@agenticmail/api 0.7.15 → 0.7.16

package/README.md

@@ -8,7 +8,14 @@ The API server for [AgenticMail](https://github.com/agenticmail/agenticmail) —
 
 This package runs a web server that handles everything: sending email and SMS, reading inboxes, managing agents, phone number access, real-time notifications, inter-agent messaging, spam filtering, outbound security scanning, and gateway configuration. Every feature in AgenticMail is accessible through this API.
 
-## ✨ What's new in 0.7.9
+## ✨ What's new in 0.7.16
+
+- **📐 Typed task contracts** — `POST /tasks/assign` and the long-poll `POST /tasks/rpc` accept an optional `outputSchema` field (JSON Schema, draft-7 subset). The schema is persisted on the task row via migration `014_task_output_schema.sql` and is rendered into the worker's wake prompt. `POST /tasks/:id/result` validates against the schema before accepting; mismatches return **400** with a flat `schemaErrors: [{ path, message }]` list. Validator lives at `src/lib/schema-validator.ts` (hand-rolled, no `ajv` dep) and supports `type`, `required`, `properties`, `items`, `enum`, `additionalProperties: false`, `minLength`/`maxLength`, `minimum`/`maximum`. Tasks without a schema keep the v0.8.x behaviour — fully back-compat.
+- **⭐ Star endpoint** — `POST /mail/messages/:uid/star` with `{ starred: boolean, folder?: string }`. Maps to IMAP's `\Flagged` flag — same on-disk bit Gmail's star uses.
+- **📥 Long-running worker visibility** — `POST /dispatcher/worker-heartbeat`, `GET /dispatcher/worker-log/:id`. Combined with the dropped 30-min `active` TTL, workers can run for hours; staleness is a flag, not an eviction trigger.
+- **🌐 Web UI** under `packages/api/public/` — Gmail two-column layout, official Claude + AgenticMail logos, hash router (`#/folder/<id>`, `#/m/<uid>`), folder auto-discovery (works on Stalwart / Gmail / Outlook / macOS Mail conventions), 2-line preview rows, mobile-responsive sidebar, draft autosave, vector icon library.
+
+## ✨ Earlier — 0.7.9
 
 - **🌐 Gmail-style web UI, fully redesigned** — `packages/api/public/` ships a proper two-column Gmail layout (sidebar with Compose + folders / content pane) served by `express.static` at the API root. Every emoji replaced with an inline 24×24 vector icon library (`public/js/icons.js`). HTML shell + dedicated `styles.css` + 14 modular ES module JS files under `public/js/`. Hash router (`#/inbox`, `#/m/<uid>`), search with `from:` / `subject:` operators, real-time SSE updates, browser notifications. Run via `agenticmail web` from the CLI.
 - **Wake allowlist on `POST /mail/send`** — accept a `wake` parameter (array of agent names or comma-separated string). The API normalises it, sets an `X-AgenticMail-Wake` header on the outgoing SMTP envelope, AND surfaces it as `wakeAllowlist` on the SSE event so the dispatcher can decide which CC'd recipients to actually give a Claude turn.

