Attachment.cid may still carry RFC angle brackets while body `src="cid:...`
references never do. The viewers already stripped them before matching;
the reply/forward inline-image hydration didn't, so the match silently
failed and the image stayed a blank placeholder in compose and never made
it into the outgoing message. Extracted the stripping into a shared
normalizeCid() and applied it everywhere cids get compared.
Some senders ship the images their HTML body embeds via cid: as
application/octet-stream with no Content-Disposition and no filename.
The body rendered them fine, but the "hide inline images" check only
recognised parts declared inline with an image/* type, so they also
showed up as nameless "Attachment" chips next to the real files.
Both viewers now scan the HTML they actually render for cid: references
(the same pattern the renderer rewrites to blob URLs) and hide a
referenced part when it is an image or generically typed. An explicit
attachment disposition always keeps its chip, as does a referenced part
with a real non-image type, since that chip is its only download. Plain
text rendering references nothing, so nothing is hidden there. The
shared rule lives in lib/attachment-visibility.ts so the desktop viewer,
the thread view and the decrypted-message path cannot drift apart.
Linus Rath
Aaron Guise
dealerweb