
+  try {
+    const internal = `Send internal ${RUN}`;
+    const alice = await userPage(browser, ENT.alice);
+    await pluginsReady(alice);
+    await compose(alice, [ENT.bob, 'someone@partner.example.net'], internal, `IBAN ${IBAN}`);
+    await pressSend(alice);
+    await waitForMessage(ENT.bob, internal);
+    await expect(sendDialog(alice)).toHaveCount(0);
+    await alice.context().close();
+
+    // ent-carol is in no group: partner.example.net is outside for her.
+    const outside = `Send outside ${RUN}`;
+    const carol = await userPage(browser, ENT.carol);
+    await pluginsReady(carol);
+    await compose(carol, [ENT.bob, 'someone@partner.example.net'], outside, `IBAN ${IBAN}`);
+    await pressSend(carol);
+    const dialog = sendDialog(carol);
+    await expect(dialog).toContainText('IBAN DE89', { timeout: 20_000 });
+    await expect(dialog).toContainText('goes outside your organisation');
+    await dialog.getByRole('button', { name: 'Go back' }).click();
+    await expectNotSent(ENT.bob, outside);
+    await carol.context().close();
+  } finally {
+    await setConfig(browser, SEND, { ibanExternalOnly: false });
+    await setPolicy(browser, { scopes: (original.scopes as unknown[] | undefined) ?? [] });
+  }
+});
+
+test('item 5: a program is refused as an attachment, also renamed to .pdf', async ({ browser }) => {
+  const alice = await userPage(browser, ENT.alice);
+  await pluginsReady(alice);
+  await compose(alice, [ENT.bob], `Send attachment ${RUN}`, 'See the file.');
+  const program = Buffer.concat([Buffer.from('MZ'), Buffer.alloc(200, 0x90)]);
+  const input = alice.locator('[data-testid="email-composer"] input[type="file"]').first();
+  await input.setInputFiles({ name: 'tool.exe', mimeType: 'application/octet-stream', buffer: program });
+  const dialog = sendDialog(alice);
+  await expect(dialog).toContainText("This file can't be attached", { timeout: 20_000 });
+  await expect(dialog).toContainText('tool.exe');
+  await dialog.getByRole('button', { name: 'OK' }).click();
+  await expect(dialog).toBeHidden();
+  await input.setInputFiles({ name: 'invoice.pdf', mimeType: 'application/pdf', buffer: program });
+  await expect(dialog).toContainText('invoice.pdf', { timeout: 20_000 });
+  await shot(alice, 'e-send-attachment');
+  await dialog.getByRole('button', { name: 'OK' }).click();
+  await expect(dialog).toBeHidden();
+  await expect(alice.locator('[data-testid="email-composer"]').getByText('invoice.pdf')).toHaveCount(0);
+  await expect(alice.locator('[data-testid="email-composer"]').getByText('tool.exe')).toHaveCount(0);
+  await alice.context().close();
+});
+
+test('item 5: a quick reply is checked too', async ({ browser }) => {
+  const subject = `Quick ${RUN}`;
+  await deliver({ from: ENT.bob, to: [ENT.alice], subject, text: 'Where do I pay?' });
+  await waitForMessage(ENT.alice, subject);
+  const alice = await userPage(browser, ENT.alice);
+  await pluginsReady(alice);
+  await openMessage(alice, subject);
+  const box = alice.getByPlaceholder('Write a quick reply...');
+  await box.fill(`To ${IBAN} please`);
+  await box.press('Control+Enter');
+  const dialog = sendDialog(alice);
+  await expect(dialog).toContainText('IBAN DE89', { timeout: 20_000 });
+  await dialog.getByRole('button', { name: 'Go back' }).click();
+  // The typed text stays, nothing went out.
+  await expect(box).toHaveValue(`To ${IBAN} please`);
+  await expectNotSent(ENT.bob, `Re: ${subject}`);
+  await alice.context().close();
+});
+
+test('item 5: the send dialog fits at 390 px', async ({ browser }) => {
+  const alice = await userPage(browser, ENT.alice, true);
+  await pluginsReady(alice);
+  await alice.getByRole('button', { name: /^(Compose|New message|Write)/ }).first().click().catch(() => alice.keyboard.press('c'));
+  const composer = alice.locator('[data-testid="email-composer"]');
+  await composer.waitFor({ state: 'visible', timeout: 15_000 });
+  const input = alice.locator('[data-testid="composer-to"] input').first();
+  await input.fill(ENT.bob);
+  await input.press('Enter');
+  await alice.locator('[data-testid="composer-subject"]').first().fill(`Send phone ${RUN}`);
+  await composer.locator('[contenteditable="true"]').first().click();
+  await alice.keyboard.type(`Card ${CARD}`);
+  await alice.getByTestId('composer-send').first().click();
+  const dialog = sendDialog(alice);
+  await expect(dialog).toContainText('Card number ending 4242', { timeout: 20_000 });
+  const box = await dialog.boundingBox();
+  expect(box!.x).toBeGreaterThanOrEqual(0);
+  expect(box!.x + box!.width).toBeLessThanOrEqual(390);
+  expect(await alice.evaluate(() => document.documentElement.scrollWidth - window.innerWidth)).toBeLessThanOrEqual(0);
+  await shot(alice, 'e-send-phone');
+  await dialog.getByRole('button', { name: 'Go back' }).click();
+  await alice.context().close();
+});
+
+test('item 5: the admin sets the rules on the plugin page', async ({ browser }) => {
+  const admin = await adminContext(browser);
+  const page = await admin.newPage();
+  await page.goto(`/admin/plugins/${SEND}`);
+  await expect(page.getByText('IBANs', { exact: true }).first()).toBeVisible({ timeout: 30_000 });
+  await expect(page.getByText('Payment card numbers', { exact: true }).first()).toBeVisible();
+  await expect(page.getByText('Blocked file types', { exact: true }).first()).toBeVisible();
+  await shot(page, 'e-send-admin');
+  await admin.close();
+});

From fbf85972c5ec53d6b764b9c7340e54617091dc2b Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 09:51:00 +0100
Subject: [PATCH 09/17] fix: check links in plain-text mail and the address the
 browser really opens

Plain-text bodies render in the page, not in the body iframe, so their
links opened without the link check. Plugins now get each link as the
browser parses it (new URL(href).href) and that same string opens, so a
link check can't judge one host while another opens. With no link check
listening, clicks and middle-clicks stay with the browser as before.
---
 .../__tests__/link-check-surfaces.test.tsx    | 44 ++++++++++
 .../thread-conversation-link-gate.test.tsx    | 33 +++++++-
 .../email/__tests__/viewer-link-gate.test.tsx | 84 +++++++++++++++++++
 components/email/email-viewer.tsx             | 11 ++-
 components/email/thread-conversation-view.tsx | 11 ++-
 lib/plugin-hook-result.ts                     | 58 ++++++++++---
 lib/plugin-hooks.ts                           |  5 ++
 lib/plugin-sandbox/host-api.ts                |  8 +-
 8 files changed, 228 insertions(+), 26 deletions(-)
 create mode 100644 components/email/__tests__/viewer-link-gate.test.tsx

diff --git a/components/__tests__/link-check-surfaces.test.tsx b/components/__tests__/link-check-surfaces.test.tsx
index 39f615287..0fafcac70 100644
--- a/components/__tests__/link-check-surfaces.test.tsx
+++ b/components/__tests__/link-check-surfaces.test.tsx
@@ -128,3 +128,47 @@ describe("other plugins' ui.openExternalUrl", () => {
     expect(open).toHaveBeenCalledWith('https://evil.example/p', '_blank', 'noopener,noreferrer');
   });
 });
+
+// What is checked is what opens: the host hands plugins the address as the
+// browser parses it, and opens exactly that.
+describe('one address end to end', () => {
+  it('checks and opens the address the browser really goes to', async () => {
+    const { seen, open } = watchLinks();
+    render(<div onClick={gateLinkClick}><a href={'http://evil.example\\@good.example/login'}>login</a></div>);
+    fireEvent.click(screen.getByRole('link'));
+    await waitFor(() => expect(open).toHaveBeenCalledWith('http://evil.example/@good.example/login', '_blank', 'noopener,noreferrer'));
+    expect(seen[0].href).toBe('http://evil.example/@good.example/login');
+  });
+
+  it('hands over international names in their punycode form', async () => {
+    const { seen } = watchLinks(() => false);
+    expect(await resolveExternalLink({ href: 'https://b\u00fccher.example/a' })).toBeNull();
+    expect(seen[0].href).toBe('https://xn--bcher-kva.example/a');
+  });
+});
+
+// Without a link check listening, clicks stay exactly as they were.
+describe('no link check listening', () => {
+  it('leaves clicks and middle-clicks to the browser', () => {
+    const open = vi.spyOn(window, 'open').mockReturnValue(null);
+    render(<div onClick={gateLinkClick} onAuxClick={gateLinkClick}><a href="https://a.example/">a</a></div>);
+    expect(fireEvent.click(screen.getByRole('link'))).toBe(true);
+    expect(fireEvent(screen.getByRole('link'), new MouseEvent('auxclick', { bubbles: true, cancelable: true, button: 1 }))).toBe(true);
+    expect(open).not.toHaveBeenCalled();
+  });
+
+  it('opens at once, inside the click, from code that opens a link itself', () => {
+    const open = vi.spyOn(window, 'open').mockReturnValue(null);
+    void openExternalLink({ href: 'https://a.example/' });
+    expect(open).toHaveBeenCalledWith('https://a.example/', '_blank', 'noopener,noreferrer');
+  });
+
+  it("opens a plugin's own link at once when only that plugin listens", async () => {
+    const { dispatchApiCall } = await import('@/lib/plugin-sandbox/host-api');
+    uiHooks.onBeforeExternalLink.register('link-check', () => false);
+    const open = vi.spyOn(window, 'open').mockReturnValue(null);
+    const call = dispatchApiCall({ id: 'link-check', name: 'x', version: '1', author: '', description: '', type: 'hook', permissions: [], entrypoint: 'index.js', enabled: true, status: 'running', settings: {} } as never, 'ui.openExternalUrl', ['https://a.example/']);
+    expect(open).toHaveBeenCalledTimes(1);
+    await call;
+  });
+});
diff --git a/components/email/__tests__/thread-conversation-link-gate.test.tsx b/components/email/__tests__/thread-conversation-link-gate.test.tsx
index 870003337..4499d6dbf 100644
--- a/components/email/__tests__/thread-conversation-link-gate.test.tsx
+++ b/components/email/__tests__/thread-conversation-link-gate.test.tsx
@@ -26,8 +26,14 @@ const { clearAllHooks, uiHooks } = await import('@/lib/plugin-hooks');
 
 const BODY = '<p>hi</p><a id="web" href="https://site.example/a">web</a><a id="app" href="/settings/accounts">app</a>';
 
-function renderBody() {
-  const email = {
+function renderBody(plain?: string) {
+  const email = plain ? {
+    id: 'e1', threadId: 't1', mailboxIds: { a: true }, keywords: { $seen: true },
+    from: [{ name: 'Sender', email: 'sender@t.example' }], to: [{ email: 'me@example.org' }],
+    subject: 's', receivedAt: '2026-09-26T10:00:00Z', size: 1, preview: 'hi', hasAttachment: false,
+    htmlBody: [{ partId: '1', type: 'text/plain' }], textBody: [{ partId: '1', type: 'text/plain' }], attachments: [],
+    bodyValues: { '1': { value: plain } },
+  } : {
     id: 'e1', threadId: 't1', mailboxIds: { a: true }, keywords: { $seen: true },
     from: [{ name: 'Sender', email: 'sender@t.example' }], to: [{ email: 'me@example.org' }],
     subject: 's', receivedAt: '2026-09-26T10:00:00Z', size: 1, preview: 'hi', hasAttachment: false,
@@ -41,6 +47,7 @@ function renderBody() {
       onBack={() => {}}
     />,
   );
+  if (plain) return container as unknown as Document;
   const iframe = container.querySelector('iframe')!;
   // jsdom does not load srcdoc: put the sanitised body in by hand.
   const srcdoc = iframe.getAttribute('srcdoc') ?? '';
@@ -100,3 +107,25 @@ describe('conversation view link gate', () => {
     expect(open).not.toHaveBeenCalled();
   }, 30_000);
 });
+
+describe('conversation view link gate, more paths', () => {
+  it('sends a link in a plain-text message through the check', async () => {
+    const open = vi.spyOn(window, 'open').mockReturnValue(null);
+    const hook = vi.fn(() => false);
+    uiHooks.onBeforeExternalLink.register('p1', hook);
+    const root = renderBody('Pay at https://pay.example/x now');
+    const link = root.querySelector('[data-plugin-source="email-body"] a')!;
+    expect(click(link)).toBe(true);
+    await waitFor(() => expect(hook).toHaveBeenCalledWith(expect.objectContaining({ href: 'https://pay.example/x', emailId: 'e1' })));
+    expect(open).not.toHaveBeenCalled();
+  }, 30_000);
+
+  it('leaves a middle-click to the browser while no link check listens', async () => {
+    const open = vi.spyOn(window, 'open').mockReturnValue(null);
+    const doc = renderBody();
+    const ev = new MouseEvent('auxclick', { bubbles: true, cancelable: true, button: 1 });
+    doc.getElementById('web')!.dispatchEvent(ev);
+    expect(ev.defaultPrevented).toBe(false);
+    expect(open).not.toHaveBeenCalled();
+  }, 30_000);
+});
diff --git a/components/email/__tests__/viewer-link-gate.test.tsx b/components/email/__tests__/viewer-link-gate.test.tsx
new file mode 100644
index 000000000..6e720f721
--- /dev/null
+++ b/components/email/__tests__/viewer-link-gate.test.tsx
@@ -0,0 +1,84 @@
+// The reader's link check: links in a plain-text mail render in the page,
+// not in the body iframe, and opened without the check; a middle-click in
+// the iframe opened the link in a new tab without it too. With no link
+// check listening, a click stays the browser's.
+import { render, act, fireEvent, waitFor } from '@testing-library/react';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import type { Email, Mailbox } from '@/lib/jmap/types';
+import { clearAllHooks, pluginErrorTracker, uiHooks } from '@/lib/plugin-hooks';
+import type { ExternalLinkContext } from '@/lib/plugin-types';
+
+vi.mock('@/hooks/use-media-query', () => ({
+  useDeviceDetection: () => ({ isMobile: false, isTablet: false, isDesktop: true }),
+  useMediaQuery: () => false,
+}));
+vi.mock('@/components/tour/tour-provider', () => ({
+  useTour: () => ({ activeTour: null, startTour: vi.fn(), endTour: vi.fn(), registerStep: vi.fn() }),
+}));
+vi.mock('@/components/plugins/plugin-slot', () => ({ PluginSlot: () => null }));
+vi.mock('@/hooks/use-plugin-slot-offers', () => ({ usePluginSlotOffers: () => [] }));
+
+class NoopResizeObserver {
+  observe() {}
+  unobserve() {}
+  disconnect() {}
+}
+vi.stubGlobal('ResizeObserver', NoopResizeObserver);
+
+const { EmailViewer } = await import('../email-viewer');
+
+const mailboxes = [
+  { id: 'inbox', name: 'Inbox', role: 'inbox', parentId: null, myRights: { mayAddItems: true } },
+] as unknown as Mailbox[];
+
+const message = (type: 'text/plain' | 'text/html', value: string) => ({
+  id: 'm1', blobId: 'b1', threadId: 't1', mailboxIds: { inbox: true }, keywords: { $seen: true },
+  from: [{ name: 'Sender', email: 'sender@other.test' }], to: [{ email: 'me@example.org' }],
+  subject: 'Hello', receivedAt: '2026-01-01T00:00:00Z', preview: 'Hello', hasAttachment: false, size: 100,
+  textBody: [{ partId: '1', type }], htmlBody: [{ partId: '1', type }], attachments: [],
+  bodyValues: { '1': { value } },
+}) as unknown as Email;
+
+async function open(email: Email) {
+  const view = render(<EmailViewer email={email} isLoading={false} mailboxes={mailboxes} selectedMailbox="inbox" currentMailboxRole="inbox" />);
+  await act(async () => { await new Promise((r) => setTimeout(r, 10)); });
+  return view;
+}
+
+function watch(answer: unknown) {
+  const seen: ExternalLinkContext[] = [];
+  uiHooks.onBeforeExternalLink.register('link-check', (ctx: ExternalLinkContext) => { seen.push(ctx); return answer; });
+  return seen;
+}
+
+let open$: ReturnType<typeof vi.spyOn>;
+beforeEach(() => {
+  clearAllHooks();
+  pluginErrorTracker.resetAll();
+  open$ = vi.spyOn(window, 'open').mockReturnValue(null);
+});
+afterEach(() => vi.restoreAllMocks());
+
+describe('plain-text mail', () => {
+  it('sends a link click through the link check, with the message and the address the browser opens', async () => {
+    const seen = watch(false);
+    const { container } = await open(message('text/plain', 'Log in at http://evil.example\\@good.example/login today'));
+    const link = container.querySelector('[data-plugin-source="email-body"] a') as HTMLAnchorElement;
+    expect(link).not.toBeNull();
+    expect(fireEvent.click(link)).toBe(false);
+    await waitFor(() => expect(seen).toHaveLength(1));
+    expect(seen[0]).toMatchObject({ href: 'http://evil.example/@good.example/login', emailId: 'm1' });
+    expect(open$).not.toHaveBeenCalled();
+  });
+
+  it('leaves the click to the browser while no link check listens', async () => {
+    const { container } = await open(message('text/plain', 'See https://site.example/a'));
+    const link = container.querySelector('[data-plugin-source="email-body"] a') as HTMLAnchorElement;
+    expect(fireEvent.click(link)).toBe(true);
+    expect(open$).not.toHaveBeenCalled();
+  });
+});
+
+// The body iframe's middle-click (jsdom doesn't load srcdoc, so the viewer
+// never wires it here) is covered by the conversation view's test of the
+// same handler and by integration/tests/22-ent-plugins.spec.ts.
diff --git a/components/email/email-viewer.tsx b/components/email/email-viewer.tsx
index 16cd5dfc1..9ce0a7f27 100644
--- a/components/email/email-viewer.tsx
+++ b/components/email/email-viewer.tsx
@@ -169,7 +169,7 @@ import { usePluginSlotOffers } from "@/hooks/use-plugin-slot-offers";
 import { ResizeHandle } from "@/components/layout/resize-handle";
 import { emailHooks, renderHooks } from "@/lib/plugin-hooks";
 import { emitThreadExpand } from "@/lib/plugin-thread-expand";
-import { linkText, resolveExternalLink } from "@/lib/plugin-hook-result";
+import { gateLinkClick, linkCheckActive, linkText, resolveExternalLink } from "@/lib/plugin-hook-result";
 import type { AttachmentInfo, AttachmentPreview } from "@/lib/plugin-types";
 import { useAttachmentDrag, isDragOutSupported, type AttachmentDragSource } from "@/hooks/use-attachment-drag";
 import type { IJMAPClient } from "@/lib/jmap/client-interface";
@@ -3522,8 +3522,9 @@ export function EmailViewer({
         // the email body before navigation happens. Bound on the iframe doc so
         // it survives later DOM mutations.
         const onLinkClick = async (ev: MouseEvent) => {
-          // A middle-click opens a link too; other buttons are left alone.
-          if (ev.type === 'auxclick' && ev.button !== 1) return;
+          // A middle-click opens a link too, through the link check while one
+          // listens; other buttons are left alone.
+          if (ev.type === 'auxclick' && (ev.button !== 1 || !linkCheckActive())) return;
           const targetEl = (ev.target as Element | null)?.closest?.('a[href], area[href]') as HTMLAnchorElement | HTMLAreaElement | null;
           if (!targetEl) return;
           const href = targetEl.getAttribute('href') || '';
@@ -5802,6 +5803,10 @@ export function EmailViewer({
                 data-plugin-source="email-body"
                 data-email-id={email?.id}
                 onContextMenu={(e) => selectionMenu.onElementContextMenu(e, email?.id)}
+                // A plain-text body renders in the page, not the iframe: its
+                // links go through the link check here.
+                onClick={(e) => gateLinkClick(e, { emailId: email?.id })}
+                onAuxClick={(e) => gateLinkClick(e, { emailId: email?.id })}
                 dangerouslySetInnerHTML={plainBodyHtml}
                 style={{
                   ...(plainTextFont === 'mono' && { fontFamily: 'ui-monospace, "SF Mono", Consolas, monospace' }),
diff --git a/components/email/thread-conversation-view.tsx b/components/email/thread-conversation-view.tsx
index 84efe4078..528f9a67e 100644
--- a/components/email/thread-conversation-view.tsx
+++ b/components/email/thread-conversation-view.tsx
@@ -4,7 +4,7 @@ import React, { useState, useEffect, useLayoutEffect, useMemo, useRef, useCallba
 import DOMPurify from "dompurify";
 import { Email, ThreadGroup } from "@/lib/jmap/types";
 import { EMAIL_SANITIZE_CONFIG, TRANSPARENT_BLOCKED_PIXEL, blockExternalResourcesOnNode, collapseBlockedImageContainers, emailIframeCsp, isOpenableLinkHref, plainTextToSafeHtml, restrictDataUriResourcesOnNode, sanitizeEmailBodyForIframe, sanitizePlainTextRenderedHtml } from "@/lib/email-sanitization";
-import { linkText, resolveExternalLink } from "@/lib/plugin-hook-result";
+import { gateLinkClick, linkCheckActive, linkText, resolveExternalLink } from "@/lib/plugin-hook-result";
 import { stripBidiControls } from "@/lib/bidi";
 import { requestInternalMailto } from "@/lib/protocol-handlers/mailto";
 import { emailDisplayDate } from "@/lib/email-date";
@@ -880,8 +880,9 @@ export function ConversationEmailBody({
       // origin (a relative path, data:) is opened. mailto: is written here
       // when the mail page takes it; the blob: URLs of cid: parts are inert.
       const onLinkClick = (ev: MouseEvent) => {
-        // A middle-click opens a link too; other buttons are left alone.
-        if (ev.type === 'auxclick' && ev.button !== 1) return;
+        // A middle-click opens a link too, through the link check while one
+        // listens; other buttons are left alone.
+        if (ev.type === 'auxclick' && (ev.button !== 1 || !linkCheckActive())) return;
         const link = (ev.target as Element | null)?.closest?.('a[href], area[href]');
         if (!link) return;
         const href = link.getAttribute('href') || '';
@@ -1000,6 +1001,10 @@ export function ConversationEmailBody({
             data-plugin-source="email-body"
             data-email-id={email.id}
             onContextMenu={(e) => selectionMenu.onElementContextMenu(e, email.id)}
+            // A plain-text body renders in the page, not the iframe: its
+            // links go through the link check here.
+            onClick={(e) => gateLinkClick(e, { emailId: email.id })}
+            onAuxClick={(e) => gateLinkClick(e, { emailId: email.id })}
             dangerouslySetInnerHTML={plainBodyHtml}
           />
         )}
diff --git a/lib/plugin-hook-result.ts b/lib/plugin-hook-result.ts
index 3540a920f..e61101ff1 100644
--- a/lib/plugin-hook-result.ts
+++ b/lib/plugin-hook-result.ts
@@ -45,18 +45,42 @@ export function acceptLinkRewrite<T extends { href: string }>(result: unknown, c
 }
 