package/dist/index.js

@@ -3147,12 +3147,120 @@ function createGatewayRoutes(gatewayManager) {
 import { Router as Router10 } from "express";
 import { v4 as uuidv43 } from "uuid";
 import { MailSender as MailSender4 } from "@agenticmail/core";
+
+// src/lib/schema-validator.ts
+function validate(value, schema, path = "") {
+  const errors = [];
+  if (!schema || typeof schema !== "object") return errors;
+  if (schema.type !== void 0) {
+    const types = Array.isArray(schema.type) ? schema.type : [schema.type];
+    if (!types.some((t) => matchesType(value, t))) {
+      errors.push({ path: path || "(root)", message: `expected type ${types.join("|")}, got ${jsType(value)}` });
+      return errors;
+    }
+  }
+  if (schema.enum && Array.isArray(schema.enum)) {
+    if (!schema.enum.some((e) => deepEqual(e, value))) {
+      errors.push({ path: path || "(root)", message: `value not in enum [${schema.enum.map((e) => JSON.stringify(e)).join(", ")}]` });
+    }
+  }
+  if (typeof value === "string") {
+    if (schema.minLength !== void 0 && value.length < schema.minLength) {
+      errors.push({ path: path || "(root)", message: `string shorter than minLength ${schema.minLength}` });
+    }
+    if (schema.maxLength !== void 0 && value.length > schema.maxLength) {
+      errors.push({ path: path || "(root)", message: `string longer than maxLength ${schema.maxLength}` });
+    }
+  }
+  if (typeof value === "number") {
+    if (schema.minimum !== void 0 && value < schema.minimum) {
+      errors.push({ path: path || "(root)", message: `value below minimum ${schema.minimum}` });
+    }
+    if (schema.maximum !== void 0 && value > schema.maximum) {
+      errors.push({ path: path || "(root)", message: `value above maximum ${schema.maximum}` });
+    }
+  }
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    const obj = value;
+    for (const key of schema.required ?? []) {
+      if (!(key in obj)) {
+        errors.push({ path: childPath(path, key), message: "required property is missing" });
+      }
+    }
+    if (schema.properties) {
+      for (const [key, subSchema] of Object.entries(schema.properties)) {
+        if (key in obj) {
+          errors.push(...validate(obj[key], subSchema, childPath(path, key)));
+        }
+      }
+      if (schema.additionalProperties === false) {
+        for (const key of Object.keys(obj)) {
+          if (!(key in schema.properties)) {
+            errors.push({ path: childPath(path, key), message: "unknown property (additionalProperties: false)" });
+          }
+        }
+      }
+    }
+  }
+  if (Array.isArray(value) && schema.items) {
+    value.forEach((item, i) => {
+      errors.push(...validate(item, schema.items, `${path}[${i}]`));
+    });
+  }
+  return errors;
+}
+function matchesType(value, t) {
+  switch (t) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number" && !Number.isNaN(value);
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "boolean":
+      return typeof value === "boolean";
+    case "null":
+      return value === null;
+    case "object":
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    case "array":
+      return Array.isArray(value);
+    default:
+      return true;
+  }
+}
+function jsType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function childPath(parent, key) {
+  return parent ? `${parent}.${key}` : key;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b) return false;
+  if (a && b && typeof a === "object") {
+    if (Array.isArray(a) !== Array.isArray(b)) return false;
+    if (Array.isArray(a)) {
+      if (a.length !== b.length) return false;
+      return a.every((v, i) => deepEqual(v, b[i]));
+    }
+    const aKeys = Object.keys(a);
+    const bKeys = Object.keys(b);
+    if (aKeys.length !== bKeys.length) return false;
+    return aKeys.every((k) => deepEqual(a[k], b[k]));
+  }
+  return false;
+}
+
+// src/routes/tasks.ts
 var rpcResolvers = /* @__PURE__ */ new Map();
 function createTaskRoutes(db, accountManager2, config) {
   const router = Router10();
   router.post("/tasks/assign", requireAuth, async (req, res, next) => {
     try {
-      const { assignee, taskType, payload, expiresInSeconds } = req.body || {};
+      const { assignee, taskType, payload, expiresInSeconds, outputSchema } = req.body || {};
       if (!assignee) {
         res.status(400).json({ error: "assignee (agent name) is required" });
         return;
@@ -3162,13 +3270,32 @@ function createTaskRoutes(db, accountManager2, config) {
         res.status(404).json({ error: `Agent "${assignee}" not found` });
         return;
       }
+      if (outputSchema !== void 0 && (typeof outputSchema !== "object" || outputSchema === null)) {
+        res.status(400).json({ error: "outputSchema must be a JSON Schema object" });
+        return;
+      }
       const assignerId = req.agent?.id ?? "master";
       const id = uuidv43();
       const expiresAt = expiresInSeconds ? new Date(Date.now() + expiresInSeconds * 1e3).toISOString() : null;
       db.prepare(
-        "INSERT INTO agent_tasks (id, assigner_id, assignee_id, task_type, payload, expires_at) VALUES (?, ?, ?, ?, ?, ?)"
-      ).run(id, assignerId, target.id, taskType || "generic", JSON.stringify(payload || {}), expiresAt);
+        "INSERT INTO agent_tasks (id, assigner_id, assignee_id, task_type, payload, expires_at, output_schema) VALUES (?, ?, ?, ?, ?, ?, ?)"
+      ).run(
+        id,
+        assignerId,
+        target.id,
+        taskType || "generic",
+        JSON.stringify(payload || {}),
+        expiresAt,
+        outputSchema ? JSON.stringify(outputSchema) : null
+      );
       const taskDescription = payload?.task || payload?.description || JSON.stringify(payload || {});
+      const schemaSection = outputSchema ? `
+
+Your submit_result MUST conform to this JSON Schema:
+\`\`\`json
+${JSON.stringify(outputSchema, null, 2)}
+\`\`\`
+The API will reject a non-conformant result with the validator errors so you can retry.` : "";
       const spawnEvent = {
         type: "task",
         taskId: id,
@@ -3176,7 +3303,7 @@ function createTaskRoutes(db, accountManager2, config) {
         task: `You have a pending task (ID: ${id}). Check your pending tasks, claim it, process it, and submit the result.
 
