@bobfrankston/mailx 1.0.167 → 1.0.169

package/bin/mailx.js

@@ -201,7 +201,7 @@ if (importMode) {
     const wrapper = { accounts: merged };
     if (data?.name)
         wrapper.name = data.name;
-    saveAccounts(merged);
+    await saveAccounts(merged);
     console.log(`Saved ${merged.length} account(s). Run 'mailx' to start.`);
     process.exit(0);
 }

package/client/app.js

@@ -5,7 +5,7 @@
 import { initFolderTree, refreshFolderTree, updateFolderCounts } from "./components/folder-tree.js";
 import { initMessageList, loadMessages, loadUnifiedInbox, loadSearchResults, reloadCurrentFolder, getSelectedMessages } from "./components/message-list.js";
 import { showMessage, getCurrentMessage } from "./components/message-viewer.js";
-import { connectWebSocket, onWsEvent, triggerSync, getAccounts, getFolders, deleteMessages, undeleteMessage, restartServer, rebuildServer, getSyncPending, getVersion, getSettings, saveSettings, getAutocompleteSettings, saveAutocompleteSettings, repairAccounts } from "./lib/api-client.js";
+import { connectWebSocket, onWsEvent, triggerSync, syncAccount, reauthenticate, getAccounts, getFolders, deleteMessages, undeleteMessage, restartServer, rebuildServer, getSyncPending, getVersion, getSettings, saveSettings, getAutocompleteSettings, saveAutocompleteSettings, repairAccounts } from "./lib/api-client.js";
 // ── New message badge (favicon + title) ──
 let baseTitle = "mailx";
 let lastSeenCount = 0;
@@ -641,8 +641,7 @@ onWsEvent((event) => {
                             btn.disabled = true;
                             btn.textContent = "Authenticating...";
                             try {
-                                const res = await fetch(`/api/reauth/${event.accountId}`, { method: "POST" });
-                                const data = await res.json();
+                                const data = await reauthenticate(event.accountId);
                                 if (data.ok) {
                                     hideAlert();
                                     const acctEl = document.getElementById("status-accounts");
@@ -668,8 +667,7 @@ onWsEvent((event) => {
                             btn.disabled = true;
                             btn.textContent = "Syncing...";
                             try {
-                                const res = await fetch(`/api/sync/${event.accountId}`, { method: "POST" });
-                                const data = await res.json();
+                                const data = await syncAccount(event.accountId);
                                 if (data.ok) {
                                     hideAlert();
                                     const acctEl = document.getElementById("status-accounts");

package/client/components/message-list.js

@@ -86,6 +86,8 @@ export function reloadCurrentFolder() {
 }
 /** Load unified inbox (all accounts) */
 export async function loadUnifiedInbox(autoSelect = true) {
+    if (autoSelect)
+        clearViewer();
     unifiedMode = true;
     currentPage = 1;
     totalMessages = 0;