 /**
- * Ask onBeforeExternalLink about a link the user opens. Resolves to the
- * address to open: the original, the one a plugin rewrote it to, or null
- * when a plugin stopped it. `skipPluginId`: a plugin opening a link itself
- * (ui.openExternalUrl) isn't asked about it again, so a link check can open
- * the link after its own dialog.
+ * A web address the way the browser will open it (`new URL(href).href`):
+ * a link check has to judge the host the browser really goes to, and
+ * `http://evil.example\@good.example/` goes to evil.example. Other schemes
+ * come back unchanged.
+ */
+export function normaliseLinkHref(href: string): string {
+  const trimmed = href.trim();
+  if (!/^https?:/i.test(trimmed)) return trimmed;
+  try {
+    return new URL(trimmed).href;
+  } catch {
+    return trimmed;
+  }
+}
+
+/** Whether a link check would be asked about a link (some plugin listens, other than `skipPluginId`). */
+export function linkCheckActive(skipPluginId?: string): boolean {
+  return uiHooks.onBeforeExternalLink.hasHandlersBesides(skipPluginId);
+}
+
+/**
+ * Ask onBeforeExternalLink about a link the user opens. Plugins get the
+ * address as the browser parses it (normaliseLinkHref), and that same
+ * string is what opens. Resolves to the address to open: that one, the one
+ * a plugin rewrote it to, or null when a plugin stopped it.
+ * `skipPluginId`: a plugin opening a link itself (ui.openExternalUrl) isn't
+ * asked about it again, so a link check can open the link after its own
+ * dialog.
  */
 export async function resolveExternalLink(ctx: ExternalLinkContext, opts: { skipPluginId?: string } = {}): Promise<string | null> {
-  const outcome = uiHooks.onBeforeExternalLink.size > 0
-    ? await uiHooks.onBeforeExternalLink.interceptWithValue(ctx, acceptLinkRewrite, { skipPluginId: opts.skipPluginId })
-    : { allowed: true as const, value: ctx };
+  const normalised = { ...ctx, href: normaliseLinkHref(ctx.href) };
+  const outcome = linkCheckActive(opts.skipPluginId)
+    ? await uiHooks.onBeforeExternalLink.interceptWithValue(normalised, acceptLinkRewrite, { skipPluginId: opts.skipPluginId })
+    : { allowed: true as const, value: normalised };
   if (!outcome.allowed || !isOpenableLinkHref(outcome.value.href)) return null;
-  return outcome.value.href;
+  return normaliseLinkHref(outcome.value.href);
 }
 
 /** Longest link text handed to plugins. */
@@ -72,9 +96,14 @@ export function linkText(link: Element): string | undefined {
 /**
  * Open an outside link the way every link in the app opens: through
  * onBeforeExternalLink, then in a new tab. Resolves true when it opened.
+ * With no link check listening it opens right away, inside the click.
  */
 export async function openExternalLink(ctx: ExternalLinkContext, opts: { skipPluginId?: string } = {}): Promise<boolean> {
   if (!isOpenableLinkHref(ctx.href)) return false;
+  if (!linkCheckActive(opts.skipPluginId)) {
+    window.open(normaliseLinkHref(ctx.href), '_blank', 'noopener,noreferrer');
+    return true;
+  }
   const target = await resolveExternalLink(ctx, opts);
   if (!target) return false;
   window.open(target, '_blank', 'noopener,noreferrer');
@@ -83,12 +112,15 @@ export async function openExternalLink(ctx: ExternalLinkContext, opts: { skipPlu
 
 /**
  * A click or middle-click on a web link inside `event.currentTarget`
- * (rendered text with links, an anchor of our own): the browser's own
- * navigation is stopped and the link goes through openExternalLink. Other
- * links (mailto:, tel:, in-app paths) and other buttons are left alone.
- * "Copy link address" and the browser's context menu stay out of reach.
+ * (rendered text with links, an anchor of our own): while a link check
+ * listens, the browser's own navigation is stopped and the link goes
+ * through openExternalLink. Without one the browser handles the click as it
+ * always did. Other links (mailto:, tel:, in-app paths) and other buttons
+ * are left alone. "Copy link address" and the browser's context menu stay
+ * out of reach.
  */
 export function gateLinkClick(event: { target: EventTarget | null; button: number; type: string; preventDefault(): void; stopPropagation(): void }, extra: Partial<ExternalLinkContext> = {}): void {
+  if (!linkCheckActive()) return;
   if (event.type === 'auxclick' ? event.button !== 1 : event.button !== 0) return;
   const link = (event.target as Element | null)?.closest?.('a[href]') as HTMLAnchorElement | null;
   if (!link) return;
diff --git a/lib/plugin-hooks.ts b/lib/plugin-hooks.ts
index 0c9059d5f..91b06a7ef 100644
--- a/lib/plugin-hooks.ts
+++ b/lib/plugin-hooks.ts
@@ -197,6 +197,11 @@ export class HookBus<T extends (...args: any[]) => any> {
     return this.handlers.length;
   }
 
+  /** Whether a plugin other than `pluginId` has a handler here. */
+  hasHandlersBesides(pluginId: string | undefined): boolean {
+    return this.handlers.some((h) => h.pluginId !== pluginId);
+  }
+
   /** Fire all handlers (observer pattern - no return values used) */
   async emit(...args: Parameters<T>): Promise<void> {
     for (const { pluginId, handler } of this.handlers) {
diff --git a/lib/plugin-sandbox/host-api.ts b/lib/plugin-sandbox/host-api.ts
index d00099d15..653005cd6 100644
--- a/lib/plugin-sandbox/host-api.ts
+++ b/lib/plugin-sandbox/host-api.ts
@@ -69,7 +69,7 @@ import { requestOpenEmail } from './open-email';
 import { doComposerAttach, doComposerGetBody, doComposerGetSelection, doComposerReplaceBody, doComposerReplaceSelection } from './host-api-composer';
 import { wkdAllowed } from '../outgoing-hosts';
 import { noThirdPartyTraffic } from '../third-party-mode';
-import { resolveExternalLink } from '../plugin-hook-result';
+import { openExternalLink } from '../plugin-hook-result';
 
 /**
  * Methods only callable from the privileged (same-origin) tier. These expose
@@ -2223,11 +2223,9 @@ export async function dispatchApiCall(
       // Other plugins' link checks (onBeforeExternalLink) see it like a
       // click in a message; the plugin's own handler isn't asked again, so a
       // link check opens the link after its dialog.
-      const target = await resolveExternalLink({ href: parsed.toString(), target: '_blank' }, { skipPluginId: plugin.id });
-      if (!target) return undefined;
-      // Always open in a new tab; plugins must not be able to navigate the
+      // Always opens in a new tab; plugins must not be able to navigate the
       // host window (_self/_top/_parent) to an attacker-controlled origin.
-      window.open(target, '_blank', 'noopener,noreferrer');
+      await openExternalLink({ href: parsed.toString(), target: '_blank' }, { skipPluginId: plugin.id });
       return undefined;
     }
     case 'ui.print': return doUiPrint(plugin, args[0]);

From 0c8d4ad93ed5cb1f633c7b873979ae163766981b Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 10:02:58 +0100
Subject: [PATCH 10/17] fix: hold sends until required send checks have
 started, and check what really goes out

- The message for send checks is built after waiting for required
  checks that are still starting: a send right after sign-in gave them
  no external recipients and no file types.
- A plugin's forward is held too while a required check is down, also
  with no plugin listening.
- A plugin the admin forces on that hasn't reached this browser yet (a
  new device, a failed plugin sync) counts as starting.
- A check that stopped working says to reload or tell the admin.
- The files that were checked are the ones sent, and recipients a
  plugin adds after the check are checked again.
- A file Bulwark couldn't read is marked unreadable; a text file
  starting with "MZ" is text, Java and Android apps are told from ZIPs.

Changed assertions: runPluginSendCheck takes a builder and reports
guard-loading or guard-failed instead of guard-down; the composer test
of an auto-disabled guard expects the stopped_working text; the sniff
tests give programs a zero byte, as real ones have, and expect
unreadable on a file that can't be read.
---
 .../composer-send-check-payload.test.tsx      | 79 +++++++++++++++++--
 components/email/email-composer.tsx           | 52 +++++++-----
 components/mail/mail-app.tsx                  |  3 +-
 .../plugin-host-email-forward.test.ts         | 16 +++-
 lib/__tests__/plugin-send-guards.test.ts      | 78 ++++++++++++++++--
 .../__tests__/send-check-payload.test.ts      | 32 ++++++--
 lib/outgoing/attachment-sniff.ts              | 22 +++++-
 lib/outgoing/plugin-send-check.ts             | 47 +++++++++--
 lib/outgoing/quick-reply.ts                   |  7 +-
 lib/outgoing/send-check-payload.ts            | 13 ++-
 lib/plugin-sandbox/host-api-forward.ts        | 15 ++--
 lib/plugin-send-guards.ts                     | 32 +++++++-
 lib/plugin-types.ts                           |  7 ++
 locales/ar/common.json                        |  3 +-
 locales/ca/common.json                        |  3 +-
 locales/cs/common.json                        |  3 +-
 locales/da/common.json                        |  3 +-
 locales/de/common.json                        |  3 +-
 locales/en/common.json                        |  3 +-
 locales/es/common.json                        |  3 +-
 locales/et/common.json                        |  3 +-
 locales/fa/common.json                        |  3 +-
 locales/fr/common.json                        |  3 +-
 locales/he/common.json                        |  3 +-
 locales/hu/common.json                        |  3 +-
 locales/it/common.json                        |  3 +-
 locales/ja/common.json                        |  3 +-
 locales/ko/common.json                        |  3 +-
 locales/lv/common.json                        |  3 +-
 locales/mn/common.json                        |  3 +-
 locales/nb/common.json                        |  3 +-
 locales/nl/common.json                        |  3 +-
 locales/pl/common.json                        |  3 +-
 locales/pt/common.json                        |  3 +-
 locales/ro/common.json                        |  3 +-
 locales/ru/common.json                        |  3 +-
 locales/sk/common.json                        |  3 +-
 locales/th/common.json                        |  3 +-
 locales/tr/common.json                        |  3 +-
 locales/uk/common.json                        |  3 +-
 locales/vi/common.json                        |  3 +-
 locales/zh-TW/common.json                     |  3 +-
 locales/zh/common.json                        |  3 +-
 stores/plugin-store.ts                        | 36 +++++++--
 44 files changed, 425 insertions(+), 104 deletions(-)

