@bobfrankston/mailx-imap 0.1.140 → 0.1.144

package/index.d.ts

@@ -60,6 +60,23 @@ export declare class ImapManager extends EventEmitter {
     private configs;
     private watchers;
     private watcherClients;
+    /** Accounts whose IDLE watcher is mid-establish. `watchers` only gains an
+     *  entry AFTER connect+login+SELECT+IDLE completes (seconds), so two
+     *  overlapping startWatching() sweeps both see "no watcher" and both open
+     *  a socket — a duplicate IDLE connection per account. Bob 2026-08-05:
+     *  boot's startWatching was still in flight when the 60s deadman fired,
+     *  giving two watchers each for bobma/gmail and pushing aol into
+     *  "[LIMIT] LOGIN Rate limit hit". This set closes that window. */
+    private watchStarting;
+    /** Accounts whose IDLE watcher was refused for a CREDENTIAL reason, with
+     *  the error text. Retrying those every 60s forever is pure waste: the
+     *  outlook account has failed `AUTHENTICATE failed.` on every boot for
+     *  weeks (its mail syncs over Graph, so nothing is lost — but each attempt
+     *  burns a connection slot and buries the log). Suppressed until the
+     *  account re-authenticates, which clears the entry. Transient refusals
+     *  (rate limits, network) are NOT recorded here — they keep the normal
+     *  60s deadman cadence. */
+    private watchAuthFailed;
     private fetchClients;
     /** The Store is the architectural nexus — owner of MailxDB +
      *  FileMessageStore + the event bus. This package (mailx-imap) is a

package/index.js

@@ -202,6 +202,23 @@ export class ImapManager extends EventEmitter {
     // (folder syncs holding all permits, timing out at 360s), leaving new mail
     // on 5-min polling for minutes at a time (Bob 2026-05-28).
     watcherClients = new Map();
+    /** Accounts whose IDLE watcher is mid-establish. `watchers` only gains an
+     *  entry AFTER connect+login+SELECT+IDLE completes (seconds), so two
+     *  overlapping startWatching() sweeps both see "no watcher" and both open
+     *  a socket — a duplicate IDLE connection per account. Bob 2026-08-05:
+     *  boot's startWatching was still in flight when the 60s deadman fired,
+     *  giving two watchers each for bobma/gmail and pushing aol into
+     *  "[LIMIT] LOGIN Rate limit hit". This set closes that window. */
+    watchStarting = new Set();
+    /** Accounts whose IDLE watcher was refused for a CREDENTIAL reason, with
+     *  the error text. Retrying those every 60s forever is pure waste: the
+     *  outlook account has failed `AUTHENTICATE failed.` on every boot for
+     *  weeks (its mail syncs over Graph, so nothing is lost — but each attempt
+     *  burns a connection slot and buries the log). Suppressed until the
+     *  account re-authenticates, which clears the entry. Transient refusals
+     *  (rate limits, network) are NOT recorded here — they keep the normal
+     *  60s deadman cadence. */
+    watchAuthFailed = new Map();
     fetchClients = new Map();
     /** The Store is the architectural nexus — owner of MailxDB +
      *  FileMessageStore + the event bus. This package (mailx-imap) is a
@@ -363,6 +380,9 @@ export class ImapManager extends EventEmitter {
             if (config?.tokenProvider) {
                 console.log(`  [reauth] ${accountId}: success`);
                 this.accountErrorShown.delete(accountId);
+                // Fresh credentials — let IDLE try again on an account whose
+                // watcher was suppressed for an auth failure.