package/client/lib/api-client.js

@@ -6,7 +6,9 @@
  * All server operations MUST go through these centralized methods.
  * Never use fetch("/api/...") directly in components.
  */
-const hasIPC = typeof mailxapi !== "undefined" && mailxapi?.isApp;
+// In popup windows (compose), mailxapi isn't injected — fall back to opener's bridge
+const _ipc = typeof mailxapi !== "undefined" ? mailxapi : window.opener?.mailxapi;
+const hasIPC = _ipc?.isApp === true;
 // ── HTTP fallback ──
 // Abort controller for message-list requests — cancel stale fetches when folder changes
 let messageListAbort = null;
@@ -44,29 +46,29 @@ async function api(path, options) {
 // ── API Methods (IPC or HTTP) ──
 export function getAccounts() {
     if (hasIPC)
-        return mailxapi.getAccounts();
+        return _ipc.getAccounts();
     return api("/accounts");
 }
 export function getFolders(accountId) {
     if (hasIPC)
-        return mailxapi.getFolders(accountId);
+        return _ipc.getFolders(accountId);
     return api(`/folders/${accountId}`);
 }
 export function getMessages(accountId, folderId, page = 1, pageSize = 50) {
     if (hasIPC)
-        return mailxapi.getMessages(accountId, folderId, page, pageSize);
+        return _ipc.getMessages(accountId, folderId, page, pageSize);
     const signal = newMessageListSignal();
     return api(`/messages/${accountId}/${folderId}?page=${page}&pageSize=${pageSize}`, { signal });
 }
 export function getUnifiedInbox(page = 1, pageSize = 50) {
     if (hasIPC)
-        return mailxapi.getUnifiedInbox(page, pageSize);
+        return _ipc.getUnifiedInbox(page, pageSize);
     const signal = newMessageListSignal();
     return api(`/messages/unified/inbox?page=${page}&pageSize=${pageSize}`, { signal });
 }
 export function searchMessages(query, page = 1, pageSize = 50, scope = "all", accountId = "", folderId = 0) {
     if (hasIPC)
-        return mailxapi.searchMessages(query, page, pageSize);
+        return _ipc.searchMessages(query, page, pageSize);
     const params = new URLSearchParams({ q: query, page: String(page), pageSize: String(pageSize), scope });
     if (scope === "current" && accountId) {
         params.set("accountId", accountId);
@@ -80,7 +82,7 @@ export function searchMessages(query, page = 1, pageSize = 50, scope = "all", ac
 }
 export function getMessage(accountId, uid, allowRemote = false, folderId) {
     if (hasIPC)
-        return mailxapi.getMessage(accountId, uid, allowRemote, folderId);
+        return _ipc.getMessage(accountId, uid, allowRemote, folderId);
     const params = new URLSearchParams();
     if (allowRemote)
         params.set("allowRemote", "true");
@@ -91,7 +93,7 @@ export function getMessage(accountId, uid, allowRemote = false, folderId) {
 }
 export function updateFlags(accountId, uid, flags) {
     if (hasIPC)
-        return mailxapi.updateFlags(accountId, uid, flags);
+        return _ipc.updateFlags(accountId, uid, flags);
     return api(`/message/${accountId}/${uid}/flags`, {
         method: "PATCH",
         body: JSON.stringify({ flags })
@@ -99,22 +101,32 @@ export function updateFlags(accountId, uid, flags) {
 }
 export function triggerSync() {
     if (hasIPC)
-        return mailxapi.syncAll();
+        return _ipc.syncAll();
     return api("/sync", { method: "POST" });
 }
+export function syncAccount(accountId) {
+    if (hasIPC)
+        return _ipc.syncAccount(accountId);
+    return api(`/sync/${accountId}`, { method: "POST" });
+}
+export function reauthenticate(accountId) {
+    if (hasIPC)
+        return _ipc.reauthenticate(accountId);
+    return api(`/reauth/${accountId}`, { method: "POST" });
+}
 export function getSyncPending() {
     if (hasIPC)
-        return mailxapi.getSyncPending();
+        return _ipc.getSyncPending();
     return api("/sync/pending");
 }
 export function searchContacts(query) {
     if (hasIPC)
-        return mailxapi.searchContacts(query);
+        return _ipc.searchContacts(query);
     return api(`/contacts?q=${encodeURIComponent(query)}`);
 }
 export function allowRemoteContent(type, value) {
     if (hasIPC)