diff --git a/components/email/__tests__/composer-send-check-payload.test.tsx b/components/email/__tests__/composer-send-check-payload.test.tsx
index 3db8388d8..4a0484412 100644
--- a/components/email/__tests__/composer-send-check-payload.test.tsx
+++ b/components/email/__tests__/composer-send-check-payload.test.tsx
@@ -20,9 +20,10 @@ const signaturePlugin = vi.hoisted(() => ({ on: false }));
 // Send plugins: a footer added by onTransformOutgoingEmail, and a crypto
 // plugin taking the send over (onComposeSend).
 // What a send check plugin (onBeforeEmailSend) was handed.
-const sendChecks = vi.hoisted(() => ({ seen: [] as unknown[] }));
+const sendChecks = vi.hoisted(() => ({ seen: [] as unknown[], size: 1, answers: [] as string[] }));
 const sendPlugins = vi.hoisted(() => ({
   footer: false,
+  addBcc: '' as string,
   takeOver: null as null | ((request: { htmlBody: string; textBody: string }) => void),
 }));
 vi.mock('@/components/email/rich-text-editor', () => ({
@@ -201,9 +202,9 @@ vi.mock('@/lib/plugin-hooks', () => ({
     onDraftChange: { emit: () => {} },
     onBeforeDraftAutoSave: { transform: async (draft: unknown) => draft },
     onBeforeEmailSend: {
-      size: 1,
+      get size() { return sendChecks.size; },
       intercept: async () => true,
-      interceptOutcome: async (email: unknown) => { sendChecks.seen.push(email); return 'allowed'; },
+      interceptOutcome: async (email: unknown) => { sendChecks.seen.push(email); return sendChecks.answers.shift() ?? 'allowed'; },
     },
     onComposeSend: {
       takeOver: async (request: { htmlBody: string; textBody: string }) => {
@@ -213,9 +214,12 @@ vi.mock('@/lib/plugin-hooks', () => ({
       },
     },
     onTransformOutgoingEmail: {
-      transform: async (email: { htmlBody: string; textBody: string }) => (sendPlugins.footer
-        ? { ...email, htmlBody: `${email.htmlBody}<p>Plugin footer</p>`, textBody: `${email.textBody}\n\nPlugin footer` }
-        : email),
+      transform: async (email: { htmlBody: string; textBody: string; bcc: string[] }) => {
+        const withBcc = sendPlugins.addBcc ? { ...email, bcc: [...email.bcc, sendPlugins.addBcc] } : email;
+        return sendPlugins.footer
+          ? { ...withBcc, htmlBody: `${withBcc.htmlBody}<p>Plugin footer</p>`, textBody: `${withBcc.textBody}\n\nPlugin footer` }
+          : withBcc;
+      },
     },
   },
   contactHooks: {
@@ -332,8 +336,69 @@ describe('composer: a required send check that is down', () => {
     const onSend = vi.fn();
     render(<EmailComposer initialData={DRAFT} onSend={onSend} />);
     fireEvent.click(screen.getAllByTestId('composer-send')[0]);
-    await waitFor(() => expect(toasts.error).toContain('not_running'));
+    // Turned off after errors: waiting doesn't help, reloading may.
+    await waitFor(() => expect(toasts.error).toContain('stopped_working'));
     expect(onSend).not.toHaveBeenCalled();
     expect(sendChecks.seen).toEqual([]);
   });
+
+  it('gives a check that was still starting at the click the whole message once it runs', async () => {
+    let status = 'enabled';
+    const listeners = new Set<() => void>();
+    const guard = () => ({
+      id: 'send-checks', name: 'Send checks', version: '1.0.0', permissions: ['email:send'],
+      status, enabled: true, forceEnabled: true, managed: true,
+    }) as unknown as InstalledPlugin;
+    setSendGuardSource({ snapshot: () => ({ plugins: [guard()], forced: () => true }), subscribe: (l) => { listeners.add(l); return () => listeners.delete(l); } });
+    setPolicy([]);
+    // Nothing listens at the click; the check registers when it has started.
+    sendChecks.size = 0;
+    sendChecks.seen = [];
+    const onSend = vi.fn();
+    render(<EmailComposer initialData={DRAFT} onSend={onSend} />);
+    fireEvent.click(screen.getAllByTestId('composer-send')[0]);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(onSend).not.toHaveBeenCalled();
+    sendChecks.size = 1;
+    status = 'running';
+    listeners.forEach((l) => l());
+    await waitFor(() => expect(onSend).toHaveBeenCalledTimes(1));
+    expect((sendChecks.seen[0] as OutgoingEmail).externalRecipients).toEqual(['carol@partner.test', 'mallory@evil.test']);
+  });
+});
+
+// A plugin's onTransformOutgoingEmail ran after the check: an automatic Bcc
+// to an outside address went out after an "outside only" rule had passed.
+describe('composer: recipients a plugin adds after the check', () => {
+  beforeEach(() => {
+    sendChecks.size = 1;
+    sendChecks.seen = [];
+    sendChecks.answers = [];
+    setPolicy([]);
+  });
+  afterEach(() => {
+    sendPlugins.addBcc = '';
+    vi.clearAllMocks();
+  });
+
+  it('are checked again, and a no then stops the send', async () => {
+    sendPlugins.addBcc = 'archive@outside.test';
+    sendChecks.answers = ['allowed', 'vetoed'];
+    const onSend = vi.fn();
+    render(<EmailComposer initialData={{ ...DRAFT, to: 'bob@example.com', bcc: '' }} onSend={onSend} />);
+    fireEvent.click(screen.getAllByTestId('composer-send')[0]);
+    await waitFor(() => expect(sendChecks.seen).toHaveLength(2));
+    expect((sendChecks.seen[0] as OutgoingEmail).externalRecipients).toEqual([]);
+    expect((sendChecks.seen[1] as OutgoingEmail).externalRecipients).toEqual(['archive@outside.test']);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(onSend).not.toHaveBeenCalled();
+  });
+
+  it('are not asked about twice when nobody changed the recipients', async () => {
+    const onSend = vi.fn();
+    render(<EmailComposer initialData={{ ...DRAFT, to: 'bob@example.com', bcc: '' }} onSend={onSend} />);
+    fireEvent.click(screen.getAllByTestId('composer-send')[0]);
+    await waitFor(() => expect(onSend).toHaveBeenCalledTimes(1));
+    expect(sendChecks.seen).toHaveLength(1);
+  });
 });
diff --git a/components/email/email-composer.tsx b/components/email/email-composer.tsx
index eedd3d713..4efbbf971 100644
--- a/components/email/email-composer.tsx
+++ b/components/email/email-composer.tsx
@@ -113,7 +113,7 @@ import { wantsSignatureSeparator } from "@/lib/signature-delimiter";
 import { finalizeOutgoing, runPreSendChecks, type OutgoingContext } from "@/lib/outgoing/send-pipeline";
 import { classifyOutgoing, isLabelRequiredError, labelMissing, labelsPolicyFor, resolveLabel, type OriginalMessage } from "@/lib/outgoing/classification";
 import { beginLabelTakeover, endLabelTakeover } from "@/lib/outgoing/classification-raw";
-import { runPluginSendCheck } from "@/lib/outgoing/plugin-send-check";
+import { recipientsChanged, runPluginSendCheck, sendGuardMessageKey } from "@/lib/outgoing/plugin-send-check";
 import { externalRecipientsFor, inspectAttachments, sniffFile } from "@/lib/outgoing/send-check-payload";
 import { whenPolicySettled } from "@/stores/policy-store";
 import { ClassificationLabelPicker, type ClassificationPickerHandle } from "./classification-label-picker";
@@ -2223,12 +2223,12 @@ export function EmailComposer({
     // Let plugins veto each upload before it's queued.
     const allowedFiles: File[] = [];
     for (const file of files) {
-      const sniffedType = emailHooks.onBeforeAttachmentUpload.size > 0 ? await sniffFile(file) : undefined;
+      const sniffed = emailHooks.onBeforeAttachmentUpload.size > 0 ? await sniffFile(file) : {};
       const ok = await emailHooks.onBeforeAttachmentUpload.intercept({
         name: file.name,
         type: file.type || 'application/octet-stream',
         size: file.size,
-        ...(sniffedType ? { sniffedType } : {}),
+        ...sniffed,
       });
       if (ok) allowedFiles.push(file);
     }
@@ -3616,24 +3616,28 @@ export function EmailComposer({
       // guards, send checks). Returning false from any handler aborts before
       // either the S/MIME or standard JMAP path runs. What a send check needs
       // beyond the bodies (lib/outgoing/send-check-payload.ts) is worked out
-      // only while a plugin listens.
-      const checking = emailHooks.onBeforeEmailSend.size > 0;
+      // after waiting for required checks that are still starting, and only
+      // while a plugin listens.
       const sendClient = composerClientRef.current ?? client;
       const readBlob = (blobId: string, name: string, type: string, bytes: number) => (sendClient
         ? sendClient.fetchBlobArrayBuffer(blobId, name, type, undefined, bytes)
         : Promise.reject(new Error('No client')));
+      // What is checked is what goes: a file added while the check waits or
+      // asks isn't sent with this message.
       const sentAttachments = attachmentsRef.current.filter(att => att.blobId && !att.uploading && !att.error);
-      const sendablePreview: OutgoingEmail = {
+      const recipientsAtCheck = {
         to: toAddresses.map(r => formatRecipient(r.name, r.email)),
         cc: ccAddresses.map(r => formatRecipient(r.name, r.email)),
         bcc: bccAddresses.map(r => formatRecipient(r.name, r.email)),
+      };
+      const buildCheck = async (recipients: { to: string[]; cc: string[]; bcc: string[] }): Promise<OutgoingEmail> => ({
+        ...recipients,
         subject,
         htmlBody: finalHtmlBody || '',
         textBody: finalBody,
         identityId: currentIdentity?.id || '',
         fromEmail,
-        attachments: checking
-          ? await inspectAttachments([
+        attachments: await inspectAttachments([
             ...sentAttachments.map(a => ({
               name: a.name, type: a.type, size: a.size, blobId: a.blobId, file: a.file,
               load: (bytes: number) => readBlob(a.blobId!, a.name, a.type, bytes),
@@ -3642,8 +3646,7 @@ export function EmailComposer({
               name: a.name, type: a.type, size: a.size, blobId: a.blobId, inline: true,
               load: (bytes: number) => readBlob(a.blobId, a.name, a.type, bytes),
             })),
-          ])
-          : sentAttachments.map(a => ({ name: a.name, type: a.type || 'application/octet-stream', size: a.size, blobId: a.blobId })),
+          ]),
         inReplyTo: threadingHeaders?.inReplyTo?.[0],
         surface: 'composer',
         mode,
@@ -3651,9 +3654,9 @@ export function EmailComposer({
           plainTextMode ? plainTextBodyWithoutSignature(body, signatureIdentity) : stripEmbeddedSignatureHtml(body),
           { plainTextMode, forwardedSeparator: tQuote('forwarded_separator') },
         ),
-        externalRecipients: checking ? await externalRecipientsFor(outgoingContext) : [],
-      };
-      const sendCheck = await runPluginSendCheck(sendablePreview);
+        externalRecipients: await externalRecipientsFor({ ...outgoingContext, ...recipients }),
+      });
+      const sendCheck = await runPluginSendCheck(() => buildCheck(recipientsAtCheck));
       if (sendCheck !== 'allowed') {
         // A plugin vetoed the send (it is expected to show its own UI).
         // Leave a trace so a silent no-op send is diagnosable (#592).
@@ -3661,7 +3664,8 @@ export function EmailComposer({
         // A guard that crashed or never answered showed nothing; say why
         // the message is still here.
         if (sendCheck === 'failed') toast.error(t('send_guard_failed'));
-        if (sendCheck === 'guard-down') toast.error(tSendGuards('not_running'));
+        const guardKey = sendGuardMessageKey(sendCheck);
+        if (guardKey) toast.error(tSendGuards(guardKey));
         return;
       }
 
@@ -3697,8 +3701,7 @@ export function EmailComposer({
         references: threadingHeaders?.references,
         delayedUntil: effectiveDelayedUntil,
         attachments: [
-          ...attachmentsRef.current
-            .filter(att => att.blobId && !att.uploading && !att.error)
+          ...sentAttachments
             .map(a => ({ name: a.name, type: a.type || 'application/octet-stream', size: a.size, blobId: a.blobId, cid: a.cid })),
           ...inlineAttachments.map(a => ({ name: a.name, type: a.type, size: a.size, blobId: a.blobId, cid: a.cid })),
         ],
@@ -3730,8 +3733,7 @@ export function EmailComposer({
       } else {
         // Standard JMAP send path
         // Collect uploaded attachment blobIds for the send request
-        const uploadedAttachments: Array<{ blobId: string; name: string; type: string; size: number; disposition?: 'attachment' | 'inline'; cid?: string }> = attachmentsRef.current
-          .filter(att => att.blobId && !att.uploading && !att.error)
+        const uploadedAttachments: Array<{ blobId: string; name: string; type: string; size: number; disposition?: 'attachment' | 'inline'; cid?: string }> = sentAttachments
           .map(att => ({
             blobId: att.blobId!,
             name: att.name,
@@ -3759,6 +3761,20 @@ export function EmailComposer({
           inReplyTo: threadingHeaders?.inReplyTo?.[0],
         };
         const outgoing = await emailHooks.onTransformOutgoingEmail.transform(transformInput);
+        // A plugin that adds or changes recipients after the send checks
+        // (an automatic Bcc) could take the message outside after an
+        // "only outside the organisation" rule passed: check it again for
+        // the recipients it really goes to.
+        if (recipientsChanged(recipientsAtCheck, outgoing)) {
+          const recheck = await runPluginSendCheck(() => buildCheck({ to: outgoing.to ?? [], cc: outgoing.cc ?? [], bcc: outgoing.bcc ?? [] }));
+          if (recheck !== 'allowed') {
+            debug.log('email', `Send stopped on the second check after a plugin changed the recipients (${recheck})`);
+            if (recheck === 'failed') toast.error(t('send_guard_failed'));
+            const recheckKey = sendGuardMessageKey(recheck);
+            if (recheckKey) toast.error(tSendGuards(recheckKey));
+            return;
+          }
+        }
         // Below whatever the plugins added (a footer), the `last` finalisers.
         const sealedOutgoing = lastStage(outgoing.htmlBody, outgoing.textBody);
         // The label after the plugins had their say, so none can drop it.
diff --git a/components/mail/mail-app.tsx b/components/mail/mail-app.tsx
index 0bccfb3e0..2d4d21d82 100644
--- a/components/mail/mail-app.tsx
+++ b/components/mail/mail-app.tsx
@@ -4118,7 +4118,8 @@ export function MailApp({ linkSegments: routeSegments }: MailAppProps = {}) {
       // A plugin that said no told the user; one that crashed didn't.
       onSendCheckStopped: (outcome) => {
         if (outcome === 'failed') toast.error(t('email_composer.send_guard_failed'));
-        if (outcome === 'guard-down') toast.error(t('send_guards.not_running'));
+        if (outcome === 'guard-loading') toast.error(t('send_guards.not_running'));
+        if (outcome === 'guard-failed') toast.error(t('send_guards.stopped_working'));
       },
       questions: {
         // The fill-in words of the UI language and of English, as the composer.
diff --git a/lib/__tests__/plugin-host-email-forward.test.ts b/lib/__tests__/plugin-host-email-forward.test.ts
index 463ba96c2..ca61a1723 100644
--- a/lib/__tests__/plugin-host-email-forward.test.ts
+++ b/lib/__tests__/plugin-host-email-forward.test.ts
@@ -189,7 +189,7 @@ describe('api.email.forward', () => {
 
   it("gives send checks the note, the recipients outside and what the attachments really are", async () => {
     const seen: OutgoingEmail[] = [];
-    client.fetchBlobArrayBuffer = vi.fn(async (blobId: string) => new TextEncoder().encode(blobId === 'pdf-1' ? 'MZ' : '<Invoice/>').buffer);
+    client.fetchBlobArrayBuffer = vi.fn(async (blobId: string) => (blobId === 'pdf-1' ? new Uint8Array([0x4d, 0x5a, 0x90, 0, 3]) : new TextEncoder().encode('<Invoice/>')).buffer);
     const off = emailHooks.onBeforeEmailSend.register('send-checks', (outgoing: OutgoingEmail) => { seen.push(outgoing); return false; });
     try {
       const pending = call(FORWARDER, 'email.forward', 'E1', { to: ['books@outside.test', 'ann2@example.com'], text: 'Please book this.' });
@@ -210,6 +210,20 @@ describe('api.email.forward', () => {
     }
   });
 
+  it('is held while a send check the admin requires is down, also with no plugin listening', async () => {
+    const { setSendGuardSource } = await import('../plugin-send-guards');
+    const down = { id: 'send-checks', name: 'Send checks', version: '1', permissions: ['email:send'], status: 'error', error: 'auto-disabled', enabled: false, forceEnabled: true } as unknown as InstalledPlugin;
+    setSendGuardSource({ snapshot: () => ({ plugins: [down], forced: () => true }), subscribe: () => () => {} });
+    try {
+      const pending = call(FORWARDER, 'email.forward', 'E1', { to: ['books@example.com'] });
+      await answerDialog(true);
+      expect(await pending).toEqual({ sent: false, reason: 'stopped' });
+      expect(sendEmail).not.toHaveBeenCalled();
+    } finally {
+      setSendGuardSource(null);
+    }
+  });
+
   it('needs email:forward and sound input', async () => {
     await expect(call(plugin(['email:read', 'email:send']), 'email.forward', 'E1', { to: ['a@example.com'] }))
       .rejects.toThrow(/lacks permission "email:forward"/);
diff --git a/lib/__tests__/plugin-send-guards.test.ts b/lib/__tests__/plugin-send-guards.test.ts
index 8b53f4496..80bb0e097 100644
--- a/lib/__tests__/plugin-send-guards.test.ts
+++ b/lib/__tests__/plugin-send-guards.test.ts
@@ -2,6 +2,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import {
   awaitSendGuards,
   downSendGuards,
+  getSendGuardSource,
   guardsSending,
   rememberDeclaredHooks,
   setSendGuardSource,
@@ -27,9 +28,12 @@ const email: OutgoingEmail = { to: ['x@example.org'], cc: [], bcc: [], subject:
 
 beforeEach(() => {
   localStorage.clear();
+  // Plugins are on (the default policy has them off).
+  const state = usePolicyStore.getState();
+  usePolicyStore.setState({ policy: { ...state.policy, features: { ...state.policy.features, pluginsEnabled: true } } });
 });
 afterEach(() => {
-  usePluginStore.setState({ plugins: [] });
+  usePluginStore.setState({ plugins: [], initialized: false, serverPluginsSynced: false });
   emailHooks.onBeforeEmailSend.clear();
   vi.useRealTimers();
 });
@@ -95,15 +99,13 @@ describe('awaitSendGuards', () => {
   });
 
