@agenticmail/api 0.7.19 → 0.7.21

package/dist/index.js

@@ -751,20 +751,75 @@ function createFeatureRoutes(db, _accountManager, config, gatewayManager) {
       next(err);
     }
   });
+  const MAX_DRAFT_ATTACHMENTS_BYTES = 25 * 1024 * 1024;
+  function normaliseDraftAttachments(raw) {
+    if (!Array.isArray(raw) || raw.length === 0) return null;
+    let totalBytes = 0;
+    const cleaned = raw.map((a) => {
+      const content = typeof a?.content === "string" ? a.content : "";
+      totalBytes += Math.ceil(content.length * 0.75);
+      return {
+        filename: typeof a?.filename === "string" ? a.filename : "attachment",
+        contentType: typeof a?.contentType === "string" ? a.contentType : "application/octet-stream",
+        content,
+        encoding: "base64",
+        size: typeof a?.size === "number" ? a.size : Math.ceil(content.length * 0.75)
+      };
+    });
+    if (totalBytes > MAX_DRAFT_ATTACHMENTS_BYTES) {
+      throw Object.assign(new Error("attachments exceed 25 MB total"), { status: 413 });
+    }
+    return JSON.stringify(cleaned);
+  }
   router.get("/drafts", requireAgent, async (req, res, next) => {
     try {
       const rows = db.prepare("SELECT * FROM drafts WHERE agent_id = ? ORDER BY updated_at DESC").all(req.agent.id);
-      res.json({ drafts: rows });
+      const stripped = rows.map((r) => {
+        let metaOnly;
+        if (r.attachments) {
+          try {
+            metaOnly = JSON.parse(r.attachments).map((a) => ({
+              filename: a.filename,
+              contentType: a.contentType,
+              size: a.size
+            }));
+          } catch {
+            metaOnly = void 0;
+          }
+        }
+        return { ...r, attachments: metaOnly };
+      });
+      res.json({ drafts: stripped });
+    } catch (err) {
+      next(err);
+    }
+  });
+  router.get("/drafts/:id", requireAgent, async (req, res, next) => {
+    try {
+      const row = db.prepare("SELECT * FROM drafts WHERE id = ? AND agent_id = ?").get(req.params.id, req.agent.id);
+      if (!row) {
+        res.status(404).json({ error: "Draft not found" });
+        return;
+      }
+      if (row.attachments) {
+        try {
+          row.attachments = JSON.parse(row.attachments);
+        } catch {
+          row.attachments = [];
+        }
+      }
+      res.json(row);
     } catch (err) {
       next(err);
     }
   });
   router.post("/drafts", requireAgent, async (req, res, next) => {
     try {
-      const { to, subject, text, html, cc, bcc, inReplyTo, references } = req.body || {};
+      const { to, subject, text, html, cc, bcc, inReplyTo, references, attachments } = req.body || {};
+      const attachmentsJson = normaliseDraftAttachments(attachments);
       const id = uuidv4();
-      db.prepare(`INSERT INTO drafts (id, agent_id, to_addr, subject, text_body, html_body, cc, bcc, in_reply_to, refs)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
+      db.prepare(`INSERT INTO drafts (id, agent_id, to_addr, subject, text_body, html_body, cc, bcc, in_reply_to, refs, attachments)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
         id,
         req.agent.id,
         to || null,
@@ -774,19 +829,30 @@ function createFeatureRoutes(db, _accountManager, config, gatewayManager) {
         cc || null,
         bcc || null,
         inReplyTo || null,
-        references ? JSON.stringify(references) : null
+        references ? JSON.stringify(references) : null,
+        attachmentsJson
       );
       res.json({ ok: true, id });
     } catch (err) {
+      const status = err.status;
+      if (status) {
+        res.status(status).json({ error: err.message });
+        return;
+      }
       next(err);
     }
   });
   router.put("/drafts/:id", requireAgent, async (req, res, next) => {
     try {
-      const { to, subject, text, html, cc, bcc, inReplyTo, references } = req.body || {};
-      const result = db.prepare(`UPDATE drafts SET to_addr=?, subject=?, text_body=?, html_body=?,
-        cc=?, bcc=?, in_reply_to=?, refs=?, updated_at=datetime('now')
-        WHERE id=? AND agent_id=?`).run(
+      const { to, subject, text, html, cc, bcc, inReplyTo, references, attachments } = req.body || {};