 Type: ${taskType || "generic"}
-Task: ${taskDescription}`,
+Task: ${taskDescription}${schemaSection}`,
         assignee: target.name,
         from: req.agent?.name ?? "system"
       };
@@ -3257,6 +3384,25 @@ Please check your pending tasks.`
   router.post("/tasks/:id/result", requireAgent, async (req, res, next) => {
     try {
       const { result } = req.body || {};
+      const taskRow = db.prepare("SELECT output_schema FROM agent_tasks WHERE id = ?").get(req.params.id);
+      if (taskRow?.output_schema) {
+        let schema;
+        try {
+          schema = JSON.parse(taskRow.output_schema);
+        } catch {
+        }
+        if (schema) {
+          const errors = validate(result, schema);
+          if (errors.length > 0) {
+            res.status(400).json({
+              error: "Result does not match the task outputSchema",
+              schemaErrors: errors,
+              hint: "Retry submit_result with a value matching the schema. Use GET /tasks/:id to re-read the schema."
+            });
+            return;
+          }
+        }
+      }
       const resultJson = JSON.stringify(result ?? null);
       const dbResult = db.prepare(
         "UPDATE agent_tasks SET status = 'completed', result = ?, completed_at = datetime('now') WHERE id = ? AND status = 'claimed'"
@@ -3443,6 +3589,7 @@ function parseTask(row) {
   if (!row) return null;
   let payload = {};
   let result = null;
+  let outputSchema = null;
   try {
     payload = JSON.parse(row.payload);
   } catch {
@@ -3453,6 +3600,11 @@ function parseTask(row) {
   } catch {
     result = row.result;
   }
+  try {
+    outputSchema = row.output_schema ? JSON.parse(row.output_schema) : null;
+  } catch {
+    outputSchema = null;
+  }
   return {
     id: row.id,
     assignerId: row.assigner_id,
@@ -3465,7 +3617,8 @@ function parseTask(row) {
     createdAt: row.created_at,
     claimedAt: row.claimed_at,
     completedAt: row.completed_at,
-    expiresAt: row.expires_at
+    expiresAt: row.expires_at,
+    outputSchema
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticmail/api",
-  "version": "0.7.15",
+  "version": "0.7.16",
   "description": "REST API server for AgenticMail — email and SMS endpoints for AI agents",
   "type": "module",
   "main": "dist/index.js",

package/public/index.html

@@ -90,6 +90,7 @@
     </div>
     <div class="compose-foot">
       <button class="btn-send" id="compose-send">Send</button>
+      <span class="compose-status" id="compose-status"></span>
       <button class="btn-discard" id="compose-cancel">Discard</button>
     </div>
   </div>