   it('sees nothing without a source (no plugin store, as in Lite)', async () => {
+    const storeSource = getSendGuardSource();
     setSendGuardSource(null);
     try {
       usePluginStore.setState({ plugins: [guard({ status: 'error', error: 'auto-disabled' })] });
       expect(await awaitSendGuards(10)).toEqual([]);
     } finally {
-      setSendGuardSource({
-        snapshot: () => ({ plugins: usePluginStore.getState().plugins, forced: (p) => !!p.forceEnabled }),
-        subscribe: (l) => usePluginStore.subscribe(l),
-      });
+      setSendGuardSource(storeSource);
     }
   });
 });
@@ -113,10 +115,72 @@ describe('runPluginSendCheck', () => {
     const handler = vi.fn(() => undefined);
     emailHooks.onBeforeEmailSend.register('other', handler);
     usePluginStore.setState({ plugins: [guard({ status: 'error', error: 'auto-disabled', enabled: false })] });
-    expect(await runPluginSendCheck(email)).toBe('guard-down');
+    expect(await runPluginSendCheck(() => email)).toBe('guard-failed');
     expect(handler).not.toHaveBeenCalled();
     usePluginStore.setState({ plugins: [guard()] });
-    expect(await runPluginSendCheck(email)).toBe('allowed');
+    expect(await runPluginSendCheck(() => email)).toBe('allowed');
     expect(handler).toHaveBeenCalledTimes(1);
   });
 });
+
+// A plugin the admin forces on that hasn't reached this browser (a new
+// device, a failed plugin sync) used to count for nothing: mail went out
+// unchecked until it arrived.
+describe('a forced plugin this browser has not got yet', () => {
+  const forceInPolicy = (ids: string[]) => {
+    const state = usePolicyStore.getState();
+    usePolicyStore.setState({ policy: { ...state.policy, forceEnabledPlugins: ids } });
+  };
+  afterEach(() => forceInPolicy([]));
+
+  it('counts as starting until the admin list arrived in full, then not', () => {
+    forceInPolicy(['send-checks']);
+    usePluginStore.setState({ plugins: [], initialized: true, serverPluginsSynced: false });
+    expect(downSendGuards()).toEqual([{ id: 'send-checks', name: 'send-checks', state: 'loading' }]);
+    usePluginStore.setState({ initialized: false, serverPluginsSynced: true });
+    expect(downSendGuards().map((g) => g.id)).toEqual(['send-checks']);
+    // The server left it out on purpose (refused in the no-third-party mode, removed).
+    usePluginStore.setState({ initialized: true, serverPluginsSynced: true });
+    expect(downSendGuards()).toEqual([]);
+  });
+
+  it('counts nothing while the admin turned plugins off', () => {
+    forceInPolicy(['send-checks']);
+    const state = usePolicyStore.getState();
+    usePolicyStore.setState({ policy: { ...state.policy, features: { ...state.policy.features, pluginsEnabled: false } } });
+    try {
+      usePluginStore.setState({ plugins: [guard({ status: 'error', error: 'auto-disabled' })], initialized: false });
+      expect(downSendGuards()).toEqual([]);
+    } finally {
+      usePolicyStore.setState({ policy: { ...state.policy } });
+    }
+  });
+});
+
+// A send right after sign-in, while the check was still starting, gave it a
+// message built for nobody: no external recipients, no file types.
+describe('runPluginSendCheck builds the message after the wait', () => {
+  it('asks a check that finished starting with the message built then', async () => {
+    usePluginStore.setState({ plugins: [guard({ status: 'enabled' })] });
+    const seen: unknown[] = [];
+    let built = 0;
+    const pending = runPluginSendCheck(() => { built++; return { ...email, externalRecipients: ['x@outside.test'] }; });
+    expect(built).toBe(0);
+    emailHooks.onBeforeEmailSend.register('send-checks', (m: OutgoingEmail) => { seen.push(m); return false; });
+    usePluginStore.setState({ plugins: [guard({ status: 'running' })] });
+    expect(await pending).toBe('vetoed');
+    expect(built).toBe(1);
+    expect(seen).toEqual([expect.objectContaining({ externalRecipients: ['x@outside.test'] })]);
+  });
+
+  it('says whether a guard is starting or has stopped working', async () => {
+    vi.useFakeTimers();
+    usePluginStore.setState({ plugins: [guard({ status: 'enabled' })] });
+    const waiting = runPluginSendCheck(() => email);
+    await vi.advanceTimersByTimeAsync(8000);
+    expect(await waiting).toBe('guard-loading');
+    vi.useRealTimers();
+    usePluginStore.setState({ plugins: [guard({ status: 'error', error: 'Bundle integrity mismatch' })] });
+    expect(await runPluginSendCheck(() => email)).toBe('guard-failed');
+  });
+});
diff --git a/lib/outgoing/__tests__/send-check-payload.test.ts b/lib/outgoing/__tests__/send-check-payload.test.ts
index 3b1dce85a..1c7f87a0d 100644
--- a/lib/outgoing/__tests__/send-check-payload.test.ts
+++ b/lib/outgoing/__tests__/send-check-payload.test.ts
@@ -26,6 +26,18 @@ describe('sniffType', () => {
     expect(sniffType(bytes('#!/bin/sh\nrm -rf /\n'))).toBe('text/x-shellscript');
   });
 
+  it('takes a text file that starts with "MZ" for text, not a program', () => {
+    expect(sniffType(bytes('MZ Steuerberatung, Rechnung 2026\n'))).toBe('text/plain');
+  });
+
+  it('tells Java and Android apps from other ZIP files', () => {
+    expect(sniffType(bytes('PK', [3, 4, 20, 0], '....META-INF/MANIFEST.MF'))).toBe('application/java-archive');
+    expect(sniffType(bytes('PK', [3, 4, 20, 0], '....AndroidManifest.xml'))).toBe('application/vnd.android.package-archive');
+    expect(sniffType(bytes('PK', [3, 4, 20, 0], '....[Content_Types].xml'))).toBe('application/zip');
+    // An OpenDocument file has a META-INF/manifest.xml, not MANIFEST.MF.
+    expect(sniffType(bytes('PK', [3, 4, 20, 0], 'mimetypeapplication/vnd.oasis.opendocument.textMETA-INF/manifest.xml'))).toBe('application/zip');
+  });
+
   it('tells HTML and plain text from binary data', () => {
     expect(sniffType(bytes('\uFEFF  <!DOCTYPE html><html>'))).toBe('text/html');
     expect(sniffType(bytes('IBAN;Name\nDE89370400440532013000;Alice\n'))).toBe('text/plain');
@@ -59,7 +71,7 @@ describe('inspectAttachments', () => {
     const load = (content: string) => async (n: number) => { asked.push(n); return new TextEncoder().encode(content).buffer as ArrayBuffer; };
     const out = await inspectAttachments([
       { name: 'notes.txt', type: 'text/plain', size: 10, blobId: 'b1', load: load('hello') },
-      { name: 'invoice.pdf', type: 'application/pdf', size: 9_000_000, blobId: 'b2', load: load('MZ\u0090') },
+      { name: 'invoice.pdf', type: 'application/pdf', size: 9_000_000, blobId: 'b2', load: load('MZ\u0090\u0000\u0003') },
     ]);
     expect(asked).toEqual([TEXT_EXCERPT_BYTES, SNIFF_BYTES]);
     expect(out[0]).toMatchObject({ sniffedType: 'text/plain', textExcerpt: 'hello' });
@@ -69,20 +81,26 @@ describe('inspectAttachments', () => {
 
   it("doesn't read a program named .txt as text, nor inline images", async () => {
     const out = await inspectAttachments([
-      { name: 'readme.txt', type: 'text/plain', size: 3, file: new Blob([bytes('MZ', [0x90])]) },
+      { name: 'readme.txt', type: 'text/plain', size: 3, file: new Blob([bytes('MZ', [0x90, 0, 3])]) },
       { name: 'pasted.png', type: 'image/png', size: 8, blobId: 'b3', inline: true, file: new Blob([bytes([0x89], 'PNG', [0x0d, 0x0a, 0x1a, 0x0a])]) },
     ]);
     expect(out[0]).toEqual({ name: 'readme.txt', type: 'text/plain', size: 3, sniffedType: 'application/x-msdownload' });
     expect(out[1]).toEqual({ name: 'pasted.png', type: 'image/png', size: 8, blobId: 'b3', inline: true, sniffedType: 'image/png' });
   });
 
-  it('passes a file it cannot read on without the two fields', async () => {
-    const [out] = await inspectAttachments([{ name: 'a.txt', type: '', size: 1, blobId: 'b', load: async () => { throw new Error('offline'); } }]);
-    expect(out).toEqual({ name: 'a.txt', type: 'application/octet-stream', size: 1, blobId: 'b' });
+  it('marks a file it cannot read, so a check does not take it for a clean one', async () => {
+    const [out, none] = await inspectAttachments([
+      { name: 'a.txt', type: '', size: 1, blobId: 'b', load: async () => { throw new Error('offline'); } },
+      { name: 'b.bin', type: '', size: 1, blobId: 'c' },
+    ]);
+    expect(out).toEqual({ name: 'a.txt', type: 'application/octet-stream', size: 1, blobId: 'b', unreadable: true });
+    expect(none.unreadable).toBe(true);
   });
 
-  it('sniffs a file before upload', async () => {
-    expect(await sniffFile(new Blob([bytes('MZ', [0x90])]))).toBe('application/x-msdownload');
+  it('sniffs a file before upload, and says when it cannot', async () => {
+    expect(await sniffFile(new Blob([bytes('MZ', [0x90, 0, 3])]))).toEqual({ sniffedType: 'application/x-msdownload' });
+    const broken = { slice: () => ({ arrayBuffer: async () => { throw new Error('gone'); } }) } as unknown as Blob;
+    expect(await sniffFile(broken)).toEqual({ unreadable: true });
   });
 });
 
diff --git a/lib/outgoing/attachment-sniff.ts b/lib/outgoing/attachment-sniff.ts
index 1671a1c27..f32b92846 100644
--- a/lib/outgoing/attachment-sniff.ts
+++ b/lib/outgoing/attachment-sniff.ts
@@ -17,7 +17,6 @@ const startsWith = (bytes: Uint8Array, sig: readonly number[], offset = 0): bool
 const ascii = (text: string): number[] => Array.from(text, (c) => c.charCodeAt(0));
 
 const SIGNATURES: readonly { sig: readonly number[]; offset?: number; type: string }[] = [
-  { sig: ascii('MZ'), type: 'application/x-msdownload' },
   { sig: [0x7f, 0x45, 0x4c, 0x46], type: 'application/x-executable' },
   { sig: [0xcf, 0xfa, 0xed, 0xfe], type: 'application/x-mach-binary' },
   { sig: [0xce, 0xfa, 0xed, 0xfe], type: 'application/x-mach-binary' },
@@ -42,10 +41,29 @@ const SIGNATURES: readonly { sig: readonly number[]; offset?: number; type: stri
   { sig: ascii('#!'), type: 'text/x-shellscript' },
 ];
 
+/** Whether `needle` occurs in the bytes. */
+function contains(bytes: Uint8Array, needle: string): boolean {
+  const sig = ascii(needle);
+  outer: for (let i = 0; i + sig.length <= bytes.length; i++) {
+    for (let j = 0; j < sig.length; j++) if (bytes[i + j] !== sig[j]) continue outer;
+    return true;
+  }
+  return false;
+}
+
 /** The MIME type the bytes start with, or undefined when none is known. */
 export function sniffType(bytes: Uint8Array): string | undefined {
+  // "MZ" starts every Windows and DOS program, whose header holds zero
+  // bytes; a text file that happens to start with "MZ" has none.
+  if (startsWith(bytes, ascii('MZ')) && bytes.subarray(0, SNIFF_BYTES).includes(0)) return 'application/x-msdownload';
   for (const { sig, offset, type } of SIGNATURES) {
-    if (startsWith(bytes, sig, offset)) return type;
+    if (!startsWith(bytes, sig, offset)) continue;
+    // Java and Android apps are ZIP files; their entry names give them away.
+    if (type === 'application/zip') {
+      if (contains(bytes, 'AndroidManifest.xml')) return 'application/vnd.android.package-archive';
+      if (contains(bytes, 'META-INF/MANIFEST.MF')) return 'application/java-archive';
+    }
+    return type;
   }
   if (startsWith(bytes, ascii('RIFF')) && startsWith(bytes, ascii('WEBP'), 8)) return 'image/webp';
   return sniffText(bytes);
diff --git a/lib/outgoing/plugin-send-check.ts b/lib/outgoing/plugin-send-check.ts
index 4bbdfe8a6..b0bfb4703 100644
--- a/lib/outgoing/plugin-send-check.ts
+++ b/lib/outgoing/plugin-send-check.ts
@@ -16,17 +16,50 @@ import { debug } from '@/lib/debug';
 
 /**
  * allowed: send. vetoed: a plugin said no and told the user. failed: a
- * handler threw or ran out of time. guard-down: a send check the admin
- * requires isn't running (lib/plugin-send-guards.ts). Nobody told the user
- * about the last two yet.
+ * handler threw or ran out of time. guard-loading / guard-failed: a send
+ * check the admin requires is still starting, or failed to start or was
+ * turned off after errors (lib/plugin-send-guards.ts). Nobody told the user
+ * about the last three yet.
  */
-export type PluginSendCheckOutcome = 'allowed' | 'vetoed' | 'failed' | 'guard-down';
+export type PluginSendCheckOutcome = 'allowed' | 'vetoed' | 'failed' | 'guard-loading' | 'guard-failed';
 
-export async function runPluginSendCheck(email: OutgoingEmail): Promise<PluginSendCheckOutcome> {
+/**
+ * Waits for the send checks the admin requires, then asks the plugins.
+ * `build` makes the message they get; it runs only after that wait and only
+ * while a plugin listens, so a check that was still starting at the click
+ * gets the whole message (external recipients, attachment types), never the
+ * cut-down one built for nobody.
+ */
+export async function runPluginSendCheck(build: () => OutgoingEmail | Promise<OutgoingEmail>): Promise<PluginSendCheckOutcome> {
   const down = await awaitSendGuards();
   if (down.length > 0) {
     debug.warn('email', `Send held: required send checks not running: ${down.map((g) => `${g.id} (${g.state})`).join(', ')}`);
-    return 'guard-down';
+    return down.some((g) => g.state === 'failed') ? 'guard-failed' : 'guard-loading';
   }
-  return emailHooks.onBeforeEmailSend.interceptOutcome(email);
+  if (emailHooks.onBeforeEmailSend.size === 0) return 'allowed';
+  return emailHooks.onBeforeEmailSend.interceptOutcome(await build());
+}
+
+/** The message key in the `send_guards` namespace for a held send, or null. */
+export function sendGuardMessageKey(outcome: PluginSendCheckOutcome): 'not_running' | 'stopped_working' | null {
+  if (outcome === 'guard-loading') return 'not_running';
+  if (outcome === 'guard-failed') return 'stopped_working';
+  return null;
+}
+
+/** Bare lowercase addresses of a recipient list ("Name <a@b>" or "a@b"). */
+function addressSet(list: readonly string[]): string {
+  return list
+    .map((entry) => (/<([^>]+)>\s*$/.exec(entry)?.[1] ?? entry).trim().toLowerCase())
+    .filter(Boolean)
+    .sort()
+    .join(',');
+}
+
+/** Whether a plugin's onTransformOutgoingEmail changed who the message goes to. */
+export function recipientsChanged(
+  before: Pick<OutgoingEmail, 'to' | 'cc' | 'bcc'>,
+  after: Pick<OutgoingEmail, 'to' | 'cc' | 'bcc'>,
+): boolean {
+  return addressSet([...before.to, ...before.cc, ...before.bcc]) !== addressSet([...(after.to ?? []), ...(after.cc ?? []), ...(after.bcc ?? [])]);
 }
diff --git a/lib/outgoing/quick-reply.ts b/lib/outgoing/quick-reply.ts
index d0a6ed207..142022ddf 100644
--- a/lib/outgoing/quick-reply.ts
+++ b/lib/outgoing/quick-reply.ts
@@ -5,7 +5,6 @@ import { findUnfilledPlaceholders, type PlaceholderWords } from '@/lib/placehold
 import { finalizeOutgoing, runPreSendChecks, type OutgoingBodies } from './send-pipeline';
 import { runPluginSendCheck, type PluginSendCheckOutcome } from './plugin-send-check';
 import { externalRecipientsFor } from './send-check-payload';
-import { emailHooks } from '@/lib/plugin-hooks';
 // Registers the organisation signature check and the disclaimer.
 import '@/lib/org/outgoing';
 
@@ -100,7 +99,7 @@ export async function prepareQuickReply(input: {
   if (questions?.confirmSend && !(await questions.ask({ kind: 'send' }))) return null;
   const bodies = finalizeOutgoing({ html, text }, context);
   // A quick reply used to skip plugins' send checks: a way around them.
-  const outcome = await runPluginSendCheck({
+  const outcome = await runPluginSendCheck(async () => ({
     to: input.to,
     cc: [],
     bcc: [],
@@ -115,8 +114,8 @@ export async function prepareQuickReply(input: {
     mode: 'reply',
     // The quote isn't part of a quick reply: the typed text is all the user wrote.
     authoredText: body,
-    externalRecipients: emailHooks.onBeforeEmailSend.size > 0 ? await externalRecipientsFor(context) : [],
-  });
+    externalRecipients: await externalRecipientsFor(context),
+  }));
   if (outcome !== 'allowed') {
     input.onSendCheckStopped?.(outcome);
     return null;
diff --git a/lib/outgoing/send-check-payload.ts b/lib/outgoing/send-check-payload.ts
index c4799a7ce..edee160ef 100644
--- a/lib/outgoing/send-check-payload.ts
+++ b/lib/outgoing/send-check-payload.ts
@@ -49,6 +49,7 @@ export interface SendCheckAttachmentSource {
   load?: (bytes: number) => Promise<ArrayBuffer>;
 }
 
+/** The first `bytes` bytes, or null when they couldn't be read (or there is nothing to read them from). */
 async function headOf(source: SendCheckAttachmentSource, bytes: number): Promise<Uint8Array | null> {
   try {
     if (source.file) return new Uint8Array(await source.file.slice(0, bytes).arrayBuffer());
@@ -83,17 +84,21 @@ export async function inspectAttachments(sources: readonly SendCheckAttachmentSo
       if (sniffed) entry.sniffedType = sniffed;
       // A "text" file whose bytes say it is a program is not read as text.
       if (text && (!sniffed || sniffed.startsWith('text/'))) entry.textExcerpt = decodeExcerpt(head);
+    } else {
+      // Said out loud, so a check doesn't take it for a clean file.
+      entry.unreadable = true;
     }
     out.push(entry);
   }
   return out;
 }
 
-/** sniffedType of a file about to be attached (onBeforeAttachmentUpload). */
-export async function sniffFile(file: Blob): Promise<string | undefined> {
+/** sniffedType of a file about to be attached (onBeforeAttachmentUpload), or unreadable. */
+export async function sniffFile(file: Blob): Promise<{ sniffedType?: string; unreadable?: true }> {
   try {
-    return sniffType(new Uint8Array(await file.slice(0, SNIFF_BYTES).arrayBuffer()));
+    const sniffedType = sniffType(new Uint8Array(await file.slice(0, SNIFF_BYTES).arrayBuffer()));
+    return sniffedType ? { sniffedType } : {};
   } catch {
-    return undefined;
+    return { unreadable: true };
   }
 }
diff --git a/lib/plugin-sandbox/host-api-forward.ts b/lib/plugin-sandbox/host-api-forward.ts
index 212a108f8..31fa4c0be 100644
--- a/lib/plugin-sandbox/host-api-forward.ts
+++ b/lib/plugin-sandbox/host-api-forward.ts
@@ -22,11 +22,10 @@ import { useEmailStore } from '@/stores/email-store';
 import { useSettingsStore } from '@/stores/settings-store';
 import { useLocaleStore } from '@/stores/locale-store';
 import { detectBrowserLocale } from '@/i18n/detect-locale';
-import { emailHooks } from '../plugin-hooks';
 import { announceSent } from '../plugin-after-send';
 import { buildForwardSubject } from '../subject-prefix';
 import { finalizeOutgoing, runPreSendChecks } from '../outgoing/send-pipeline';
-import { runPluginSendCheck } from '../outgoing/plugin-send-check';
+import { runPluginSendCheck, sendGuardMessageKey } from '../outgoing/plugin-send-check';
 import { externalRecipientsFor, inspectAttachments } from '../outgoing/send-check-payload';
 import { automaticLabel, classifyOutgoing } from '../outgoing/classification';
 import { whenPolicySettled } from '@/stores/policy-store';
@@ -188,8 +187,10 @@ export async function doEmailForward(
   // No plugin step in between, as for a quick reply: both stages at once.
   const body = finalizeOutgoing(finalizeOutgoing({ text: forwardBody(email, note, messages, locale) }, context), context, 'last').text;
 