+      const includeAttachments = Object.prototype.hasOwnProperty.call(req.body || {}, "attachments");
+      const attachmentsJson = includeAttachments ? normaliseDraftAttachments(attachments) : void 0;
+      const sql = includeAttachments ? `UPDATE drafts SET to_addr=?, subject=?, text_body=?, html_body=?,
+            cc=?, bcc=?, in_reply_to=?, refs=?, attachments=?, updated_at=datetime('now')
+            WHERE id=? AND agent_id=?` : `UPDATE drafts SET to_addr=?, subject=?, text_body=?, html_body=?,
+            cc=?, bcc=?, in_reply_to=?, refs=?, updated_at=datetime('now')
+            WHERE id=? AND agent_id=?`;
+      const params = [
         to || null,
         subject || null,
         text || null,
@@ -794,16 +860,22 @@ function createFeatureRoutes(db, _accountManager, config, gatewayManager) {
         cc || null,
         bcc || null,
         inReplyTo || null,
-        references ? JSON.stringify(references) : null,
-        req.params.id,
-        req.agent.id
-      );
+        references ? JSON.stringify(references) : null
+      ];
+      if (includeAttachments) params.push(attachmentsJson);
+      params.push(req.params.id, req.agent.id);
+      const result = db.prepare(sql).run(...params);
       if (result.changes === 0) {
         res.status(404).json({ error: "Draft not found" });
         return;
       }
       res.json({ ok: true });
     } catch (err) {
+      const status = err.status;
+      if (status) {
+        res.status(status).json({ error: err.message });
+        return;
+      }
       next(err);
     }
   });
@@ -833,6 +905,19 @@ function createFeatureRoutes(db, _accountManager, config, gatewayManager) {
       const agent = req.agent;
       const wakeList = normalizeWakeList(req.body?.wake);
       const customHeaders = wakeHeaders(wakeList);
+      let persistedAttachments;
+      if (draft.attachments) {
+        try {
+          const parsed = JSON.parse(draft.attachments);
+          persistedAttachments = parsed.map((a) => ({
+            filename: a.filename,
+            contentType: a.contentType,
+            content: a.content,
+            encoding: "base64"
+          }));
+        } catch {
+        }
+      }
       const mailOpts = {
         to: draft.to_addr,
         subject: draft.subject || "(no subject)",
@@ -842,6 +927,7 @@ function createFeatureRoutes(db, _accountManager, config, gatewayManager) {
         bcc: draft.bcc || void 0,
         inReplyTo: draft.in_reply_to || void 0,
         references: draft.refs ? JSON.parse(draft.refs) : void 0,
+        ...persistedAttachments && persistedAttachments.length > 0 ? { attachments: persistedAttachments } : {},
         ...Object.keys(customHeaders).length > 0 ? { headers: customHeaders } : {}
       };
       if (gatewayManager) {
@@ -1794,15 +1880,21 @@ async function notifyLocalRecipientsOfNewMail(accountManager2, toField, ccField,
     });
   }
 }
-function saveSentCopy(authUser, password, config, raw) {
-  (async () => {
-    try {
-      const receiver = await getReceiver(authUser, password, config);
-      await receiver.appendMessage(raw, "Sent Items", ["\\Seen"]);
-    } catch (err) {
-      console.warn(`[mail] Failed to save Sent copy for ${authUser}: ${err.message}`);
+var sentFolderCache = /* @__PURE__ */ new Map();
+async function saveSentCopy(authUser, password, config, raw) {
+  try {
+    const receiver = await getReceiver(authUser, password, config);
+    let folder = sentFolderCache.get(authUser);
+    if (!folder) {
+      const folders = await receiver.listFolders();
+      const sentRe = /^sent\b|sent items|sent mail|sent messages|\[gmail\]\/sent/i;
+      folder = folders.find((f) => f.specialUse === "\\Sent")?.path ?? folders.find((f) => sentRe.test(f.name) || sentRe.test(f.path))?.path ?? "Sent Items";
+      sentFolderCache.set(authUser, folder);
     }
-  })();
+    await receiver.appendMessage(raw, folder, ["\\Seen"]);
+  } catch (err) {
+    console.warn(`[mail] Failed to save Sent copy for ${authUser}: ${err.message}`);
+  }
 }
 function createMailRoutes(accountManager2, config, db, gatewayManager) {
   const router = Router6();
@@ -2416,6 +2508,95 @@ function createMailRoutes(accountManager2, config, db, gatewayManager) {
       next(err);