package/public/js/api.js

@@ -23,3 +23,27 @@ export async function apiPost(path, body, opts = {}) {
   if (!r.ok) throw new Error(`${r.status} ${path}`);
   return await r.json();
 }
+
+export async function apiPut(path, body, opts = {}) {
+  const r = await fetch(`${API_URL}/api/agenticmail${path}`, {
+    method: 'PUT',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${opts.agentKey ?? state.masterKey}`,
+    },
+    body: JSON.stringify(body),
+  });
+  if (!r.ok) throw new Error(`${r.status} ${path}`);
+  return await r.json();
+}
+
+export async function apiDelete(path, opts = {}) {
+  const r = await fetch(`${API_URL}/api/agenticmail${path}`, {
+    method: 'DELETE',
+    headers: { Authorization: `Bearer ${opts.agentKey ?? state.masterKey}` },
+  });
+  if (!r.ok) throw new Error(`${r.status} ${path}`);
+  // DELETE may return 204 No Content — guard against empty body.
+  const text = await r.text();
+  return text ? JSON.parse(text) : { ok: true };
+}

package/public/js/app.js

@@ -10,7 +10,7 @@ import { apiGet } from './api.js';
 import { isBridgeAgent } from './avatar.js';
 import { renderProfile, toggleProfileMenu, closeProfileMenu } from './profile.js';
 import { renderSidebar } from './sidebar.js';
-import { loadList, renderList, clearSearch } from './list-view.js';
+import { loadList, renderList, clearSearch, ensureFolderCache } from './list-view.js';
 import { openMessage } from './message-view.js';
 import { populateComposeFrom, openCompose, closeCompose, sendCompose } from './compose.js';
 import { subscribeToAllAgents, maybeRequestNotificationPermission } from './sse.js';
@@ -96,6 +96,15 @@ async function selectAgent(agent) {
   state.selectedAgent = agent;
   state.selectedUid = null;
   state.currentMessage = null;
+  // Reset the per-agent folder cache so a fresh discovery runs
+  // against the new agent's IMAP. Otherwise switching to an
+  // account that uses different folder names (e.g. Gmail relay
+  // vs vanilla Stalwart) keeps the previous cache.
+  state.folderNames = {};
+  // Discover folders BEFORE the first sidebar render so the
+  // `requiresDiscovery` hide-rule (All Mail on non-Gmail servers)
+  // has the cache to consult. Falls back to defaults on failure.
+  await ensureFolderCache(agent);
   renderSidebar(onFolderSelect);
   renderProfile();
   await loadList(agent, state.selectedFolder);

package/public/js/compose.js

@@ -1,10 +1,21 @@
 // Gmail-style bottom-right compose popup. Handles both new-message
 // and reply flows. `wake` is the AgenticMail selective-wake hint.
+//
+// Draft autosave: every keystroke on the to / cc / subject / body
+// fields schedules a 2s-debounced save to `/drafts`. First save
+// POSTs and stores the returned id; subsequent saves PUT to that
+// id. On Send, the draft (if any) is deleted after the send
+// succeeds — otherwise it stays around so the user can find it
+// in the Drafts folder.
 import { state } from './state.js';
 import { escapeHtml, toast } from './utils.js';
-import { apiPost } from './api.js';
+import { apiPost, apiPut, apiDelete } from './api.js';
 import { loadList } from './list-view.js';
 
+const AUTOSAVE_DEBOUNCE_MS = 2000;
+let autosaveTimer = null;
+let autosaveInFlight = false;
+
 export function populateComposeFrom() {
   const sel = document.getElementById('compose-from');
   sel.innerHTML = state.agents
@@ -14,11 +25,14 @@ export function populateComposeFrom() {
 
 export function openCompose() {
   state.composeReplyContext = null;
+  state.composeDraftId = null;
   document.getElementById('compose-title').textContent = 'New message';
   if (state.selectedAgent) document.getElementById('compose-from').value = state.selectedAgent.id;
   ['compose-to', 'compose-cc', 'compose-wake', 'compose-subject', 'compose-body']
     .forEach(id => { document.getElementById(id).value = ''; });
+  setComposeStatus('');
   showModal();
+  wireAutosave();
   setTimeout(() => document.getElementById('compose-to').focus(), 50);
 }
 