+                this.watchAuthFailed.delete(accountId);
                 this.syncInbox().catch(() => { });
                 return true;
             }
@@ -895,6 +915,15 @@ export class ImapManager extends EventEmitter {
         const skipSemaphore = purpose === "idle";
         const releaseHostSlot = skipSemaphore ? (() => { }) : await this.acquireHostSlot(host);
         let client;
+        // Forward declaration: the connect wrapper below is DEFINED here but
+        // only CALLED after newClient returns, by which time the real
+        // markClosed is installed. A connect that throws (aol "[LIMIT] LOGIN
+        // Rate limit hit", outlook "AUTHENTICATE failed") used to leave the
+        // client registered in openClients forever AND never release its host
+        // semaphore permit — the counter climbed to 141 over a 37-hour session
+        // (Bob 2026-08-05 shutdown log) and every leaked permit is one fewer
+        // concurrent connection that account can ever open again.
+        let markClosed = () => { };
         try {
             // Verbose IMAP wire trace — diagnostic for silently-hanging
             // commands. It was left permanently ON for the ops/fast lanes, but
@@ -946,10 +975,21 @@ export class ImapManager extends EventEmitter {
                         const total = Date.now() - connT0;
                         if (total > 3000)
                             console.log(`  [conn-slow] ${accountId} (${purpose}): connect took ${total}ms — ${phaseTimings()}`);
+                        // A socket that dies on its own — server drop, TLS
+                        // reset, idle timeout — never routes through
+                        // logout()/destroy(), so without this the connection
+                        // stays "open" in our books and its semaphore permit
+                        // is gone for the life of the process. Node always
+                        // emits 'close' after 'error', so one listener covers
+                        // both.
+                        const sock = client?.native?.transport?.socket;
+                        if (typeof sock?.once === "function")
+                            sock.once("close", () => markClosed("socket-close"));
                         return r;
                     }
                     catch (e) {
                         emitPhase("failed", e?.message || String(e));
+                        markClosed("connect-failed");
                         throw e;
                     }
                 };
@@ -967,10 +1007,17 @@ export class ImapManager extends EventEmitter {
         open.add(client);
         console.log(`  [conn+] ${accountId} (${purpose}) — ${open.size} open`);
         let closed = false;
-        const markClosed = (how) => {
+        markClosed = (how) => {
             if (closed)
                 return;
             closed = true;
+            // Flag the client itself so the IDLE watcher health-check (which
+            // inspects `_dead` alongside the raw socket state) re-establishes
+            // a watcher whose socket died under it.
+            try {
+                client._dead = true;
+            }
+            catch { /* frozen client — the socket checks still catch it */ }
             open.delete(client);
             releaseHostSlot();
             console.log(`  [conn-] ${accountId} (${purpose}/${how}) — ${open.size} open`);
@@ -3101,15 +3148,28 @@ export class ImapManager extends EventEmitter {
         // accounts with healthy IDLE are skipped). One log line per
         // detected gap so a chronically failing account is obvious in
         // the log.
+        //
+        // startWatching() sweeps EVERY account, so it must be called at most
+        // once per tick: the old per-account call meant N missing accounts →
+        // N concurrent sweeps, and since `watchers` is only populated after
+        // the connect completes, every sweep opened its own socket for every
+        // account (Bob 2026-08-05 boot: two IDLE watchers each for bobma and
+        // gmail, aol refused with "[LIMIT] LOGIN Rate limit hit").
         const deadmanInterval = setInterval(() => {
+            const missing = [];
             for (const [accountId] of this.configs) {
                 if (this.isApiAccount(accountId))
                     continue; // Gmail/Outlook = API, no IDLE
                 if (this.watchers.has(accountId))
                     continue;
-                console.log(`  [idle-deadman] ${accountId}: no IDLE watcher — attempting restart`);
-                this.startWatching().catch(e => console.error(`  [idle-deadman] ${accountId} restart failed: ${e?.message || e}`));
+                if (this.watchStarting.has(accountId))
+                    continue; // first attempt still connecting
+                missing.push(accountId);
             }
+            if (missing.length === 0)
+                return;
+            console.log(`  [idle-deadman] no IDLE watcher for ${missing.join(", ")} — attempting restart`);
+            this.startWatching().catch(e => console.error(`  [idle-deadman] restart failed: ${e?.message || e}`));
         }, 60_000);
         this.syncIntervals.set("idle-deadman", deadmanInterval);
         // Sync actions (sends + flags/deletes/moves) every 30 seconds — skip during active sync
@@ -3206,6 +3266,20 @@ export class ImapManager extends EventEmitter {
                 this.watchers.delete(accountId);
                 this.watcherClients.delete(accountId);
             }
+            // Another sweep is already connecting this account. `watchers`
+            // stays empty for the whole connect+login+SELECT+IDLE round trip,
+            // so without this the second sweep opens a duplicate IDLE socket
+            // (and on connection-limited servers the duplicate is what gets
+            // refused). See the watchStarting field comment.