     }
   });
+  router.post("/mail/messages/:uid/archive", requireAgent, async (req, res, next) => {
+    try {
+      const agent = req.agent;
+      const uid = parseInt(req.params.uid);
+      if (isNaN(uid) || uid < 1) {
+        res.status(400).json({ error: "Invalid UID" });
+        return;
+      }
+      const sourceFolder = req.body?.folder || "INBOX";
+      const password = getAgentPassword(agent);
+      const receiver = await getReceiver(agent.stalwartPrincipal, password, config);
+      const folders = await receiver.listFolders();
+      const archiveRe = /^archives?\b|^all archive\b/i;
+      let archiveFolder = folders.find((f) => f.specialUse === "\\Archive")?.path ?? folders.find((f) => archiveRe.test(f.name) || archiveRe.test(f.path))?.path;
+      if (!archiveFolder) {
+        try {
+          await receiver.createFolder("Archive");
+        } catch {
+        }
+        archiveFolder = "Archive";
+      }
+      if (archiveFolder === sourceFolder) {
+        res.status(400).json({ error: "Message already in archive" });
+        return;
+      }
+      await receiver.moveMessage(uid, sourceFolder, archiveFolder);
+      res.json({ ok: true, archive: archiveFolder });
+    } catch (err) {
+      next(err);
+    }
+  });
+  router.post("/mail/batch/archive", requireAgent, async (req, res, next) => {
+    try {
+      const agent = req.agent;
+      const { uids: rawUids, folder } = req.body || {};
+      const uids = validateUids(rawUids);
+      if (!uids) {
+        res.status(400).json({ error: "uids must be a non-empty array of positive integers (max 1000)" });
+        return;
+      }
+      const sourceFolder = folder || "INBOX";
+      const password = getAgentPassword(agent);
+      const receiver = await getReceiver(agent.stalwartPrincipal, password, config);
+      const folders = await receiver.listFolders();
+      const archiveRe = /^archives?\b|^all archive\b/i;
+      let archiveFolder = folders.find((f) => f.specialUse === "\\Archive")?.path ?? folders.find((f) => archiveRe.test(f.name) || archiveRe.test(f.path))?.path;
+      if (!archiveFolder) {
+        try {
+          await receiver.createFolder("Archive");
+        } catch {
+        }
+        archiveFolder = "Archive";
+      }
+      if (archiveFolder === sourceFolder) {
+        res.status(400).json({ error: "Messages already in archive" });
+        return;
+      }
+      await receiver.batchMove(uids, sourceFolder, archiveFolder);
+      res.json({ ok: true, archived: uids.length, archive: archiveFolder });
+    } catch (err) {
+      next(err);
+    }
+  });
+  router.post("/mail/batch/trash", requireAgent, async (req, res, next) => {
+    try {
+      const agent = req.agent;
+      const { uids: rawUids, folder } = req.body || {};
+      const uids = validateUids(rawUids);
+      if (!uids) {
+        res.status(400).json({ error: "uids must be a non-empty array of positive integers (max 1000)" });
+        return;
+      }
+      const sourceFolder = folder || "INBOX";
+      const password = getAgentPassword(agent);
+      const receiver = await getReceiver(agent.stalwartPrincipal, password, config);
+      const folders = await receiver.listFolders();
+      const trashRe = /^trash\b|deleted items|deleted messages|\[gmail\]\/trash|\[gmail\]\/bin/i;
+      const trashFolder = folders.find((f) => f.specialUse === "\\Trash")?.path ?? folders.find((f) => trashRe.test(f.name) || trashRe.test(f.path))?.path;
+      if (!trashFolder || trashFolder === sourceFolder) {
+        await receiver.batchDelete(uids, sourceFolder);
+        res.json({ ok: true, deleted: uids.length });
+        return;
+      }
+      await receiver.batchMove(uids, sourceFolder, trashFolder);
+      res.json({ ok: true, trashed: uids.length, trash: trashFolder });
+    } catch (err) {
+      next(err);
+    }
+  });
   router.post("/mail/messages/:uid/spam", requireAgent, async (req, res, next) => {
     try {
       const agent = req.agent;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticmail/api",
-  "version": "0.7.19",
+  "version": "0.7.21",
   "description": "REST API server for AgenticMail — email and SMS endpoints for AI agents",
   "type": "module",
   "main": "dist/index.js",