@@ -26,6 +40,7 @@ export function openReply(replyAll) {
   if (!state.currentMessage) return;
   const msg = state.currentMessage;
   state.composeReplyContext = { uid: msg.uid, agent: state.selectedAgent, replyAll };
+  state.composeDraftId = null;
   document.getElementById('compose-title').textContent =
     `Reply${replyAll ? ' all' : ''}: ${msg.subject ?? '(no subject)'}`;
   document.getElementById('compose-from').value = state.selectedAgent.id;
@@ -45,18 +60,104 @@ export function openReply(replyAll) {
   const quoted = (msg.text ?? '').split('\n').map(l => `> ${l}`).join('\n');
   const stub = `\n\nOn ${msg.date}, ${fromAddr} wrote:\n${quoted}`;
   document.getElementById('compose-body').value = stub;
+  setComposeStatus('');
   showModal();
+  wireAutosave();
   setTimeout(() => document.getElementById('compose-body').focus(), 50);
 }
 
 export function closeCompose() {
   document.getElementById('compose-bg').style.display = 'none';
+  // Flush a final save synchronously-ish on close so a quick
+  // "type → close" doesn't lose work. We only fire if there's a
+  // pending debounce — if the user already saved or never typed,
+  // skip the network call.
+  if (autosaveTimer) {
+    clearTimeout(autosaveTimer);
+    autosaveTimer = null;
+    void runAutosave();
+  }
 }
 
 function showModal() {
   document.getElementById('compose-bg').style.display = 'flex';
 }
 
+/**
+ * Build the field set the drafts API expects from current modal
+ * state. Returns null when the draft is empty (no point persisting
+ * a blank shell).
+ */
+function readComposeFields() {
+  const to = document.getElementById('compose-to').value.trim();
+  const subject = document.getElementById('compose-subject').value.trim();
+  const text = document.getElementById('compose-body').value;
+  const cc = document.getElementById('compose-cc').value.trim();
+  if (!to && !subject && !text.trim() && !cc) return null;
+  return {
+    to: to || null,
+    subject: subject || null,
+    text: text || null,
+    cc: cc || null,
+  };
+}
+
+/**
+ * Wire the autosave debounce to every input/textarea in the modal.
+ * Re-wires on every open() so removed/replaced DOM nodes don't
+ * accumulate listeners.
+ */
+function wireAutosave() {
+  ['compose-to', 'compose-cc', 'compose-subject', 'compose-body'].forEach(id => {
+    const el = document.getElementById(id);
+    if (!el) return;
+    // Marker prevents double-binding.
+    if (el._autosaveBound) return;
+    el._autosaveBound = true;
+    el.addEventListener('input', scheduleAutosave);
+  });
+}
+
+function scheduleAutosave() {
+  setComposeStatus('Saving…');
+  if (autosaveTimer) clearTimeout(autosaveTimer);
+  autosaveTimer = setTimeout(runAutosave, AUTOSAVE_DEBOUNCE_MS);
+}
+
+async function runAutosave() {
+  autosaveTimer = null;
+  if (autosaveInFlight) {
+    // Coalesce: re-schedule one more pass after the current
+    // request lands so we don't lose the latest keystroke.
+    autosaveTimer = setTimeout(runAutosave, AUTOSAVE_DEBOUNCE_MS);
+    return;
+  }
+  const fields = readComposeFields();
+  if (!fields) { setComposeStatus(''); return; }
+  const agentId = document.getElementById('compose-from').value;
+  const agent = state.agents.find(a => a.id === agentId) ?? state.selectedAgent;
+  if (!agent) return;
+  autosaveInFlight = true;
+  try {
+    if (state.composeDraftId) {
+      await apiPut(`/drafts/${state.composeDraftId}`, fields, { agentKey: agent.apiKey });
+    } else {
+      const r = await apiPost('/drafts', fields, { agentKey: agent.apiKey });
+      state.composeDraftId = r?.id ?? null;
+    }
+    setComposeStatus('Saved to Drafts');
+  } catch (err) {
+    setComposeStatus(`Save failed: ${err.message}`);
+  } finally {
+    autosaveInFlight = false;
+  }
+}
+
+function setComposeStatus(text) {
+  const el = document.getElementById('compose-status');
+  if (el) el.textContent = text;
+}
+
 export async function sendCompose() {
   const agentId = document.getElementById('compose-from').value;
   const agent = state.agents.find(a => a.id === agentId);
@@ -72,6 +173,12 @@ export async function sendCompose() {
   if (wakeRaw) body.wake = wakeRaw.split(',').map(s => s.trim()).filter(Boolean);
   try {
     await apiPost('/mail/send', body, { agentKey: agent.apiKey });
+    // Clean up the autosaved draft (if any) — the message is in
+    // the real Sent folder now, no need to keep a Drafts entry.
+    if (state.composeDraftId) {
+      try { await apiDelete(`/drafts/${state.composeDraftId}`, { agentKey: agent.apiKey }); } catch { /* ignore */ }
+      state.composeDraftId = null;
+    }
     closeCompose();
     toast('Sent.');
     if (state.selectedAgent?.id === agent.id) await loadList(agent, state.selectedFolder);