+            if (this.watchStarting.has(accountId)) {
+                console.log(`  [idle] ${accountId}: watcher already being established — skipping duplicate`);
+                continue;
+            }
+            // Credentials were refused last time. Don't re-offer them every
+            // 60s — wait for a re-auth to clear this. See watchAuthFailed.
+            if (this.watchAuthFailed.has(accountId))
+                continue;
+            this.watchStarting.add(accountId);
             try {
                 // IDLE keeps its own dedicated socket — once the connection
                 // is parked in IDLE, it's unusable for any other command, so
@@ -3305,6 +3379,20 @@ export class ImapManager extends EventEmitter {
                     ? parts.join(" ")
                     : `<no message> ${typeof e} ${e?.constructor?.name || ""}`.trim();
                 console.error(`  [idle] Failed to watch ${accountId}: ${desc}`);
+                // Separate "these credentials are wrong" from "the server is
+                // busy right now". A rate limit ([LIMIT] LOGIN Rate limit hit
+                // — aol does this when we over-connect) says nothing about the
+                // credentials and must stay retryable, so it is checked FIRST
+                // even though its text also contains "Login failed".
+                const transient = /\[LIMIT\]|rate limit|too many|try again|timed? ?out|ECONNRESET|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|socket/i.test(desc);
+                const authFailed = !transient && /authenticat|login failed|AUTHENTICATIONFAILED|invalid credential|password|\[AUTH/i.test(desc);
+                if (authFailed) {
+                    this.watchAuthFailed.set(accountId, desc);
+                    console.error(`  [idle] ${accountId}: credentials refused — suppressing IDLE retries until this account re-authenticates`);
+                }
+            }
+            finally {
+                this.watchStarting.delete(accountId);
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-imap",
-  "version": "0.1.140",
+  "version": "0.1.144",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
@@ -11,8 +11,8 @@
   "dependencies": {
     "@bobfrankston/mailx-types": "^0.1.38",
     "@bobfrankston/mailx-settings": "^0.1.48",
-    "@bobfrankston/mailx-store": "^0.1.79",
-    "@bobfrankston/iflow-direct": "^0.1.63",
+    "@bobfrankston/mailx-store": "^0.1.80",
+    "@bobfrankston/iflow-direct": "^0.1.65",
     "@bobfrankston/tcp-transport": "^0.1.8",
     "@bobfrankston/smtp-direct": "^0.1.9",
     "@bobfrankston/mailx-sync": "^0.1.29",
@@ -39,8 +39,8 @@
     "dependencies": {
       "@bobfrankston/mailx-types": "^0.1.38",
       "@bobfrankston/mailx-settings": "^0.1.48",
-      "@bobfrankston/mailx-store": "^0.1.79",
-      "@bobfrankston/iflow-direct": "^0.1.63",
+      "@bobfrankston/mailx-store": "^0.1.80",
+      "@bobfrankston/iflow-direct": "^0.1.65",
       "@bobfrankston/tcp-transport": "^0.1.8",
       "@bobfrankston/smtp-direct": "^0.1.9",
       "@bobfrankston/mailx-sync": "^0.1.29",