package/public/js/app.js

@@ -55,9 +55,16 @@ function showAuthErr(msg) {
 }
 function signOut() {
   localStorage.removeItem('agenticmail.masterKey');
+  localStorage.removeItem('agenticmail.selectedAgentId');
   location.reload();
 }
 
+// localStorage key for the inbox the user was last viewing.
+// Persisted on every successful agent switch and consulted on
+// bootstrap so a refresh / reopen lands on the same account
+// instead of bouncing back to the bridge.
+const STORAGE_LAST_AGENT = 'agenticmail.selectedAgentId';
+
 document.getElementById('auth-submit').addEventListener('click', signIn);
 document.getElementById('auth-key').addEventListener('keydown', e => {
   if (e.key === 'Enter') signIn();
@@ -77,7 +84,15 @@ async function bootstrap() {
       return a.name.localeCompare(b.name);
     });
     state.agents = all;
-    const initial = state.agents.find(isBridgeAgent) ?? state.agents[0];
+    // Prefer the inbox the user was last viewing (persisted in
+    // localStorage on every selectAgent call). Falls back to the
+    // bridge if the stored id is gone (agent was deleted) or the
+    // user never switched. Fixes the "refresh always bounces me
+    // back to the host account" bug.
+    const lastId = localStorage.getItem(STORAGE_LAST_AGENT);
+    const initial = (lastId && state.agents.find(a => a.id === lastId))
+      ?? state.agents.find(isBridgeAgent)
+      ?? state.agents[0];
     if (initial) await selectAgent(initial);
     renderProfile();
     populateComposeFrom();
@@ -96,6 +111,11 @@ async function selectAgent(agent) {
   state.selectedAgent = agent;
   state.selectedUid = null;
   state.currentMessage = null;
+  // Persist the selection so a page refresh lands back on this
+  // inbox rather than bouncing to the bridge. Stored under a
+  // separate key from the master key so signing out clears it
+  // cleanly without affecting auth.
+  try { localStorage.setItem(STORAGE_LAST_AGENT, agent.id); } catch { /* private mode etc. */ }
   // Reset the per-agent folder cache so a fresh discovery runs
   // against the new agent's IMAP. Otherwise switching to an
   // account that uses different folder names (e.g. Gmail relay

package/public/js/compose.js

@@ -102,8 +102,10 @@ export async function openDraft(draftId) {
   wireAutosave();
   wireAttachmentPicker();
   try {
-    const data = await apiGet('/drafts', { agentKey: state.selectedAgent.apiKey });
-    const draft = (data?.drafts ?? []).find(d => d.id === draftId);
+    // Use the single-draft endpoint, which returns attachment
+    // content in full (the list endpoint only sends metadata to
+    // keep the sidebar payload small).
+    const draft = await apiGet(`/drafts/${encodeURIComponent(draftId)}`, { agentKey: state.selectedAgent.apiKey });
     if (!draft) throw new Error('Draft not found');
     document.getElementById('compose-to').value = draft.to_addr ?? '';
     document.getElementById('compose-cc').value = draft.cc ?? '';
@@ -111,6 +113,19 @@ export async function openDraft(draftId) {
     document.getElementById('compose-body').value = draft.text_body ?? '';
     document.getElementById('compose-title').textContent =
       `Draft: ${draft.subject || '(no subject)'}`;
+    // Rehydrate attachment chips with the persisted blobs. Map
+    // the server-side `size` field back into the in-memory
+    // `sizeBytes` alias the rest of the compose code uses for
+    // the UI-side 20 MB cap.
+    pendingAttachments = Array.isArray(draft.attachments)
+      ? draft.attachments.map(a => ({
+          filename: a.filename,
+          contentType: a.contentType,
+          content: a.content,
+          encoding: 'base64',
+          sizeBytes: typeof a.size === 'number' ? a.size : 0,
+        }))
+      : [];
     renderAttachmentChips();
     setComposeStatus('Loaded from Drafts');
     setTimeout(() => document.getElementById('compose-body').focus(), 50);
@@ -174,12 +189,27 @@ function readComposeFields() {
   const subject = document.getElementById('compose-subject').value.trim();
   const text = document.getElementById('compose-body').value;
   const cc = document.getElementById('compose-cc').value.trim();
-  if (!to && !subject && !text.trim() && !cc) return null;
+  if (!to && !subject && !text.trim() && !cc && pendingAttachments.length === 0) return null;
+  // The API expects `{ filename, contentType, content (base64),
+  // size }` per attachment. Drop the local-only sizeBytes alias
+  // and the redundant encoding field — the server defaults to
+  // base64 anyway.
+  const attachments = pendingAttachments.map(a => ({
+    filename: a.filename,
+    contentType: a.contentType,
+    content: a.content,
+    size: a.sizeBytes,
+  }));
   return {
     to: to || null,
     subject: subject || null,
     text: text || null,
     cc: cc || null,
+    // Always send `attachments` (even empty) so the server clears
+    // the stored blob when the user removes every chip. The PUT
+    // route uses `hasOwnProperty('attachments')` to distinguish
+    // "leave alone" from "set to empty".
+    attachments,
   };
 }
 