package/public/js/list-view.js

@@ -97,6 +97,15 @@ export async function loadList(agent, folder) {
     <div class="list-rows" id="list-rows"><div class="empty">Loading…</div></div>
   `;
   document.getElementById('list-refresh-btn')?.addEventListener('click', () => loadList(agent, folder));
+  // Select-all toggles every visible row checkbox. We don't currently
+  // expose a bulk-action toolbar (delete/archive/move) yet, so this
+  // is purely a visual selection state for now — but wiring it
+  // means it works the moment a bulk-action surface lands.
+  document.getElementById('list-select-all-input')?.addEventListener('change', (e) => {
+    const checked = e.target.checked;
+    document.querySelectorAll('#list-rows .row-check input[type=checkbox]')
+      .forEach(cb => { cb.checked = checked; });
+  });
   await ensureFolderCache(agent);
 
   // Resolve the real IMAP folder. Starred reuses INBOX + a client-

package/public/js/message-view.js

@@ -4,7 +4,7 @@ import { escapeHtml, stripHtml, toast } from './utils.js';
 import { formatDateFull } from './time.js';
 import { renderMarkdown } from './markdown.js';
 import { avatarHtml } from './avatar.js';
-import { apiGet, apiPost } from './api.js';
+import { apiGet, apiPost, apiDelete } from './api.js';
 import { openReply } from './compose.js';
 import { loadList } from './list-view.js';
 import { icon } from './icons.js';
@@ -19,6 +19,8 @@ export async function openMessage(uid) {
       <button class="icon-btn" id="msg-reply" title="Reply">${icon('reply')}</button>
       <button class="icon-btn" id="msg-reply-all" title="Reply all">${icon('replyAll')}</button>
       <button class="icon-btn" id="msg-unread" title="Mark unread">${icon('mailUnread')}</button>
+      <button class="icon-btn" id="msg-spam" title="Report spam">${icon('spam')}</button>
+      <button class="icon-btn" id="msg-delete" title="Delete">${icon('trash')}</button>
       <div class="toolbar-spacer"></div>
     </div>
     <div class="message-view"><div class="empty">Loading…</div></div>
@@ -27,6 +29,8 @@ export async function openMessage(uid) {
   document.getElementById('msg-reply').addEventListener('click', () => openReply(false));
   document.getElementById('msg-reply-all').addEventListener('click', () => openReply(true));
   document.getElementById('msg-unread').addEventListener('click', () => markUnread());
+  document.getElementById('msg-spam').addEventListener('click', () => markSpam());
+  document.getElementById('msg-delete').addEventListener('click', () => deleteMessage());
 