-  if (emailHooks.onBeforeEmailSend.size > 0) {
-    const outgoing: OutgoingEmail = {
+  // Always: a required send check that isn't running holds the forward too,
+  // also when no plugin listens right now.
+  {
+    const outcome = await runPluginSendCheck(async (): Promise<OutgoingEmail> => ({
       to, cc: [], bcc: [], subject,
       htmlBody: '',
       textBody: body,
@@ -208,9 +209,9 @@ export async function doEmailForward(
       // The plugin's note is the only text written for this forward.
       authoredText: note,
       externalRecipients: await externalRecipientsFor(context),
-    };
-    const outcome = await runPluginSendCheck(outgoing);
-    if (outcome === 'guard-down') toast.error(text(messages, 'send_guards.not_running'));
+    }));
+    const guardKey = sendGuardMessageKey(outcome);
+    if (guardKey) toast.error(text(messages, `send_guards.${guardKey}`));
     if (outcome !== 'allowed') return { sent: false, reason: 'stopped' };
   }
 
diff --git a/lib/plugin-send-guards.ts b/lib/plugin-send-guards.ts
index ee6f27643..916b4f9e7 100644
--- a/lib/plugin-send-guards.ts
+++ b/lib/plugin-send-guards.ts
@@ -23,8 +23,22 @@
 import type { InstalledPlugin } from './plugin-types';
 
 export interface SendGuardSource {
-  /** The installed plugins and whether the admin forces each on. */
-  snapshot(): { plugins: readonly InstalledPlugin[]; forced: (plugin: InstalledPlugin) => boolean };
+  snapshot(): {
+    /** The installed plugins. */
+    plugins: readonly InstalledPlugin[];
+    /** Whether the admin forces a plugin on. */
+    forced: (plugin: InstalledPlugin) => boolean;
+    /** The admin turned plugins off: none runs, none guards. */
+    pluginsOff?: boolean;
+    /**
+     * The plugins started and the admin's list arrived in full. Until then a
+     * plugin the admin forces on can be missing from `plugins` only because
+     * it hasn't reached this browser yet (a new device, a failed sync).
+     */
+    complete?: boolean;
+    /** The plugin ids the policy forces on. */
+    forcedIds?: readonly string[];
+  };
   subscribe(listener: () => void): () => void;
 }
 
@@ -55,6 +69,10 @@ export function setSendGuardSource(next: SendGuardSource | null): void {
   source = next;
 }
 
+export function getSendGuardSource(): SendGuardSource | null {
+  return source;
+}
+
 // ─── Hooks seen at the last start ─────────────────────────────
 
 const HOOKS_KEY_PREFIX = 'plugin-declared-hooks:';
@@ -113,13 +131,21 @@ export function guardState(plugin: InstalledPlugin): SendGuardState | null {
 /** The force-enabled send guards that aren't running now. */
 export function downSendGuards(): DownSendGuard[] {
   if (!source) return [];
-  const { plugins, forced } = source.snapshot();
+  const { plugins, forced, pluginsOff, complete = true, forcedIds = [] } = source.snapshot();
+  if (pluginsOff) return [];
   const out: DownSendGuard[] = [];
   for (const plugin of plugins) {
     if (!forced(plugin) || !guardsSending(plugin)) continue;
     const state = guardState(plugin);
     if (state) out.push({ id: plugin.id, name: plugin.name, state });
   }
+  // A forced plugin this browser doesn't have yet may be a send check:
+  // it counts as starting until the admin's list has arrived in full.
+  if (!complete) {
+    for (const id of forcedIds) {
+      if (!plugins.some((plugin) => plugin.id === id)) out.push({ id, name: id, state: 'loading' });
+    }
+  }
   return out;
 }
 
diff --git a/lib/plugin-types.ts b/lib/plugin-types.ts
index 1e8527570..cd4303f2c 100644
--- a/lib/plugin-types.ts
+++ b/lib/plugin-types.ts
@@ -1106,6 +1106,11 @@ export interface OutgoingAttachment {
    * calendar and contact files) as text.
    */
   textExcerpt?: string;
+  /**
+   * onBeforeEmailSend, 1.20 and later: Bulwark couldn't read the file, so
+   * there is no sniffedType or textExcerpt. Treat it as not checked.
+   */
+  unreadable?: boolean;
 }
 
 export interface OutgoingEmail {
@@ -1236,6 +1241,8 @@ export interface AttachmentInfo {
    * the type its first bytes say it is (see OutgoingAttachment.sniffedType).
    */
   sniffedType?: string;
+  /** onBeforeAttachmentUpload, 1.20 and later: the file's bytes couldn't be read. */
+  unreadable?: boolean;
 }
 
 /**
diff --git a/locales/ar/common.json b/locales/ar/common.json
index af0a02f95..2fe7da744 100644
--- a/locales/ar/common.json
+++ b/locales/ar/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "لم تُرسل. هناك فحص تشترطه مؤسستك لا يعمل حاليًا. حاول مرة أخرى بعد قليل."
+    "not_running": "لم تُرسل. هناك فحص تشترطه مؤسستك لا يعمل حاليًا. حاول مرة أخرى بعد قليل.",
+    "stopped_working": "لم تُرسل. توقف فحص تشترطه مؤسستك عن العمل. أعد تحميل الصفحة. إذا لم يساعد ذلك، أبلغ المسؤول."
   },
   "plugin_list": {
     "filters": "المرشحات",
diff --git a/locales/ca/common.json b/locales/ca/common.json
index e7d195f3f..195785f7b 100644
--- a/locales/ca/common.json
+++ b/locales/ca/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "No s'ha enviat. Una comprovació que exigeix la vostra organització no s'està executant. Torneu-ho a provar d'aquí a un moment."
+    "not_running": "No s'ha enviat. Una comprovació que exigeix la vostra organització no s'està executant. Torneu-ho a provar d'aquí a un moment.",
+    "stopped_working": "No s'ha enviat. Una comprovació que exigeix la vostra organització ha deixat de funcionar. Torneu a carregar la pàgina. Si no ho soluciona, aviseu l'administrador."
   },
   "plugin_list": {
     "filters": "Filtres",
diff --git a/locales/cs/common.json b/locales/cs/common.json
index 42841c483..8ef83656c 100644
--- a/locales/cs/common.json
+++ b/locales/cs/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Neodesláno. Kontrola, kterou vaše organizace vyžaduje, právě neběží. Zkuste to za chvíli znovu."
+    "not_running": "Neodesláno. Kontrola, kterou vaše organizace vyžaduje, právě neběží. Zkuste to za chvíli znovu.",
+    "stopped_working": "Neodesláno. Kontrola, kterou vaše organizace vyžaduje, přestala fungovat. Načtěte stránku znovu. Pokud to nepomůže, obraťte se na správce."
   },
   "plugin_list": {
     "filters": "Filtry",
diff --git a/locales/da/common.json b/locales/da/common.json
index c8ede86b8..5dc061e71 100644
--- a/locales/da/common.json
+++ b/locales/da/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Ikke sendt. En kontrol, som din organisation kræver, kører ikke. Prøv igen om et øjeblik."
+    "not_running": "Ikke sendt. En kontrol, som din organisation kræver, kører ikke. Prøv igen om et øjeblik.",
+    "stopped_working": "Ikke sendt. En kontrol, som din organisation kræver, virker ikke længere. Genindlæs siden. Hvis det ikke hjælper, så kontakt din administrator."
   },
   "plugin_list": {
     "filters": "Filtre",
diff --git a/locales/de/common.json b/locales/de/common.json
index dadd10d1c..e2c830686 100644
--- a/locales/de/common.json
+++ b/locales/de/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Nicht gesendet. Eine Prüfung, die Ihre Organisation vorschreibt, läuft gerade nicht. Versuchen Sie es gleich noch einmal."
+    "not_running": "Nicht gesendet. Eine Prüfung, die Ihre Organisation vorschreibt, läuft gerade nicht. Versuchen Sie es gleich noch einmal.",
+    "stopped_working": "Nicht gesendet. Eine Prüfung, die Ihre Organisation vorschreibt, funktioniert nicht mehr. Laden Sie die Seite neu. Wenn das nicht hilft, wenden Sie sich an Ihre Administration."
   },
   "plugin_list": {
     "filters": "Filter",
diff --git a/locales/en/common.json b/locales/en/common.json
index 637e6e7bb..45606abc7 100644
--- a/locales/en/common.json
+++ b/locales/en/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Not sent. A check your organisation requires isn't running. Try again in a moment."
+    "not_running": "Not sent. A check your organisation requires isn't running. Try again in a moment.",
+    "stopped_working": "Not sent. A check your organisation requires has stopped working. Reload the page. If that doesn't help, tell your administrator."
   },
   "plugin_list": {
     "filters": "Filters",
diff --git a/locales/es/common.json b/locales/es/common.json
index 0b0ffcfa9..35c52225d 100644
--- a/locales/es/common.json
+++ b/locales/es/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "No enviado. Una comprobación que exige tu organización no está en marcha. Vuelve a intentarlo en un momento."
+    "not_running": "No enviado. Una comprobación que exige tu organización no está en marcha. Vuelve a intentarlo en un momento.",
+    "stopped_working": "No enviado. Una comprobación que exige tu organización ha dejado de funcionar. Vuelve a cargar la página. Si no se soluciona, avisa al administrador."
   },
   "plugin_list": {
     "filters": "Filtros",
diff --git a/locales/et/common.json b/locales/et/common.json
index 4f941156c..a20bef979 100644
--- a/locales/et/common.json
+++ b/locales/et/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Ei saadetud. Teie organisatsiooni nõutud kontroll praegu ei tööta. Proovige hetke pärast uuesti."
+    "not_running": "Ei saadetud. Teie organisatsiooni nõutud kontroll praegu ei tööta. Proovige hetke pärast uuesti.",
+    "stopped_working": "Ei saadetud. Teie organisatsiooni nõutud kontroll ei tööta enam. Laadige leht uuesti. Kui see ei aita, teatage administraatorile."
   },
   "plugin_list": {
     "filters": "Filtrid",
diff --git a/locales/fa/common.json b/locales/fa/common.json
index 6d33d0d9d..0ffae400e 100644
--- a/locales/fa/common.json
+++ b/locales/fa/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "ارسال نشد. بررسی‌ای که سازمان شما الزامی کرده در حال اجرا نیست. چند لحظه دیگر دوباره تلاش کنید."
+    "not_running": "ارسال نشد. بررسی‌ای که سازمان شما الزامی کرده در حال اجرا نیست. چند لحظه دیگر دوباره تلاش کنید.",
+    "stopped_working": "ارسال نشد. بررسی‌ای که سازمان شما الزامی کرده دیگر کار نمی‌کند. صفحه را دوباره بارگیری کنید. اگر کمکی نکرد، به مدیر سیستم خبر دهید."
   },
   "plugin_list": {
     "filters": "فیلترها",
diff --git a/locales/fr/common.json b/locales/fr/common.json
index 61c388afb..ef9201d6c 100644
--- a/locales/fr/common.json
+++ b/locales/fr/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Non envoyé. Une vérification exigée par votre organisation ne fonctionne pas. Réessayez dans un instant."
+    "not_running": "Non envoyé. Une vérification exigée par votre organisation ne fonctionne pas. Réessayez dans un instant.",
+    "stopped_working": "Non envoyé. Une vérification exigée par votre organisation ne fonctionne plus. Rechargez la page. Si cela ne suffit pas, prévenez votre administrateur."
   },
   "plugin_list": {
     "filters": "Filtres",
diff --git a/locales/he/common.json b/locales/he/common.json
index c924bb9f1..410187eab 100644
--- a/locales/he/common.json
+++ b/locales/he/common.json
@@ -6003,7 +6003,8 @@
     }
   },
   "send_guards": {
-    "not_running": "לא נשלח. בדיקה שהארגון שלך מחייב לא פועלת כרגע. נסו שוב בעוד רגע."
+    "not_running": "לא נשלח. בדיקה שהארגון שלך מחייב לא פועלת כרגע. נסו שוב בעוד רגע.",
+    "stopped_working": "לא נשלח. בדיקה שהארגון שלך מחייב הפסיקה לפעול. טענו את הדף מחדש. אם זה לא עוזר, פנו למנהל המערכת."
   },
   "plugin_list": {
     "filters": "מסננים",
diff --git a/locales/hu/common.json b/locales/hu/common.json
index af40c1100..038a305a9 100644
--- a/locales/hu/common.json
+++ b/locales/hu/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Nincs elküldve. Egy, a szervezete által előírt ellenőrzés most nem fut. Próbálja újra egy pillanat múlva."
+    "not_running": "Nincs elküldve. Egy, a szervezete által előírt ellenőrzés most nem fut. Próbálja újra egy pillanat múlva.",
+    "stopped_working": "Nincs elküldve. Egy, a szervezete által előírt ellenőrzés leállt. Töltse be újra az oldalt. Ha ez nem segít, szóljon a rendszergazdának."
   },
   "plugin_list": {
     "filters": "Szűrők",
diff --git a/locales/it/common.json b/locales/it/common.json
index 2d4bc8a88..cbb12d150 100644
--- a/locales/it/common.json
+++ b/locales/it/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Non inviato. Un controllo richiesto dalla tua organizzazione non è attivo. Riprova tra un momento."
+    "not_running": "Non inviato. Un controllo richiesto dalla tua organizzazione non è attivo. Riprova tra un momento.",
+    "stopped_working": "Non inviato. Un controllo richiesto dalla tua organizzazione ha smesso di funzionare. Ricarica la pagina. Se non basta, avvisa l'amministratore."
   },
   "plugin_list": {
     "filters": "Filtri",
diff --git a/locales/ja/common.json b/locales/ja/common.json
index f4728eb48..8df1c64f9 100644
--- a/locales/ja/common.json
+++ b/locales/ja/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "送信されませんでした。組織で必須のチェックが動作していません。しばらくしてからもう一度お試しください。"
+    "not_running": "送信されませんでした。組織で必須のチェックが動作していません。しばらくしてからもう一度お試しください。",
+    "stopped_working": "送信されませんでした。組織で必須のチェックが動作しなくなりました。ページを再読み込みしてください。解決しない場合は管理者に連絡してください。"
   },
   "plugin_list": {
     "filters": "フィルター",
diff --git a/locales/ko/common.json b/locales/ko/common.json
index 2447ec2b2..e4047f960 100644
--- a/locales/ko/common.json
+++ b/locales/ko/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "보내지 않았습니다. 조직에서 요구하는 검사가 실행되고 있지 않습니다. 잠시 후 다시 시도하세요."
+    "not_running": "보내지 않았습니다. 조직에서 요구하는 검사가 실행되고 있지 않습니다. 잠시 후 다시 시도하세요.",
+    "stopped_working": "보내지 않았습니다. 조직에서 요구하는 검사가 작동을 멈췄습니다. 페이지를 새로 고치세요. 그래도 안 되면 관리자에게 알리세요."
   },
   "plugin_list": {
     "filters": "필터",
diff --git a/locales/lv/common.json b/locales/lv/common.json
index f7ee1227e..c443fa579 100644
--- a/locales/lv/common.json
+++ b/locales/lv/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Nav nosūtīts. Jūsu organizācijas pieprasītā pārbaude pašlaik nedarbojas. Mēģiniet vēlreiz pēc brīža."
+    "not_running": "Nav nosūtīts. Jūsu organizācijas pieprasītā pārbaude pašlaik nedarbojas. Mēģiniet vēlreiz pēc brīža.",
+    "stopped_working": "Nav nosūtīts. Jūsu organizācijas pieprasītā pārbaude vairs nedarbojas. Pārlādējiet lapu. Ja tas nepalīdz, sazinieties ar administratoru."
   },
   "plugin_list": {
     "filters": "Filtri",
diff --git a/locales/mn/common.json b/locales/mn/common.json
index a25d7c1ab..c5dfd59c0 100644
--- a/locales/mn/common.json
+++ b/locales/mn/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Илгээгдсэнгүй. Танай байгууллагын шаарддаг шалгалт одоогоор ажиллахгүй байна. Хэсэг хугацааны дараа дахин оролдоно уу."
+    "not_running": "Илгээгдсэнгүй. Танай байгууллагын шаарддаг шалгалт одоогоор ажиллахгүй байна. Хэсэг хугацааны дараа дахин оролдоно уу.",
+    "stopped_working": "Илгээгдсэнгүй. Танай байгууллагын шаарддаг шалгалт ажиллахаа больсон. Хуудсыг дахин ачаална уу. Тус болохгүй бол админдаа мэдэгдээрэй."
   },
   "plugin_list": {
     "filters": "Шүүлтүүр",
diff --git a/locales/nb/common.json b/locales/nb/common.json
index 12bea3c7e..7945ce217 100644
--- a/locales/nb/common.json
+++ b/locales/nb/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Ikke sendt. En kontroll organisasjonen din krever, kjører ikke. Prøv igjen om et øyeblikk."
+    "not_running": "Ikke sendt. En kontroll organisasjonen din krever, kjører ikke. Prøv igjen om et øyeblikk.",
+    "stopped_working": "Ikke sendt. En kontroll organisasjonen din krever, har sluttet å virke. Last inn siden på nytt. Hvis det ikke hjelper, si fra til administratoren."
   },
   "plugin_list": {
     "filters": "Filtre",
diff --git a/locales/nl/common.json b/locales/nl/common.json
index d1b377ab6..3cbf1efdd 100644
--- a/locales/nl/common.json
+++ b/locales/nl/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Niet verzonden. Een controle die je organisatie verplicht stelt, draait niet. Probeer het zo meteen opnieuw."
+    "not_running": "Niet verzonden. Een controle die je organisatie verplicht stelt, draait niet. Probeer het zo meteen opnieuw.",
+    "stopped_working": "Niet verzonden. Een controle die je organisatie verplicht stelt, werkt niet meer. Laad de pagina opnieuw. Helpt dat niet, meld het dan bij je beheerder."
   },
   "plugin_list": {
     "filters": "Filters",
diff --git a/locales/pl/common.json b/locales/pl/common.json
index 629244756..62403e385 100644
--- a/locales/pl/common.json
+++ b/locales/pl/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Nie wysłano. Kontrola wymagana przez Twoją organizację nie działa. Spróbuj ponownie za chwilę."
+    "not_running": "Nie wysłano. Kontrola wymagana przez Twoją organizację nie działa. Spróbuj ponownie za chwilę.",
+    "stopped_working": "Nie wysłano. Kontrola wymagana przez Twoją organizację przestała działać. Odśwież stronę. Jeśli to nie pomoże, zgłoś to administratorowi."
   },
   "plugin_list": {
     "filters": "Filtry",
diff --git a/locales/pt/common.json b/locales/pt/common.json
index 56cd5a626..dbc2cfe10 100644
--- a/locales/pt/common.json
+++ b/locales/pt/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Não enviado. Uma verificação exigida pela sua organização não está em execução. Tente novamente daqui a pouco."
+    "not_running": "Não enviado. Uma verificação exigida pela sua organização não está em execução. Tente novamente daqui a pouco.",
+    "stopped_working": "Não enviado. Uma verificação exigida pela sua organização deixou de funcionar. Recarregue a página. Se não resolver, avise o administrador."
   },
   "plugin_list": {
     "filters": "Filtros",
diff --git a/locales/ro/common.json b/locales/ro/common.json
index 47000dcb5..d83177444 100644
--- a/locales/ro/common.json
+++ b/locales/ro/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Nu a fost trimis. O verificare cerută de organizația ta nu rulează. Încearcă din nou peste o clipă."
+    "not_running": "Nu a fost trimis. O verificare cerută de organizația ta nu rulează. Încearcă din nou peste o clipă.",
+    "stopped_working": "Nu a fost trimis. O verificare cerută de organizația ta nu mai funcționează. Reîncarcă pagina. Dacă nu ajută, anunță administratorul."
   },
   "plugin_list": {
     "filters": "Filtre",
diff --git a/locales/ru/common.json b/locales/ru/common.json
index 5d6d20b6e..ad6a4faf0 100644
--- a/locales/ru/common.json
+++ b/locales/ru/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Не отправлено. Проверка, которую требует ваша организация, сейчас не работает. Повторите попытку через минуту."
+    "not_running": "Не отправлено. Проверка, которую требует ваша организация, сейчас не работает. Повторите попытку через минуту.",
+    "stopped_working": "Не отправлено. Проверка, которую требует ваша организация, перестала работать. Перезагрузите страницу. Если это не поможет, сообщите администратору."
   },
   "plugin_list": {
     "filters": "Фильтры",
diff --git a/locales/sk/common.json b/locales/sk/common.json
index 0709c73bc..d1d35ffed 100644
--- a/locales/sk/common.json
+++ b/locales/sk/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Neodoslané. Kontrola, ktorú vyžaduje vaša organizácia, práve nebeží. Skúste to o chvíľu znova."
+    "not_running": "Neodoslané. Kontrola, ktorú vyžaduje vaša organizácia, práve nebeží. Skúste to o chvíľu znova.",
+    "stopped_working": "Neodoslané. Kontrola, ktorú vyžaduje vaša organizácia, prestala fungovať. Načítajte stránku znova. Ak to nepomôže, obráťte sa na správcu."
   },
   "plugin_list": {
     "filters": "Filtre",
diff --git a/locales/th/common.json b/locales/th/common.json
index ae6aa2b6a..cbdb420ee 100644
--- a/locales/th/common.json
+++ b/locales/th/common.json
@@ -2946,7 +2946,8 @@
     }
   },
   "send_guards": {
-    "not_running": "ยังไม่ได้ส่ง การตรวจสอบที่องค์กรของคุณกำหนดไม่ได้ทำงานอยู่ ลองอีกครั้งในอีกสักครู่"
+    "not_running": "ยังไม่ได้ส่ง การตรวจสอบที่องค์กรของคุณกำหนดไม่ได้ทำงานอยู่ ลองอีกครั้งในอีกสักครู่",
+    "stopped_working": "ยังไม่ได้ส่ง การตรวจสอบที่องค์กรของคุณกำหนดหยุดทำงาน โหลดหน้านี้ใหม่ หากยังไม่ได้ผล โปรดแจ้งผู้ดูแลระบบ"
   },
   "plugin_list": {
     "filters": "ตัวกรอง",
diff --git a/locales/tr/common.json b/locales/tr/common.json
index 12bfd09c1..af5d64fed 100644
--- a/locales/tr/common.json
+++ b/locales/tr/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Gönderilmedi. Kuruluşunuzun zorunlu tuttuğu bir denetim şu anda çalışmıyor. Biraz sonra yeniden deneyin."
+    "not_running": "Gönderilmedi. Kuruluşunuzun zorunlu tuttuğu bir denetim şu anda çalışmıyor. Biraz sonra yeniden deneyin.",
+    "stopped_working": "Gönderilmedi. Kuruluşunuzun zorunlu tuttuğu bir denetim çalışmayı durdurdu. Sayfayı yeniden yükleyin. İşe yaramazsa yöneticinize bildirin."
   },
   "plugin_list": {
     "filters": "Filtreler",
diff --git a/locales/uk/common.json b/locales/uk/common.json
index 918367fd7..b6d39f640 100644
--- a/locales/uk/common.json
+++ b/locales/uk/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Не надіслано. Перевірка, якої вимагає ваша організація, зараз не працює. Спробуйте ще раз за мить."
+    "not_running": "Не надіслано. Перевірка, якої вимагає ваша організація, зараз не працює. Спробуйте ще раз за мить.",
+    "stopped_working": "Не надіслано. Перевірка, якої вимагає ваша організація, перестала працювати. Перезавантажте сторінку. Якщо це не допоможе, повідомте адміністратора."
   },
   "plugin_list": {
     "filters": "Фільтри",
diff --git a/locales/vi/common.json b/locales/vi/common.json
index b5dba61d7..b0131c8dd 100644
--- a/locales/vi/common.json
+++ b/locales/vi/common.json
@@ -6014,7 +6014,8 @@
     }
   },
   "send_guards": {
-    "not_running": "Chưa gửi. Một bước kiểm tra mà tổ chức của bạn yêu cầu hiện không chạy. Hãy thử lại sau giây lát."
+    "not_running": "Chưa gửi. Một bước kiểm tra mà tổ chức của bạn yêu cầu hiện không chạy. Hãy thử lại sau giây lát.",
+    "stopped_working": "Chưa gửi. Một bước kiểm tra mà tổ chức của bạn yêu cầu đã ngừng hoạt động. Hãy tải lại trang. Nếu vẫn không được, hãy báo cho quản trị viên."
   },
   "plugin_list": {
     "filters": "Bộ lọc",
diff --git a/locales/zh-TW/common.json b/locales/zh-TW/common.json
index bd463b83c..0c46dc483 100644
--- a/locales/zh-TW/common.json
+++ b/locales/zh-TW/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "未傳送。貴組織要求的一項檢查目前未執行。請稍後再試。"
+    "not_running": "未傳送。貴組織要求的一項檢查目前未執行。請稍後再試。",
+    "stopped_working": "未傳送。貴組織要求的一項檢查已停止運作。請重新載入頁面。如果仍無法解決，請告知管理員。"
   },
   "plugin_list": {
     "filters": "篩選",
diff --git a/locales/zh/common.json b/locales/zh/common.json
index c014c081e..f3575ed12 100644
--- a/locales/zh/common.json
+++ b/locales/zh/common.json
@@ -6002,7 +6002,8 @@
     }
   },
   "send_guards": {
-    "not_running": "未发送。你的组织要求的一项检查当前未运行。请稍后再试。"
+    "not_running": "未发送。你的组织要求的一项检查当前未运行。请稍后再试。",
+    "stopped_working": "未发送。你的组织要求的一项检查已停止工作。请重新加载页面。如果仍不行，请告诉管理员。"
   },
   "plugin_list": {
     "filters": "筛选",
diff --git a/stores/plugin-store.ts b/stores/plugin-store.ts
index 9fb26514c..3ded83644 100644
--- a/stores/plugin-store.ts
+++ b/stores/plugin-store.ts
@@ -50,6 +50,12 @@ export interface InstallResult {
 interface PluginStoreState {
   plugins: InstalledPlugin[];
   initialized: boolean;
+  /**
+   * The admin's plugin list arrived in full this session (every bundle
+   * fetched). Until then a plugin the admin forces on may be missing here
+   * only because it hasn't reached this browser (plugin-send-guards.ts).
+   */
+  serverPluginsSynced: boolean;
 