@@ -278,6 +308,11 @@ function wireAttachmentPicker() {
       }
     }
     renderAttachmentChips();
+    // Persist the new attachments to the draft so a "close and
+    // reopen" round-trip keeps them. Without this, attachments
+    // only ever lived in memory until the user typed in another
+    // field and triggered autosave organically.
+    scheduleAutosave();
   });
 }
 
@@ -310,6 +345,9 @@ function renderAttachmentChips() {
     el.addEventListener('click', () => {
       pendingAttachments.splice(Number(el.dataset.attRemove), 1);
       renderAttachmentChips();
+      // Same reason as the picker: removing a chip needs to
+      // persist or the draft round-trip will resurrect the file.
+      scheduleAutosave();
     });
   });
 }

package/public/js/icons.js

@@ -32,6 +32,8 @@ const PATHS = {
 
   // ─── Sidebar folders ────────────────────────────────────────────
   inbox:   'M19 3H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2zm0 12h-4c0 1.66-1.35 3-3 3s-3-1.34-3-3H5V5h14v10z',
+  // Material-style archive: lidded box with horizontal slot.
+  archive: 'M20.54 5.23l-1.39-1.68A1.45 1.45 0 0 0 18 3H6c-.47 0-.88.21-1.16.55L3.46 5.23A2 2 0 0 0 3 6.5V19a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V6.5c0-.5-.18-.96-.46-1.27zM12 17.5L6.5 12H10v-2h4v2h3.5L12 17.5zM5.12 5l.82-1h12l.93 1H5.12z',
   sent:    'M2.01 21 23 12 2.01 3 2 10l15 2-15 2z',
   drafts:  'M19 3H4.99c-1.11 0-1.98.9-1.98 2L3 19a2 2 0 0 0 2 2h14c1.1 0 2-.9 2-2v-7l-8 5-8-5V5l8 5 8-5v2h2V5a2 2 0 0 0-2-2z',
   allMail: 'M22 4h-2v9.38l-2.79-2.79L16 12l4 4 4-4-1.21-1.21L22 13.38V4zM4 4a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8h-2v10H4V6h12V4H4z',

package/public/js/list-view.js

@@ -38,6 +38,11 @@ const FOLDER_MATCHERS = {
   drafts:  /^drafts?\b|\[gmail\]\/drafts/i,
   spam:    /^junk\b|junk mail|^spam\b|\[gmail\]\/spam/i,
   trash:   /^trash\b|deleted items|deleted messages|\[gmail\]\/trash|\[gmail\]\/bin/i,
+  // Archive is a Gmail/Outlook concept — most servers don't ship
+  // with one by default. We auto-create on demand (see the API's
+  // archive endpoint) so this matcher only needs to recognise
+  // existing folders.
+  archive: /^archives?\b|^all archive\b/i,
   all:     /^all mail\b|\[gmail\]\/all/i,
 };
 
@@ -72,10 +77,11 @@ export async function ensureFolderCache(agent) {
   } catch {
     // Discovery failed — fall back to the most common defaults so
     // at least Inbox + Sent work for vanilla Stalwart.
-    state.folderNames.sent   = 'Sent Items';
-    state.folderNames.drafts = 'Drafts';
-    state.folderNames.spam   = 'Junk Mail';
-    state.folderNames.trash  = 'Trash';
+    state.folderNames.sent    = 'Sent Items';
+    state.folderNames.drafts  = 'Drafts';
+    state.folderNames.spam    = 'Junk Mail';
+    state.folderNames.trash   = 'Trash';
+    state.folderNames.archive = 'Archive';
   }
 }
 