   try {
     const msg = await apiGet(`/mail/messages/${uid}`, { agentKey: state.selectedAgent.apiKey });
@@ -85,3 +89,40 @@ async function markUnread() {
     toast(`Failed: ${err.message}`, true);
   }
 }
+
+/**
+ * Move the open message to the Junk Mail folder (IMAP). The API
+ * route is POST /mail/messages/:uid/spam — it does the move +
+ * flags the message so future scans treat it as known spam.
+ */
+async function markSpam() {
+  if (!state.currentMessage || !state.selectedAgent) return;
+  if (!confirm('Report this message as spam? It will be moved to the Junk folder.')) return;
+  try {
+    await apiPost(`/mail/messages/${state.currentMessage.uid}/spam`, {}, { agentKey: state.selectedAgent.apiKey });
+    toast('Reported as spam.');
+    location.hash = `#/folder/${state.selectedFolder ?? 'inbox'}`;
+    await loadList(state.selectedAgent, state.selectedFolder);
+  } catch (err) {
+    toast(`Spam failed: ${err.message}`, true);
+  }
+}
+
+/**
+ * Delete the open message. DELETE /mail/messages/:uid moves it
+ * to the IMAP \Deleted state (Stalwart auto-expunges on server
+ * config, otherwise it stays in Trash). Confirm before firing
+ * since this is destructive.
+ */
+async function deleteMessage() {
+  if (!state.currentMessage || !state.selectedAgent) return;
+  if (!confirm('Delete this message?')) return;
+  try {
+    await apiDelete(`/mail/messages/${state.currentMessage.uid}`, { agentKey: state.selectedAgent.apiKey });
+    toast('Deleted.');
+    location.hash = `#/folder/${state.selectedFolder ?? 'inbox'}`;
+    await loadList(state.selectedAgent, state.selectedFolder);
+  } catch (err) {
+    toast(`Delete failed: ${err.message}`, true);
+  }
+}

package/public/js/sidebar.js

@@ -8,12 +8,18 @@
 import { state } from './state.js';
 import { icon } from './icons.js';
 
+// `All Mail` is a Gmail-only concept (a virtual folder that
+// aggregates every message regardless of mailbox). Stalwart and most
+// other IMAP servers don't expose anything equivalent, so we ship
+// the link but hide it at render time when the discovery cache
+// didn't find a real folder name — see `renderSidebar`. The
+// flag below is what the renderer keys off.
 export const FOLDERS = [
   { id: 'inbox',   label: 'Inbox',    icon: 'inbox' },
   { id: 'starred', label: 'Starred',  icon: 'starOutline' },
   { id: 'sent',    label: 'Sent',     icon: 'sent' },
   { id: 'drafts',  label: 'Drafts',   icon: 'drafts' },
-  { id: 'all',     label: 'All Mail', icon: 'allMail' },
+  { id: 'all',     label: 'All Mail', icon: 'allMail', requiresDiscovery: true },
   { id: 'spam',    label: 'Spam',     icon: 'spam' },
   { id: 'trash',   label: 'Trash',    icon: 'trash' },
 ];
@@ -23,7 +29,13 @@ export function renderSidebar(onSelect) {
   if (!root) return;
   const active = state.selectedFolder ?? 'inbox';
   const unread = state.unread?.[state.selectedAgent?.id] ?? 0;
-  root.innerHTML = FOLDERS.map(f => {
+  // Hide folders that need discovery but didn't get a real IMAP
+  // name from the per-agent folder cache. Saves the user from
+  // clicking "All Mail" and getting an empty-state error on
+  // servers that don't have an equivalent (Stalwart, most non-
+  // Gmail providers).
+  const visible = FOLDERS.filter(f => !f.requiresDiscovery || state.folderNames?.[f.id]);
+  root.innerHTML = visible.map(f => {
     const isActive = f.id === active;
     const showCount = f.id === 'inbox' && unread > 0;
     return `

package/public/styles.css

@@ -691,8 +691,13 @@ mark.search-hl {
   font-weight: 500; font-size: 14px;
 }
 .btn-send:hover { background: var(--accent-strong); }
+.compose-status {
+  font-size: 12px; color: var(--muted);
+  margin-left: 12px;
+  flex: 1; min-width: 0;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
 .btn-discard {
-  margin-left: auto;
   color: var(--muted);
   padding: 8px 12px;
 }