   // Management
   installPlugin: (file: File) => Promise<InstallResult>;
@@ -132,6 +138,7 @@ export const usePluginStore = create<PluginStoreState>()(
     (set, get) => ({
       plugins: [],
       initialized: false,
+      serverPluginsSynced: false,
 
       installPlugin: async (file: File) => {
         const policy = usePolicyStore.getState();
@@ -580,7 +587,10 @@ async function syncServerPlugins(
   try {
     const res = await fetchServerPluginList();
     if (res.status === 401) return 'signed-out';
-    if (!res.ok) return;
+    if (!res.ok) {
+      set({ serverPluginsSynced: false });
+      return;
+    }
 
     const data = res.data as { plugins: ServerPluginInfo[] };
     if (!data?.plugins || !Array.isArray(data.plugins)) return;
@@ -694,9 +704,12 @@ async function syncServerPlugins(
 
     // Persist current server plugin IDs for future cleanup
     setServerManagedPluginIds(serverPluginIds);
+    // A bundle that couldn't be fetched leaves its plugin out: not in full.
+    set({ serverPluginsSynced: outcomes.every((outcome) => outcome !== null) });
   } catch {
     // Sync failure is non-fatal - client continues with local plugins
     console.warn('[plugin-store] Server plugin sync failed, using local plugins only');
+    set({ serverPluginsSynced: false });
   }
 }
 
@@ -845,10 +858,21 @@ onFullSignOut(() => {
 // (lib/plugin-send-guards.ts). No plugins run in Lite.
 if (!IS_LITE) {
   setSendGuardSource({
-    snapshot: () => ({
-      plugins: usePluginStore.getState().plugins,
-      forced: (plugin) => !!plugin.forceEnabled || usePolicyStore.getState().isPluginForceEnabled(plugin.id),
-    }),
-    subscribe: (listener) => usePluginStore.subscribe(listener),
+    snapshot: () => {
+      const state = usePluginStore.getState();
+      const policy = usePolicyStore.getState();
+      return {
+        plugins: state.plugins,
+        forced: (plugin) => !!plugin.forceEnabled || policy.isPluginForceEnabled(plugin.id),
+        pluginsOff: !policy.isFeatureEnabled('pluginsEnabled'),
+        complete: state.initialized && state.serverPluginsSynced,
+        forcedIds: policy.policy.forceEnabledPlugins ?? [],
+      };
+    },
+    subscribe: (listener) => {
+      const offPlugins = usePluginStore.subscribe(listener);
+      const offPolicy = usePolicyStore.subscribe(listener);
+      return () => { offPlugins(); offPolicy(); };
+    },
   });
 }

From 6b3a220d44d10d05eacf821ff72235592464db72 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 10:06:00 +0100
Subject: [PATCH 11/17] fix: let only a server the admin typed through with no
 third-party traffic

---
 app/api/plugin-proxy/route.ts                 |  9 ++++---
 lib/__tests__/no-third-party-server.test.ts   | 27 ++++++++++++++++++-
 .../plugin-admin-config-secrets.test.ts       | 18 +++++++++++++
 lib/plugin-sandbox/host-api.ts                | 16 +++++++++--
 lib/plugin-secrets/proxy.ts                   | 23 ++++++++++++++--
 5 files changed, 85 insertions(+), 8 deletions(-)

diff --git a/app/api/plugin-proxy/route.ts b/app/api/plugin-proxy/route.ts
index 3bf248e6f..c46f88640 100644
--- a/app/api/plugin-proxy/route.ts
+++ b/app/api/plugin-proxy/route.ts
@@ -6,7 +6,8 @@ import { getStalwartCredentials } from '@/lib/stalwart/credentials';
 import { CREDENTIAL_ID_RE, type CredentialSpec } from '@/lib/plugin-secrets/credentials';
 import { credentialAllowedInMode } from '@/lib/outgoing-hosts';
 import { getPlugin } from '@/lib/admin/plugin-registry';
-import { ProxyError, proxyRequest, type CaptureSpec } from '@/lib/plugin-secrets/proxy';
+import { ProxyError, adminEnteredOrigin, proxyRequest, type CaptureSpec } from '@/lib/plugin-secrets/proxy';
+import { getPluginConfig } from '@/lib/admin/plugin-config';
 import { bootGateResponse } from '@/lib/shared-store/boot-gate';
 
 const PLUGIN_ID_RE = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
@@ -60,13 +61,15 @@ export async function POST(request: NextRequest) {
   if (!PLUGIN_ID_RE.test(pluginId) || !CREDENTIAL_ID_RE.test(credentialId) || !url) {
     return NextResponse.json({ error: 'plugin, credential and url are required', code: 'bad_request' }, { status: 400 });
   }
-  // With third-party traffic off only a server the admin entered on the
+  // With third-party traffic off only a server the admin typed on the
   // plugin's admin page stays reachable (a company link check); servers
-  // fixed in a manifest and accounts users connect are outside hosts (#903).
+  // fixed in a manifest or brought as a field's default, and accounts users
+  // connect, are outside hosts (#903).
   if (thirdPartyOff) {
     const plugin = await getPlugin(pluginId);
     const spec = (plugin as { credentials?: Record<string, CredentialSpec> } | null)?.credentials?.[credentialId];
     if (!credentialAllowedInMode(spec)) return thirdPartyRefusal('The plugin proxy');
+    if (!adminEnteredOrigin(spec, await getPluginConfig(pluginId), plugin?.configSchema)) return thirdPartyRefusal('The plugin proxy');
   }
   const capture = parseCapture(request.headers.get('x-bulwark-capture'));
   if (capture === null) {
diff --git a/lib/__tests__/no-third-party-server.test.ts b/lib/__tests__/no-third-party-server.test.ts
index 67cf93742..4234ef493 100644
--- a/lib/__tests__/no-third-party-server.test.ts
+++ b/lib/__tests__/no-third-party-server.test.ts
@@ -393,13 +393,38 @@ describe('plugins reaching only servers the admin entered', () => {
     const { POST } = await import('@/app/api/plugin-proxy/route');
     await setMode(true, { features: { pluginsEnabled: true } });
     const company = await POST(new NextRequest('https://webmail.example/api/plugin-proxy?plugin=link-check&credential=company&url=https%3A%2F%2Flinkcheck.corp.example%2Fcheck', { method: 'POST' }));
-    expect((await company.clone().json().catch(() => ({}))).code).not.toBe('no-third-party-traffic');
+    expect(company.status).toBe(200);
+    expect(await company.json()).toEqual({ verdict: 'safe' });
+    expect(calledHosts()).toEqual(['linkcheck.corp.example']);
     const google = await POST(new NextRequest('https://webmail.example/api/plugin-proxy?plugin=link-check&credential=google&url=https%3A%2F%2Fsafebrowsing.googleapis.com%2Fv5%2Fhashes%3Asearch', { method: 'POST' }));
     expect(google.status).toBe(403);
     expect((await google.json()).code).toBe('no-third-party-traffic');
     expect(calledHosts()).not.toContain('safebrowsing.googleapis.com');
   });
 