@@ -91,6 +97,14 @@ export async function loadList(agent, folder) {
         <input type="checkbox" id="list-select-all-input" />
       </label>
       <button class="icon-btn list-refresh" title="Refresh" id="list-refresh-btn">${icon('refresh', { size: 18 })}</button>
+      <div class="bulk-actions" id="bulk-actions" hidden>
+        <button class="icon-btn bulk-btn" id="bulk-archive" title="Archive selected">${icon('archive', { size: 18 })}</button>
+        <button class="icon-btn bulk-btn" id="bulk-delete" title="Delete selected">${icon('trash', { size: 18 })}</button>
+        <button class="icon-btn bulk-btn" id="bulk-spam" title="Report as spam">${icon('spam', { size: 18 })}</button>
+        <button class="icon-btn bulk-btn" id="bulk-mark-read" title="Mark as read">${icon('check', { size: 18 })}</button>
+        <button class="icon-btn bulk-btn" id="bulk-mark-unread" title="Mark as unread">${icon('mailUnread', { size: 18 })}</button>
+        <span class="bulk-count" id="bulk-count"></span>
+      </div>
       <div class="list-toolbar-spacer"></div>
       <span class="count-text" id="list-count"></span>
     </div>
@@ -101,7 +115,17 @@ export async function loadList(agent, folder) {
     const checked = e.target.checked;
     document.querySelectorAll('#list-rows .row-check input[type=checkbox]')
       .forEach(cb => { cb.checked = checked; });
+    updateBulkActions();
   });
+  // Wire bulk-action handlers — each gathers the selected UIDs,
+  // calls the matching batch endpoint, and reloads the list. The
+  // toolbar visibility is driven by `updateBulkActions` which is
+  // called every time a checkbox flips.
+  document.getElementById('bulk-archive')?.addEventListener('click', () => runBulkAction(agent, folder, 'archive'));
+  document.getElementById('bulk-delete')?.addEventListener('click',  () => runBulkAction(agent, folder, 'delete'));
+  document.getElementById('bulk-spam')?.addEventListener('click',    () => runBulkAction(agent, folder, 'spam'));
+  document.getElementById('bulk-mark-read')?.addEventListener('click',   () => runBulkAction(agent, folder, 'mark-read'));
+  document.getElementById('bulk-mark-unread')?.addEventListener('click', () => runBulkAction(agent, folder, 'mark-unread'));
 
   // Drafts are a SQL-backed app primitive, not an IMAP mailbox.
   // The autosave path writes to /drafts (sqlite) and the agent
@@ -204,6 +228,20 @@ export function renderList() {
   if (state.selectedFolder === 'starred') {
     filtered = filtered.filter(m => flagsHas(m.flags, '\\Flagged'));
   }
+  // Defensive Sent-folder filter. The API serves the IMAP Sent
+  // mailbox directly, but some Stalwart configurations (or
+  // misconfigured saveSentCopy targets) can land messages whose
+  // sender ISN'T the active agent in Sent. Filter client-side
+  // so the user only ever sees messages they actually sent.
+  // This is a safety net — the server-side fix lives in
+  // saveSentCopy and the dispatcher's send path.
+  if (state.selectedFolder === 'sent' && state.selectedAgent?.email) {
+    const me = state.selectedAgent.email.toLowerCase();
+    filtered = filtered.filter(m => {
+      const fromAddr = (m.from?.[0]?.address ?? '').toLowerCase();
+      return fromAddr === me;
+    });
+  }
 
   const hlTerm = filters?.subject || filters?.from || filters?.text || '';
 
@@ -270,6 +308,12 @@ export function renderList() {
   }).join('');
 
   root.querySelectorAll('.list-row').forEach(el => {
+    // Checkbox change on individual rows — drives the bulk-action
+    // toolbar visibility. Attached separately from the row click
+    // handler so clicking the box doesn't propagate to "open
+    // message".
+    const cb = el.querySelector('.row-check input[type=checkbox]');
+    cb?.addEventListener('change', updateBulkActions);
     el.addEventListener('click', (e) => {
       // Star click — toggle via API and optimistically update the
       // local flags so the icon flips without a reload.
@@ -298,6 +342,112 @@ export function renderList() {
   });
 }
 