-        return mailxapi.allowRemoteContent(type, value);
+        return _ipc.allowRemoteContent(type, value);
     return api("/settings/allow-remote", {
         method: "POST",
         body: JSON.stringify({ type, value })
@@ -122,14 +134,14 @@ export function allowRemoteContent(type, value) {
 }
 export function deleteMessage(accountId, uid) {
     if (hasIPC)
-        return mailxapi.deleteMessage?.(accountId, uid);
+        return _ipc.deleteMessage?.(accountId, uid);
     return api(`/message/${accountId}/${uid}`, { method: "DELETE" });
 }
 export function deleteMessages(accountId, uids) {
     if (uids.length === 1)
         return deleteMessage(accountId, uids[0]);
     if (hasIPC)
-        return mailxapi.deleteMessages?.(accountId, uids);
+        return _ipc.deleteMessages?.(accountId, uids);
     return api("/messages/delete", {
         method: "POST", body: JSON.stringify({ accountId, uids })
     });
@@ -138,7 +150,7 @@ export function moveMessages(accountId, uids, targetFolderId, targetAccountId) {
     if (uids.length === 1)
         return moveMessage(accountId, uids[0], targetFolderId, targetAccountId);
     if (hasIPC)
-        return mailxapi.moveMessages?.(accountId, uids, targetFolderId, targetAccountId);
+        return _ipc.moveMessages?.(accountId, uids, targetFolderId, targetAccountId);
     const body = { accountId, uids, targetFolderId };
     if (targetAccountId)
         body.targetAccountId = targetAccountId;
@@ -148,7 +160,7 @@ export function moveMessages(accountId, uids, targetFolderId, targetAccountId) {
 }
 export function undeleteMessage(accountId, uid, folderId) {
     if (hasIPC)
-        return mailxapi.undeleteMessage?.(accountId, uid, folderId);
+        return _ipc.undeleteMessage?.(accountId, uid, folderId);
     return api(`/message/${accountId}/${uid}/undelete`, {
         method: "POST",
         body: JSON.stringify({ folderId })
@@ -156,7 +168,7 @@ export function undeleteMessage(accountId, uid, folderId) {
 }
 export function moveMessage(accountId, uid, targetFolderId, targetAccountId) {
     if (hasIPC)
-        return mailxapi.moveMessage?.(accountId, uid, targetFolderId, targetAccountId);
+        return _ipc.moveMessage?.(accountId, uid, targetFolderId, targetAccountId);
     const body = { targetFolderId };
     if (targetAccountId)
         body.targetAccountId = targetAccountId;
@@ -167,7 +179,7 @@ export function moveMessage(accountId, uid, targetFolderId, targetAccountId) {
 }
 export function restartServer() {
     if (hasIPC)
-        return mailxapi.restart?.();
+        return _ipc.restart?.();
     return api("/restart", { method: "POST" }).catch(() => { });
 }
 export function rebuildServer() {
@@ -175,12 +187,12 @@ export function rebuildServer() {
 }
 export function markFolderRead(accountId, folderId) {
     if (hasIPC)
-        return mailxapi.markFolderRead?.(accountId, folderId);
+        return _ipc.markFolderRead?.(accountId, folderId);
     return api(`/folder/${accountId}/${folderId}/mark-read`, { method: "POST" });
 }
 export function createFolder(accountId, parentPath, name) {
     if (hasIPC)
-        return mailxapi.createFolder?.(accountId, parentPath, name);
+        return _ipc.createFolder?.(accountId, parentPath, name);
     return api(`/folder/${accountId}`, {
         method: "POST",
         body: JSON.stringify({ parentPath, name })
@@ -188,7 +200,7 @@ export function createFolder(accountId, parentPath, name) {
 }
 export function renameFolder(accountId, folderId, newName) {
     if (hasIPC)
-        return mailxapi.renameFolder?.(accountId, folderId, newName);
+        return _ipc.renameFolder?.(accountId, folderId, newName);
     return api(`/folder/${accountId}/${folderId}/rename`, {
         method: "POST",
         body: JSON.stringify({ newName })
@@ -196,22 +208,22 @@ export function renameFolder(accountId, folderId, newName) {
 }
 export function deleteFolder(accountId, folderId) {
     if (hasIPC)
-        return mailxapi.deleteFolder?.(accountId, folderId);
+        return _ipc.deleteFolder?.(accountId, folderId);
     return api(`/folder/${accountId}/${folderId}`, { method: "DELETE" });
 }