+  // The admin page saves a field's default with the first Save: a plugin
+  // could bring its own collector as the default and reach it in the mode.
+  it("don't count a server the plugin brought as the field's default", async () => {
+    const shipped = {
+      ...linkCheck, id: 'shipped',
+      configSchema: { ...linkCheck.configSchema, endpointUrl: { type: 'string', label: 'URL', default: 'https://collector.example/in' } },
+    };
+    registryPlugins.push(shipped);
+    const { setPluginConfig } = await import('@/lib/admin/plugin-config');
+    await setPluginConfig('shipped', 'endpointUrl', 'https://collector.example/in');
+    const { POST } = await import('@/app/api/plugin-proxy/route');
+    await setMode(true, { features: { pluginsEnabled: true } });
+    const res = await POST(new NextRequest('https://webmail.example/api/plugin-proxy?plugin=shipped&credential=company&url=https%3A%2F%2Fcollector.example%2Fin', { method: 'POST' }));
+    expect(res.status).toBe(403);
+    expect((await res.json()).code).toBe('no-third-party-traffic');
+    expect(fetchMock).not.toHaveBeenCalled();
+    const { adminEnteredOrigins } = await import('@/lib/plugin-secrets/proxy');
+    expect(await adminEnteredOrigins('shipped')).toEqual([]);
+    // The admin types another address: that one is theirs.
+    await setPluginConfig('shipped', 'endpointUrl', 'https://linkcheck.corp.example/check');
+    expect(await adminEnteredOrigins('shipped')).toEqual(['https://linkcheck.corp.example']);
+  });
+
   it('are listed on the Security page with the server the admin entered and the one that stays off', async () => {
     registryPlugins.push(linkCheck, googleOnly);
     const { setPluginConfig } = await import('@/lib/admin/plugin-config');
diff --git a/lib/__tests__/plugin-admin-config-secrets.test.ts b/lib/__tests__/plugin-admin-config-secrets.test.ts
index 1592c86f2..eb137f9d7 100644
--- a/lib/__tests__/plugin-admin-config-secrets.test.ts
+++ b/lib/__tests__/plugin-admin-config-secrets.test.ts
@@ -29,3 +29,21 @@ describe('api.admin config reads', () => {
     for (const url of urls) expect(url).toMatch(/\/api\/admin\/plugins\/external-link-warning\/config\?public=1$/);
   });
 });
+
+// The server a plugin's credential reaches (originKey) is what stays
+// reachable with no third-party traffic: the plugin may not write it.
+describe('api.admin config writes', () => {
+  it("refuse the plugin's own server address fields", async () => {
+    const fetchSpy = vi.fn(async () => new Response('{}'));
+    vi.stubGlobal('fetch', fetchSpy);
+    const withServer = {
+      ...plugin,
+      credentials: { linkcheck: { label: 'x', scope: 'admin', inject: { type: 'bearer' }, secretKey: 'endpointToken', originKey: 'endpointUrl' } },
+    } as unknown as InstalledPlugin;
+    await expect(dispatchApiCall(withServer, 'admin.setConfig', ['endpointUrl', 'https://collector.example/'])).rejects.toThrow(/only an administrator/);
+    await expect(dispatchApiCall(withServer, 'admin.deleteConfig', ['endpointUrl'])).rejects.toThrow(/only an administrator/);
+    expect(fetchSpy).not.toHaveBeenCalled();
+    await dispatchApiCall(withServer, 'admin.setConfig', ['trustedDomains', 'example.com']);
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/lib/plugin-sandbox/host-api.ts b/lib/plugin-sandbox/host-api.ts
index 653005cd6..b72de344c 100644
--- a/lib/plugin-sandbox/host-api.ts
+++ b/lib/plugin-sandbox/host-api.ts
@@ -1944,6 +1944,18 @@ async function adminSet(pluginId: string, key: string, value: unknown): Promise<
   }));
 }
 
+/**
+ * A server address an admin types for a credential (`originKey`) is what
+ * stays reachable with no third-party traffic: the plugin itself may not
+ * write it, or it could point its proxy at a host of its choosing.
+ */
+function refuseServerField(plugin: InstalledPlugin, key: unknown, method: string): void {
+  const serverFields = Object.values(plugin.credentials ?? {}).flatMap((spec) => (spec.scope === 'admin' && spec.originKey ? [spec.originKey] : []));
+  if (typeof key === 'string' && serverFields.includes(key)) {
+    throw new Error(`${method}: "${key}" is a server address only an administrator can set, on the plugin's admin page`);
+  }
+}
+
 /** A failed admin config write used to look like success to the plugin. */
 async function expectOk(method: string, request: Promise<Response>): Promise<void> {
   const res = await request;
@@ -2131,8 +2143,8 @@ export async function dispatchApiCall(
     case 'admin.getConfig':    return adminGet(plugin.id, args[0] as string);
     case 'admin.getAllConfig': return adminGetAll(plugin.id);
     case 'plugin.getConfig':   return publicConfig(plugin.id);
-    case 'admin.setConfig':    await adminSet(plugin.id, args[0] as string, args[1]); return undefined;
-    case 'admin.deleteConfig': await adminDelete(plugin.id, args[0] as string); return undefined;
+    case 'admin.setConfig':    refuseServerField(plugin, args[0], 'admin.setConfig'); await adminSet(plugin.id, args[0] as string, args[1]); return undefined;
+    case 'admin.deleteConfig': refuseServerField(plugin, args[0], 'admin.deleteConfig'); await adminDelete(plugin.id, args[0] as string); return undefined;
 
     case 'ui.confirm': {
       const opts = (args[0] ?? {}) as { title?: string; message?: string; confirmLabel?: string; cancelLabel?: string; danger?: boolean };
diff --git a/lib/plugin-secrets/proxy.ts b/lib/plugin-secrets/proxy.ts
index 7130e0c0d..409649e87 100644
--- a/lib/plugin-secrets/proxy.ts
+++ b/lib/plugin-secrets/proxy.ts
@@ -132,13 +132,32 @@ export async function adminEnteredOrigins(pluginId: string): Promise<string[]> {
   const config = await getPluginConfig(pluginId);
   const out = new Set<string>();
   for (const spec of Object.values(specs)) {
-    if (spec.scope !== 'admin' || !credentialAllowedInMode(spec) || !spec.originKey) continue;
-    const origin = credentialOrigin(config[spec.originKey]);
+    const origin = adminEnteredOrigin(spec, config, plugin.configSchema);
     if (origin) out.add(origin);
   }
   return [...out];
 }
 
+/**
+ * The server an admin typed for a credential (`originKey`), or null: not
+ * an originKey credential, nothing set, or the value the plugin's manifest
+ * brings as the field's default. That one the plugin chose, not the admin
+ * (the admin page saves defaults with the first Save), so with no
+ * third-party traffic it stays off like any server fixed in a manifest.
+ */
+export function adminEnteredOrigin(
+  spec: CredentialSpec | undefined,
+  config: Record<string, unknown>,
+  schema: Record<string, { default?: unknown }> | undefined,
+): string | null {
+  if (!spec || spec.scope !== 'admin' || !credentialAllowedInMode(spec) || !spec.originKey) return null;
+  const value = config[spec.originKey];
+  const origin = credentialOrigin(value);
+  if (!origin) return null;
+  const fallback = credentialOrigin(schema?.[spec.originKey]?.default);
+  return fallback && fallback === origin ? null : origin;
+}
+
 async function adminCredentials(pluginId: string): Promise<{ credentialId: string; origin: string | null }[]> {
   const plugin = await getPlugin(pluginId);
   const specs = (plugin as { credentials?: Record<string, CredentialSpec> } | null)?.credentials;

From 2cd1baa594639e37b4e66b7906fc136cb4a10147 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 10:07:41 +0100
Subject: [PATCH 12/17] feat: let plugin frames run work they can stop in a
 worker

---
 lib/__tests__/proxy-security-headers.test.ts | 11 +++++++++++
 proxy.ts                                     |  4 ++++
 2 files changed, 15 insertions(+)

diff --git a/lib/__tests__/proxy-security-headers.test.ts b/lib/__tests__/proxy-security-headers.test.ts
index 4d1ec7ef3..48201754c 100644
--- a/lib/__tests__/proxy-security-headers.test.ts
+++ b/lib/__tests__/proxy-security-headers.test.ts
@@ -181,6 +181,17 @@ describe('frame-ancestors of the mail UI', () => {
     else process.env.ALLOWED_FRAME_ANCESTORS = original;
   });
 
+  // Send checks run the admin's patterns in a worker they can stop; only
+  // plugin frames get it, the app keeps its script-src fallback.
+  it('lets plugin frames, and only them, start workers from blobs', async () => {
+    vi.mocked(configManager.getPolicy).mockReturnValueOnce({ features: { pluginsEnabled: true } } as never);
+    const frame = await proxy(new NextRequest('http://localhost:3000/plugin-sandbox', {
+      headers: { 'sec-fetch-dest': 'iframe', 'sec-fetch-mode': 'navigate', 'sec-fetch-site': 'same-origin' },
+    }));
+    expect(frame.headers.get('content-security-policy')).toContain("worker-src 'self' blob:");
+    expect((await load('/en/mail/folder/inbox')).headers.get('content-security-policy')).not.toContain('worker-src');
+  });
+
   it('allows only the app itself by default', async () => {
     delete process.env.ALLOWED_FRAME_ANCESTORS;
     const res = await load('/en/mail/folder/inbox');
diff --git a/proxy.ts b/proxy.ts
index 6660020bd..b539c4d5a 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -420,6 +420,10 @@ export async function proxy(request: NextRequest) {
     isSandboxPath ? `form-action 'none'` : `form-action ${["'self'", ...wopiOrigins].join(" ")}`,
     `frame-ancestors ${frameAncestors}`,
     `media-src ${mediaSrc}`,
+    // A plugin frame may run work it has to stop at a deadline (send checks'
+    // admin patterns) in a worker made from a blob; it gets the frame's own
+    // connect-src, so it reaches nothing the frame can't.
+    ...(isSandboxPath ? [`worker-src 'self' blob:`] : []),
   ].join("; ");
 
   // Skip intl middleware for routes outside the localized app tree.

From 27e4f0cbac119c5c4aaa1b55a653b6bbe78323ad Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 10:09:20 +0100
Subject: [PATCH 13/17] test: cover the file type the composer tells upload
 checks

---
 .../composer-send-check-payload.test.tsx      | 27 ++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/components/email/__tests__/composer-send-check-payload.test.tsx b/components/email/__tests__/composer-send-check-payload.test.tsx
index 4a0484412..ca7c7dc72 100644
--- a/components/email/__tests__/composer-send-check-payload.test.tsx
+++ b/components/email/__tests__/composer-send-check-payload.test.tsx
@@ -20,7 +20,7 @@ const signaturePlugin = vi.hoisted(() => ({ on: false }));
 // Send plugins: a footer added by onTransformOutgoingEmail, and a crypto
 // plugin taking the send over (onComposeSend).
 // What a send check plugin (onBeforeEmailSend) was handed.
-const sendChecks = vi.hoisted(() => ({ seen: [] as unknown[], size: 1, answers: [] as string[] }));
+const sendChecks = vi.hoisted(() => ({ seen: [] as unknown[], size: 1, answers: [] as string[], uploads: [] as unknown[] }));
 const sendPlugins = vi.hoisted(() => ({
   footer: false,
   addBcc: '' as string,
@@ -206,6 +206,10 @@ vi.mock('@/lib/plugin-hooks', () => ({
       intercept: async () => true,
       interceptOutcome: async (email: unknown) => { sendChecks.seen.push(email); return sendChecks.answers.shift() ?? 'allowed'; },
     },
+    onBeforeAttachmentUpload: {
+      size: 1,
+      intercept: async (info: unknown) => { sendChecks.uploads.push(info); return false; },
+    },
     onComposeSend: {
       takeOver: async (request: { htmlBody: string; textBody: string }) => {
         if (!sendPlugins.takeOver) return 'default';
@@ -402,3 +406,24 @@ describe('composer: recipients a plugin adds after the check', () => {
     expect(sendChecks.seen).toHaveLength(1);
   });
 });
+
+// A renamed program is refused before it is uploaded: the plugin learns
+// what the file's first bytes say, not only its name.
+describe('composer: attaching a file from this device', () => {
+  it('tells onBeforeAttachmentUpload what the file really is', async () => {
+    const { useAuthStore } = await import('@/stores/auth-store');
+    // Any client method answers "nothing": only the hook matters here.
+    useAuthStore.setState({ client: new Proxy({}, { get: () => () => undefined }) as never });
+    try {
+      sendChecks.uploads = [];
+      render(<EmailComposer initialData={DRAFT} onSend={vi.fn()} />);
+      const input = document.querySelector('input[type="file"]') as HTMLInputElement;
+      const program = new File([new Uint8Array([0x4d, 0x5a, 0x90, 0, 3, 0])], 'invoice.pdf', { type: 'application/pdf' });
+      fireEvent.change(input, { target: { files: [program] } });
+      await waitFor(() => expect(sendChecks.uploads).toHaveLength(1));
+      expect(sendChecks.uploads[0]).toEqual({ name: 'invoice.pdf', type: 'application/pdf', size: 6, sniffedType: 'application/x-msdownload' });
+    } finally {
+      useAuthStore.setState({ client: null } as never);
+    }
+  });
+});

From b9630959b91e38da32c48ce162bdc6807e5edab2 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 10:12:49 +0100
Subject: [PATCH 14/17] test: cover blocked links, held sends and admin-page
 rules, and wait on conditions instead of clocks

---
 integration/tests/22-ent-plugins.spec.ts | 184 +++++++++++++++++++----
 1 file changed, 151 insertions(+), 33 deletions(-)

diff --git a/integration/tests/22-ent-plugins.spec.ts b/integration/tests/22-ent-plugins.spec.ts
index 8d597fac2..6532de880 100644
--- a/integration/tests/22-ent-plugins.spec.ts
+++ b/integration/tests/22-ent-plugins.spec.ts
@@ -25,14 +25,22 @@ import {
  *   blocked rule, ignores internal recipients for an external-only rule
  *   (with an organisation domain set in a group scope only), refuses a
  *   disallowed attachment type, and runs on quick reply too;
- * - both dialogs at 390 px, and the send-checks admin page.
+ *   (an unsafe verdict also blocks when the admin says so);
+ * - item 5 also: sending is held while the required check isn't running, and
+ *   a rule the admin changes on the plugin's admin page applies;
+ * - both dialogs at 390 px.
  *
  * Both plugins are installed from the local builds of the plugins worktree
- * (IT_PLUGINS_DIR) through the admin API and removed at the end. The server
- * must run with PLUGIN_PROXY_PRIVATE_ORIGINS=http://127.0.0.1:3195 (the
- * mock is plain HTTP on this PC) and NEXT_PUBLIC_APP_VERSION=1.20.0 (both
- * plugins need 1.20.0). No request goes to Google: the lookup mode is
- * "endpoint", the Safe Browsing key is a fake.
+ * (IT_PLUGINS_DIR) through the admin API and removed at the end. No request
+ * goes to Google: the lookup mode is "endpoint", the Safe Browsing key is a
+ * fake, so the Google verdict dialog is covered by the plugin's unit tests.
+ *
+ * The rig, from one shell (the spec checks both variables and stops early):
+ *
+ *   export PLUGIN_PROXY_PRIVATE_ORIGINS=http://127.0.0.1:3195   # the mock is plain HTTP on this PC
+ *   export NEXT_PUBLIC_APP_VERSION=1.20.0                       # both plugins need 1.20.0; VERSION says 1.19.1
+ *   BUILD=1 bash enterprise-rig/start-prod.sh <worktree> 3105 <jmap-url> e-1.0
+ *   bash enterprise-rig/run-spec.sh <worktree> 3105 <jmap-url> 1.0 integration/tests/22-ent-plugins.spec.ts
  */
 
 test.describe.configure({ mode: 'serial' });
@@ -49,6 +57,10 @@ const RUN = Date.now().toString(36);
 const LINK_HOST = 'ent-link.example.org';
 
 let original: Record<string, unknown>;
+/** The policy as it was before this spec, put back untouched at the end. */
+let untouched: Record<string, unknown> | undefined;
+/** No third-party traffic as it was before this spec. */
+let modeBefore: boolean | undefined;
 let mock: Server;
 const endpoint = { up: true, requests: [] as { url: string; host: string; auth: string }[] };
 
@@ -59,7 +71,23 @@ async function installPlugin(admin: BrowserContext, id: string, zip: string): Pr
   const installed = await admin.request.post('/api/admin/plugins', {
     multipart: { file: { name: `${id}.zip`, mimeType: 'application/zip', buffer: readFileSync(zip) } },
   });
-  expect(installed.ok(), await installed.text()).toBe(true);
+  const text = await installed.text();
+  if (/Needs Bulwark 1\.20\.0/.test(text)) {
+    throw new Error(`${id} needs Bulwark 1.20.0: build and start the server with NEXT_PUBLIC_APP_VERSION=1.20.0 (see the header of this spec)`);
+  }
+  expect(installed.ok(), text).toBe(true);
+}
+
+/** The rig variables the server needs; the same shell starts the server and this spec. */
+function requireRigEnv(): void {
+  const origins = process.env.PLUGIN_PROXY_PRIVATE_ORIGINS ?? '';
+  const missing = [
+    ...(origins.split(',').map((o) => o.trim()).includes(`http://127.0.0.1:${MOCK_PORT}`) ? [] : [`PLUGIN_PROXY_PRIVATE_ORIGINS=http://127.0.0.1:${MOCK_PORT}`]),
+    ...(process.env.NEXT_PUBLIC_APP_VERSION === '1.20.0' ? [] : ['NEXT_PUBLIC_APP_VERSION=1.20.0']),
+  ];
+  if (missing.length) {
+    throw new Error(`Set ${missing.join(' and ')} in the shell that builds and starts the server and runs this spec (see the header of this spec)`);
+  }
 }
 
 async function setConfig(browser: Browser, id: string, values: Record<string, unknown>): Promise<void> {
@@ -105,10 +133,13 @@ function startMock(): Promise<Server> {
 test.beforeAll(async ({ browser }) => {
   test.setTimeout(300_000);
   requireEntEnv();
+  requireRigEnv();
   test.skip(!existsSync(LINK_ZIP) || !existsSync(SEND_ZIP), `build the plugins first: ${LINK_ZIP}, ${SEND_ZIP}`);
   mock = await startMock();
   const admin = await adminContext(browser);
   original = await getPolicy(admin);
+  untouched = structuredClone(original);
+  modeBefore = (await (await admin.request.get('/api/admin/outgoing-hosts')).json()).noThirdPartyTraffic === true;
   await admin.request.get('/plugin-sandbox', { timeout: 120_000 });
   await installPlugin(admin, LINK, LINK_ZIP);
   await installPlugin(admin, SEND, SEND_ZIP);
@@ -148,11 +179,10 @@ test.afterAll(async ({ browser }) => {
     const ids = r.methodResponses?.[0]?.[1]?.ids ?? [];
     if (ids.length) await client.request([['Email/set', { accountId: client.accountId, destroy: ids }, '0']]).catch(() => {});
   }
-  if (!original) return;
+  if (!untouched) return;
   const admin = await adminContext(browser);
-  const forced = ((original.forceEnabledPlugins as string[] | undefined) ?? []).filter((id) => id !== LINK && id !== SEND);
-  await putPolicy(admin, { ...original, forceEnabledPlugins: forced });
-  await admin.request.patch('/api/admin/config', { data: { noThirdPartyTraffic: false } }).catch(() => {});
+  await putPolicy(admin, untouched);
+  if (modeBefore !== undefined) await admin.request.patch('/api/admin/config', { data: { noThirdPartyTraffic: modeBefore } }).catch(() => {});
   await admin.request.delete('/api/admin/plugins', { data: { id: LINK } });
   await admin.request.delete('/api/admin/plugins', { data: { id: SEND } });
   await admin.close();
@@ -177,16 +207,26 @@ async function waitForMessage(account: string, subject: string, timeoutMs = 60_0
   }
 }
 