+/**
+ * Read every checked row's UID. Empty array when nothing is
+ * selected. Used by the bulk-action handlers and toolbar
+ * visibility logic.
+ */
+function getSelectedUids() {
+  const uids = [];
+  document.querySelectorAll('#list-rows .list-row').forEach(row => {
+    const cb = row.querySelector('.row-check input[type=checkbox]');
+    if (cb?.checked) {
+      const uid = Number(row.dataset.uid);
+      if (Number.isFinite(uid)) uids.push(uid);
+    }
+  });
+  return uids;
+}
+
+/**
+ * Toggle the visibility of the bulk-action toolbar based on
+ * current selection. Also updates the count label so the user
+ * sees "3 selected" etc. Called on every checkbox change +
+ * after each successful bulk action.
+ */
+function updateBulkActions() {
+  const uids = getSelectedUids();
+  const bar = document.getElementById('bulk-actions');
+  const count = document.getElementById('bulk-count');
+  if (!bar || !count) return;
+  if (uids.length === 0) {
+    bar.hidden = true;
+    return;
+  }
+  bar.hidden = false;
+  count.textContent = `${uids.length} selected`;
+}
+
+/**
+ * Execute a bulk action against every currently-selected row.
+ * Maps the action name to the matching batch endpoint, fires
+ * one request, then reloads the list so the rows disappear /
+ * change visibly. Confirm dialogs only on destructive actions
+ * (delete, spam) — archive + mark-read/unread are silent.
+ */
+async function runBulkAction(agent, folder, action) {
+  const uids = getSelectedUids();
+  if (uids.length === 0) return;
+  const imap = state.folderNames?.[folder] ?? 'INBOX';
+  let confirmTitle = '';
+  let confirmBody = '';
+  let confirmLabel = '';
+  let endpoint = '';
+  let body = { uids, folder: imap };
+  let danger = false;
+  switch (action) {
+    case 'archive':
+      endpoint = '/mail/batch/archive';
+      break;
+    case 'delete':
+      // From Trash, batch/trash falls through to permanent
+      // expunge; everywhere else it's a move-to-trash.
+      endpoint = '/mail/batch/trash';
+      danger = true;
+      confirmTitle = folder === 'trash' ? `Delete ${uids.length} message${uids.length === 1 ? '' : 's'} forever?` : `Move ${uids.length} message${uids.length === 1 ? '' : 's'} to Trash?`;
+      confirmBody = folder === 'trash' ? "This can't be undone." : 'You can recover them from Trash.';
+      confirmLabel = folder === 'trash' ? 'Delete forever' : 'Move to Trash';
+      break;
+    case 'spam':
+      // No batch/spam route yet — fall back to batch/move with
+      // the auto-discovered Spam folder.
+      endpoint = '/mail/batch/move';
+      body.toFolder = state.folderNames?.spam ?? 'Junk Mail';
+      danger = true;
+      confirmTitle = `Report ${uids.length} message${uids.length === 1 ? '' : 's'} as spam?`;
+      confirmBody = 'They will be moved to the Junk folder.';
+      confirmLabel = 'Report spam';
+      break;
+    case 'mark-read':
+      endpoint = '/mail/batch/seen';
+      break;
+    case 'mark-unread':
+      endpoint = '/mail/batch/unseen';
+      break;
+    default:
+      return;
+  }
+  if (confirmTitle) {
+    const { confirmModal } = await import('./modal.js');
+    const ok = await confirmModal({ title: confirmTitle, body: confirmBody, confirm: confirmLabel, danger });
+    if (!ok) return;
+  }
+  try {
+    await apiPost(endpoint, body, { agentKey: agent.apiKey });
+    toast(`${uids.length} message${uids.length === 1 ? '' : 's'} ${
+      action === 'archive' ? 'archived' :
+      action === 'delete' ? (folder === 'trash' ? 'deleted' : 'moved to Trash') :
+      action === 'spam' ? 'reported as spam' :
+      action === 'mark-read' ? 'marked as read' :
+      'marked as unread'
+    }.`);
+    // Reload so the rows that moved/changed visibly update.
+    await loadList(agent, folder);
+  } catch (err) {
+    toast(`Bulk ${action} failed: ${err.message}`, true);
+  }
+}
+
 /**
  * Toggle the IMAP \Flagged flag on a message via the API. Updates
  * the in-memory message object on success so renderList reflects