-/** Nothing with `subject` arrived within a few seconds. */
-async function expectNotSent(account: string, subject: string): Promise<void> {
-  await new Promise((r) => setTimeout(r, 4000));
-  expect((await messages(account, RUN)).filter((m) => m.subject === subject)).toEqual([]);
+/**
+ * Exactly one message with `subject` arrived: the send that was stopped
+ * earlier went nowhere, and the one let through after it did. The later
+ * send is the fence, so nothing waits on a clock.
+ */
+async function expectSentOnce(account: string, subject: string): Promise<void> {
+  await waitForMessage(account, subject);
+  expect((await messages(account, RUN)).filter((m) => m.subject === subject)).toHaveLength(1);
 }
 
-/** Both plugins started: their background frames are there, and a moment for init. */
+/** Both plugins started: the host notes the hooks of every plugin once it has started it. */
 async function pluginsReady(page: Page): Promise<void> {
-  await expect(page.locator('iframe[src*="/plugin-sandbox"]')).toHaveCount(2, { timeout: 60_000 });
-  await page.waitForTimeout(1500);
+  await page.waitForFunction((ids) => ids.every((id) => localStorage.getItem(`plugin-declared-hooks:${id}`)), [LINK, SEND], { timeout: 60_000 });
+}
+
+async function clearBody(page: Page): Promise<void> {
+  const editor = page.locator('[data-testid="email-composer"] [contenteditable="true"]').first();
+  await editor.click();
+  await page.keyboard.press('Control+A');
+  await page.keyboard.press('Delete');
 }
 
 async function openMessage(page: Page, subject: string): Promise<void> {
@@ -405,12 +445,12 @@ test('item 5: an IBAN and a card number warn, masked; Go back keeps the mail, Se
   await shot(alice, 'e-send-warn');
   await dialog.getByRole('button', { name: 'Go back' }).click();
   await expect(alice.locator('[data-testid="email-composer"]')).toBeVisible();
-  await expectNotSent(ENT.bob, subject);
 
   await pressSend(alice);
   await expect(dialog).toContainText('Check before sending', { timeout: 20_000 });
   await dialog.getByRole('button', { name: 'Send anyway' }).click();
-  await waitForMessage(ENT.bob, subject);
+  // One message: Go back sent nothing.
+  await expectSentOnce(ENT.bob, subject);
   await alice.context().close();
 });
 
@@ -427,37 +467,67 @@ test('item 5: a block rule stops the send', async ({ browser }) => {
   await shot(alice, 'e-send-block');
   await alice.keyboard.press('Escape');
   await expect(alice.locator('[data-testid="email-composer"]')).toBeVisible();
-  await expectNotSent(ENT.bob, subject);
+  // Without the word it goes, once: the blocked send went nowhere.
+  await clearBody(alice);
+  await alice.keyboard.type('Nothing secret here.');
+  await pressSend(alice);
+  await expectSentOnce(ENT.bob, subject);
   await alice.context().close();
 });
 
+test('item 4: an unsafe verdict blocks the link when the admin says so', async ({ browser }) => {
+  const subject = `Links block ${RUN}`;
+  await deliverLinks(subject);
+  await setConfig(browser, LINK, { onUnsafe: 'block' });
+  try {
+    const alice = await userPage(browser, ENT.alice);
+    await routeLinks(alice.context());
+    await pluginsReady(alice);
+    await openMessage(alice, subject);
+    await body(alice).getByRole('link', { name: 'https://bank.example.com/login' }).click();
+    const dialog = linkDialog(alice);
+    await expect(dialog).toContainText('Link blocked', { timeout: 20_000 });
+    await expect(dialog).toContainText(`bad.${LINK_HOST}`);
+    await expect(dialog.getByRole('button', { name: 'Open anyway' })).toHaveCount(0);
+    await shot(alice, 'e-link-blocked');
+    await dialog.getByRole('button', { name: 'Close' }).click();
+    expect(alice.context().pages()).toHaveLength(1);
+    await alice.context().close();
+  } finally {
+    await setConfig(browser, LINK, { onUnsafe: 'warn' });
+  }
+});
+
 test('item 5: an external-only rule ignores internal recipients, with the domain from a group scope for its members only', async ({ browser }) => {
   await setConfig(browser, SEND, { ibanExternalOnly: true });
-  // partner.example.net is internal for ent-team (ent-alice) only.
+  // partner.invalid is internal for ent-team (ent-alice) only. An .invalid
+  // domain: the copy the server tries to deliver there goes nowhere real.
   await setPolicy(browser, {
-    scopes: [{ id: 'ent-e-partner', label: 'Partner', match: { groups: [ENT.team] }, policy: { organisation: { externalMail: { domains: ['partner.example.net'] } } } }],
+    scopes: [{ id: 'ent-e-partner', label: 'Partner', match: { groups: [ENT.team] }, policy: { organisation: { externalMail: { domains: ['partner.invalid'] } } } }],
   });
   try {
     const internal = `Send internal ${RUN}`;
     const alice = await userPage(browser, ENT.alice);
     await pluginsReady(alice);
-    await compose(alice, [ENT.bob, 'someone@partner.example.net'], internal, `IBAN ${IBAN}`);
+    await compose(alice, [ENT.bob, 'someone@partner.invalid'], internal, `IBAN ${IBAN}`);
     await pressSend(alice);
     await waitForMessage(ENT.bob, internal);
     await expect(sendDialog(alice)).toHaveCount(0);
     await alice.context().close();
 
-    // ent-carol is in no group: partner.example.net is outside for her.
+    // ent-carol is in no group: partner.invalid is outside for her.
     const outside = `Send outside ${RUN}`;
     const carol = await userPage(browser, ENT.carol);
     await pluginsReady(carol);
-    await compose(carol, [ENT.bob, 'someone@partner.example.net'], outside, `IBAN ${IBAN}`);
+    await compose(carol, [ENT.bob, 'someone@partner.invalid'], outside, `IBAN ${IBAN}`);
     await pressSend(carol);
     const dialog = sendDialog(carol);
     await expect(dialog).toContainText('IBAN DE89', { timeout: 20_000 });
     await expect(dialog).toContainText('goes outside your organisation');
     await dialog.getByRole('button', { name: 'Go back' }).click();
-    await expectNotSent(ENT.bob, outside);
+    await pressSend(carol);
+    await sendDialog(carol).getByRole('button', { name: 'Send anyway' }).click();
+    await expectSentOnce(ENT.bob, outside);
     await carol.context().close();
   } finally {
     await setConfig(browser, SEND, { ibanExternalOnly: false });
@@ -469,7 +539,7 @@ test('item 5: a program is refused as an attachment, also renamed to .pdf', asyn
   const alice = await userPage(browser, ENT.alice);
   await pluginsReady(alice);
   await compose(alice, [ENT.bob], `Send attachment ${RUN}`, 'See the file.');
-  const program = Buffer.concat([Buffer.from('MZ'), Buffer.alloc(200, 0x90)]);
+  const program = Buffer.concat([Buffer.from('MZ'), Buffer.from([0x90, 0, 3, 0, 0, 0, 4, 0]), Buffer.alloc(200, 0)]);
   const input = alice.locator('[data-testid="email-composer"] input[type="file"]').first();
   await input.setInputFiles({ name: 'tool.exe', mimeType: 'application/octet-stream', buffer: program });
   const dialog = sendDialog(alice);
@@ -500,9 +570,13 @@ test('item 5: a quick reply is checked too', async ({ browser }) => {
   const dialog = sendDialog(alice);
   await expect(dialog).toContainText('IBAN DE89', { timeout: 20_000 });
   await dialog.getByRole('button', { name: 'Go back' }).click();
-  // The typed text stays, nothing went out.
+  // The typed text stays.
   await expect(box).toHaveValue(`To ${IBAN} please`);
-  await expectNotSent(ENT.bob, `Re: ${subject}`);
+  await box.fill('I will pay by card in person.');
+  await box.press('Control+Enter');
+  await expect(box).toHaveValue('', { timeout: 30_000 });
+  // One reply: the stopped one went nowhere.
+  await expectSentOnce(ENT.bob, `Re: ${subject}`);
   await alice.context().close();
 });
 
@@ -530,13 +604,57 @@ test('item 5: the send dialog fits at 390 px', async ({ browser }) => {
   await alice.context().close();
 });
 
-test('item 5: the admin sets the rules on the plugin page', async ({ browser }) => {
+test('item 5: a keyword the admin adds on the plugin page warns at the next send', async ({ browser }) => {
+  const word = `Projekt-${RUN}`;
   const admin = await adminContext(browser);
   const page = await admin.newPage();
   await page.goto(`/admin/plugins/${SEND}`);
   await expect(page.getByText('IBANs', { exact: true }).first()).toBeVisible({ timeout: 30_000 });
-  await expect(page.getByText('Payment card numbers', { exact: true }).first()).toBeVisible();
-  await expect(page.getByText('Blocked file types', { exact: true }).first()).toBeVisible();
+  const keywords = page.getByRole('textbox', { name: 'Keywords', exact: true });
+  await keywords.fill(`TOPSECRET-${RUN}\n${word}`);
+  await page.getByRole('button', { name: 'Save', exact: true }).click();
+  await expect.poll(async () => {
+    const res = await admin.request.get(`/api/admin/plugins/${SEND}/config?public=1`);
+    return String((await res.json()).keywords ?? '');
+  }, { timeout: 20_000 }).toContain(word);
   await shot(page, 'e-send-admin');
   await admin.close();
+
+  const subject = `Send admin keyword ${RUN}`;
+  const alice = await userPage(browser, ENT.alice);
+  await pluginsReady(alice);
+  await compose(alice, [ENT.bob], subject, `About ${word}.`);
+  await pressSend(alice);
+  // TOPSECRET is a block rule; the new word is on the same list, so it blocks too.
+  await expect(sendDialog(alice)).toContainText(word, { timeout: 20_000 });
+  await alice.keyboard.press('Escape');
+  await alice.context().close();
+  await setConfig(browser, SEND, { keywords: `TOPSECRET-${RUN}` });
+});
+
+// A required send check that never started used to let every message through.
+test('item 5: sending is held while the required check isn't running', async ({ browser }) => {
+  const subject = `Send held ${RUN}`;
+  const alice = await userPage(browser, ENT.alice);
+  await pluginsReady(alice);
+  // From now on the plugin frames can't load: the next start of the plugins fails.
+  await alice.context().route('**/plugin-sandbox**', (route) => route.abort());
+  await alice.reload();
+  await expect(alice.locator('[data-testid="email-list-item"]').first()).toBeVisible({ timeout: 60_000 });
+  await compose(alice, [ENT.bob], subject, 'Nothing to check here.');
+  await pressSend(alice);
+  // First it waits for the check, then says it isn't running; once the start
+  // has failed for good it says it stopped working.
+  await expect(alice.getByText(/A check your organisation requires (isn't running|has stopped working)/).first()).toBeVisible({ timeout: 45_000 });
+  await expect(alice.locator('[data-testid="email-composer"]')).toBeVisible();
+  await shot(alice, 'e-send-held');
+  // With the plugins running again the same message goes, once: the held
+  // send went nowhere.
+  await alice.context().unroute('**/plugin-sandbox**');
+  await alice.reload();
+  await pluginsReady(alice);
+  await compose(alice, [ENT.bob], subject, 'Nothing to check here.');
+  await pressSend(alice);
+  await expectSentOnce(ENT.bob, subject);
+  await alice.context().close();
 });

From 0a319cde2ec265664f4880a62ed609a88360cdb8 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 10:15:22 +0100
Subject: [PATCH 15/17] test: fix the quote in a spec title

---
 integration/tests/22-ent-plugins.spec.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/integration/tests/22-ent-plugins.spec.ts b/integration/tests/22-ent-plugins.spec.ts
index 6532de880..557eb91e2 100644
--- a/integration/tests/22-ent-plugins.spec.ts
+++ b/integration/tests/22-ent-plugins.spec.ts
@@ -633,7 +633,7 @@ test('item 5: a keyword the admin adds on the plugin page warns at the next send
 });
 
 // A required send check that never started used to let every message through.
-test('item 5: sending is held while the required check isn't running', async ({ browser }) => {
+test("item 5: sending is held while the required check isn't running", async ({ browser }) => {
   const subject = `Send held ${RUN}`;
   const alice = await userPage(browser, ENT.alice);
   await pluginsReady(alice);

From bb29d919e6b53a42d745a81f1c26b32f89af6192 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 10:24:37 +0100
Subject: [PATCH 16/17] docs: say link checks get the address the browser opens

---
 lib/plugin-types.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/plugin-types.ts b/lib/plugin-types.ts
index cd4303f2c..7ed094b70 100644
--- a/lib/plugin-types.ts
+++ b/lib/plugin-types.ts
@@ -1277,6 +1277,10 @@ export interface AttachmentPreview {
  * Return false to cancel the navigation. Mutate `href` to rewrite it.
  */
 export interface ExternalLinkContext {
+  /**
+   * The address as the browser parses it (`new URL(href).href`, Bulwark
+   * 1.20 and later); exactly this string opens.
+   */
   href: string;
   /** Anchor target ('_blank', '_self', etc.) when set */
   target?: string;

From 5b50a2339095d8abb1cb0cdbdbe1c97f719914ae Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sun, 1 Nov 2026 10:38:32 +0100
Subject: [PATCH 17/17] test: wait for the message list and a finished Go back
 before sending in the plugin spec

---
 integration/tests/22-ent-plugins.spec.ts | 27 ++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/integration/tests/22-ent-plugins.spec.ts b/integration/tests/22-ent-plugins.spec.ts
index 557eb91e2..0af280d33 100644
--- a/integration/tests/22-ent-plugins.spec.ts
+++ b/integration/tests/22-ent-plugins.spec.ts
@@ -217,9 +217,14 @@ async function expectSentOnce(account: string, subject: string): Promise<void> {
   expect((await messages(account, RUN)).filter((m) => m.subject === subject)).toHaveLength(1);
 }
 
-/** Both plugins started: the host notes the hooks of every plugin once it has started it. */
+/**
+ * Both plugins started (the host notes the hooks of every plugin once it
+ * has started it) and the message list is there, so the start-up requests
+ * are done before the test sends anything.
+ */
 async function pluginsReady(page: Page): Promise<void> {
   await page.waitForFunction((ids) => ids.every((id) => localStorage.getItem(`plugin-declared-hooks:${id}`)), [LINK, SEND], { timeout: 60_000 });
+  await expect(page.locator('[data-testid="email-list-item"]').first()).toBeVisible({ timeout: 60_000 });
 }
 
 async function clearBody(page: Page): Promise<void> {
@@ -277,10 +282,20 @@ async function compose(page: Page, to: string[], subject: string, text: string):
 }
 
 async function pressSend(page: Page): Promise<void> {
+  // A send still winding down after a "Go back" ignores another one.
+  await expect(page.getByTestId('composer-send').first()).toBeEnabled({ timeout: 20_000 });
   await page.locator('[data-testid="composer-subject"]').first().focus();
   await page.keyboard.press('Control+Enter');
 }
 
+/** "Go back" in the send check's warning: it closes and the composer is ready again. */
+async function goBack(page: Page): Promise<void> {
+  const dialog = page.locator(`[data-plugin-dialog="${SEND}"]`);
+  await dialog.getByRole('button', { name: 'Go back' }).click();
+  await expect(dialog).toBeHidden();
+  await expect(page.getByText('Message not sent').first()).toBeVisible({ timeout: 20_000 });
+}
+
 const IBAN = 'DE89 3704 0044 0532 0130 00';
 const CARD = '4242 4242 4242 4242';
 
@@ -443,7 +458,7 @@ test('item 5: an IBAN and a card number warn, masked; Go back keeps the mail, Se
   await expect(dialog).not.toContainText('0532 0130');
   await expect(dialog).not.toContainText(CARD);
   await shot(alice, 'e-send-warn');
-  await dialog.getByRole('button', { name: 'Go back' }).click();
+  await goBack(alice);
   await expect(alice.locator('[data-testid="email-composer"]')).toBeVisible();
 
   await pressSend(alice);
@@ -524,7 +539,7 @@ test('item 5: an external-only rule ignores internal recipients, with the domain
     const dialog = sendDialog(carol);
     await expect(dialog).toContainText('IBAN DE89', { timeout: 20_000 });
     await expect(dialog).toContainText('goes outside your organisation');
-    await dialog.getByRole('button', { name: 'Go back' }).click();
+    await goBack(carol);
     await pressSend(carol);
     await sendDialog(carol).getByRole('button', { name: 'Send anyway' }).click();
     await expectSentOnce(ENT.bob, outside);
@@ -569,7 +584,7 @@ test('item 5: a quick reply is checked too', async ({ browser }) => {
   await box.press('Control+Enter');
   const dialog = sendDialog(alice);
   await expect(dialog).toContainText('IBAN DE89', { timeout: 20_000 });
-  await dialog.getByRole('button', { name: 'Go back' }).click();
+  await goBack(alice);
   // The typed text stays.
   await expect(box).toHaveValue(`To ${IBAN} please`);
   await box.fill('I will pay by card in person.');
@@ -600,7 +615,7 @@ test('item 5: the send dialog fits at 390 px', async ({ browser }) => {
   expect(box!.x + box!.width).toBeLessThanOrEqual(390);
   expect(await alice.evaluate(() => document.documentElement.scrollWidth - window.innerWidth)).toBeLessThanOrEqual(0);
   await shot(alice, 'e-send-phone');
-  await dialog.getByRole('button', { name: 'Go back' }).click();
+  await goBack(alice);
   await alice.context().close();
 });
 
@@ -614,7 +629,7 @@ test('item 5: a keyword the admin adds on the plugin page warns at the next send
   await keywords.fill(`TOPSECRET-${RUN}\n${word}`);
   await page.getByRole('button', { name: 'Save', exact: true }).click();
   await expect.poll(async () => {
-    const res = await admin.request.get(`/api/admin/plugins/${SEND}/config?public=1`);
+    const res = await admin.request.get(`/api/admin/plugins/${SEND}/config`);
     return String((await res.json()).keywords ?? '');
   }, { timeout: 20_000 }).toContain(word);
   await shot(page, 'e-send-admin');