package/public/js/message-view.js

@@ -19,6 +19,7 @@ export async function openMessage(uid) {
       <button class="icon-btn" id="msg-back" title="Back to list">${icon('back')}</button>
       <button class="icon-btn" id="msg-reply" title="Reply">${icon('reply')}</button>
       <button class="icon-btn" id="msg-reply-all" title="Reply all">${icon('replyAll')}</button>
+      <button class="icon-btn" id="msg-archive" title="Archive">${icon('archive')}</button>
       <button class="icon-btn" id="msg-unread" title="Mark unread">${icon('mailUnread')}</button>
       <button class="icon-btn" id="msg-spam" title="Report spam">${icon('spam')}</button>
       <button class="icon-btn" id="msg-delete" title="Delete">${icon('trash')}</button>
@@ -29,6 +30,7 @@ export async function openMessage(uid) {
   document.getElementById('msg-back').addEventListener('click', () => { location.hash = `#/folder/${state.selectedFolder ?? 'inbox'}`; });
   document.getElementById('msg-reply').addEventListener('click', () => openReply(false));
   document.getElementById('msg-reply-all').addEventListener('click', () => openReply(true));
+  document.getElementById('msg-archive').addEventListener('click', () => archiveMessage());
   document.getElementById('msg-unread').addEventListener('click', () => markUnread());
   document.getElementById('msg-spam').addEventListener('click', () => markSpam());
   document.getElementById('msg-delete').addEventListener('click', () => deleteMessage());
@@ -219,6 +221,24 @@ async function markUnread() {
  * route is POST /mail/messages/:uid/spam — it does the move +
  * flags the message so future scans treat it as known spam.
  */
+/**
+ * Archive the open message — move it to the Archive folder.
+ * No confirm dialog; archive is non-destructive (Gmail UX) so
+ * the user can always go to Archive and move things back.
+ */
+async function archiveMessage() {
+  if (!state.currentMessage || !state.selectedAgent) return;
+  try {
+    const imap = state.folderNames?.[state.selectedFolder] ?? 'INBOX';
+    await apiPost(`/mail/messages/${state.selectedUid}/archive`, { folder: imap }, { agentKey: state.selectedAgent.apiKey });
+    toast('Archived.');
+    location.hash = `#/folder/${state.selectedFolder ?? 'inbox'}`;
+    await loadList(state.selectedAgent, state.selectedFolder);
+  } catch (err) {
+    toast(`Archive failed: ${err.message}`, true);
+  }
+}
+
 async function markSpam() {
   if (!state.currentMessage || !state.selectedAgent) return;
   const ok = await confirmModal({

package/public/js/sidebar.js

@@ -19,6 +19,7 @@ export const FOLDERS = [
   { id: 'starred', label: 'Starred',  icon: 'starOutline' },
   { id: 'sent',    label: 'Sent',     icon: 'sent' },
   { id: 'drafts',  label: 'Drafts',   icon: 'drafts' },
+  { id: 'archive', label: 'Archive',  icon: 'archive' },
   { id: 'all',     label: 'All Mail', icon: 'allMail', requiresDiscovery: true },
   { id: 'spam',    label: 'Spam',     icon: 'spam' },
   { id: 'trash',   label: 'Trash',    icon: 'trash' },

package/public/styles.css

@@ -419,6 +419,27 @@ a { color: var(--accent-strong); }
   font-size: 12px; color: var(--muted);
 }
 
+/* Bulk-action toolbar — appears between select-all and refresh
+   when one or more rows are checked. Replaces the visual idle
+   state of the row (toolbar) with action buttons + a "N selected"
+   indicator on the right. */
+.bulk-actions {
+  display: flex; align-items: center; gap: 4px;
+  margin-left: 8px;
+  padding-left: 12px;
+  border-left: 1px solid var(--line);
+}
+.bulk-actions[hidden] { display: none; }
+.bulk-actions .bulk-btn {
+  width: 36px; height: 36px;
+  color: var(--ink-soft);
+}
+.bulk-actions .bulk-btn:hover { background: var(--bg-hover); color: var(--ink); }
+.bulk-count {
+  font-size: 12px; font-weight: 500; color: var(--accent-strong);
+  margin-left: 8px;
+}
+
 /* Gmail-style compact rows.
    Single line per message; subject + preview share one truncated
    cell so longer previews tail off with ellipsis instead of
@@ -576,6 +597,13 @@ mark.search-hl {
   max-width: 840px;
   margin: 0 auto;
   width: 100%;
+  /* Clear visual end-of-message marker. The reply / quoted-thread
+     chrome above made the body's bottom ambiguous; a hairline rule
+     gives the reader a definite stop and separates from the
+     attachments / next message in stack views. */
+  border-bottom: 1px solid var(--line);
+  padding-bottom: 28px;
+  margin-bottom: 8px;
 }
 .message-body h1, .message-body h2, .message-body h3 {
   color: var(--pink); margin: 1.2em 0 .4em;