 export function emptyFolder(accountId, folderId) {
     if (hasIPC)
-        return mailxapi.emptyFolder?.(accountId, folderId);
+        return _ipc.emptyFolder?.(accountId, folderId);
     return api(`/folder/${accountId}/${folderId}/empty`, { method: "POST" });
 }
 export function sendMessage(body) {
     if (hasIPC)
-        return mailxapi.sendMessage?.(body);
+        return _ipc.sendMessage?.(body);
     return api("/send", { method: "POST", body: JSON.stringify(body) });
 }
 export function saveDraft(body) {
     if (hasIPC)
-        return mailxapi.saveDraft?.(body);
+        return _ipc.saveDraft?.(body);
     return api("/draft", { method: "POST", body: JSON.stringify(body) });
 }
 const eventHandlers = [];
@@ -221,7 +233,7 @@ export function onEvent(handler) {
 export function connectEvents() {
     if (hasIPC) {
         // IPC events come via mailxapi.onEvent
-        mailxapi.onEvent((event) => {
+        _ipc.onEvent((event) => {
             for (const h of eventHandlers)
                 h(event);
         });
@@ -246,47 +258,47 @@ export function connectEvents() {
 // ── Autocomplete ──
 export function autocomplete(body, signal) {
     if (hasIPC)
-        return mailxapi.autocomplete?.(body);
+        return _ipc.autocomplete?.(body);
     return api("/autocomplete", { method: "POST", body: JSON.stringify(body), signal });
 }
 export function getAutocompleteSettings() {
     if (hasIPC)
-        return mailxapi.getAutocompleteSettings?.();
+        return _ipc.getAutocompleteSettings?.();
     return api("/autocomplete/settings");
 }
 export function saveAutocompleteSettings(settings) {
     if (hasIPC)
-        return mailxapi.saveAutocompleteSettings?.(settings);
+        return _ipc.saveAutocompleteSettings?.(settings);
     return api("/autocomplete/settings", { method: "POST", body: JSON.stringify(settings) });
 }
 export function getVersion() {
     if (hasIPC)
-        return mailxapi.getVersion();
+        return _ipc.getVersion();
     return api("/version");
 }
 export function getSettings() {
     if (hasIPC)
-        return mailxapi.getSettings();
+        return _ipc.getSettings();
     return api("/settings");
 }
 export function saveSettings(settings) {
     if (hasIPC)
-        return mailxapi.saveSettingsData?.(settings);
+        return _ipc.saveSettingsData?.(settings);
     return api("/settings", { method: "PUT", body: JSON.stringify(settings) });
 }
 export function repairAccounts() {
     if (hasIPC)
-        return mailxapi.repairAccounts?.();
+        return _ipc.repairAccounts?.();
     return api("/repair-accounts", { method: "POST" });
 }
 export function deleteDraft(accountId, draftUid) {
     if (hasIPC)
-        return mailxapi.deleteDraft?.(accountId, draftUid);
+        return _ipc.deleteDraft?.(accountId, draftUid);
     return api("/draft", { method: "DELETE", body: JSON.stringify({ accountId, draftUid }) });
 }
 export function setupAccount(name, email, password) {
     if (hasIPC)
-        return mailxapi.setupAccount?.(name, email, password);
+        return _ipc.setupAccount?.(name, email, password);
     return api("/setup", { method: "POST", body: JSON.stringify({ name, email, password }) });
 }
 // Legacy exports for backward compatibility

package/client/lib/mailxapi.js

@@ -103,7 +103,9 @@
 
         // Sync
         syncAll: function() { return callNode("syncAll"); },
+        syncAccount: function(accountId) { return callNode("syncAccount", { accountId: accountId }); },
         getSyncPending: function() { return callNode("getSyncPending"); },
+        reauthenticate: function(accountId) { return callNode("reauthenticate", { accountId: accountId }); },
 
         // Bulk operations
         deleteMessages: function(accountId, uids) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx",
-  "version": "1.0.167",
+  "version": "1.0.169",
   "description": "Local-first email client with IMAP sync and standalone native app",
   "type": "module",
   "main": "bin/mailx.js",
@@ -20,11 +20,11 @@
     "postinstall": "node bin/postinstall.js"
   },
   "dependencies": {
-    "@bobfrankston/iflow-direct": "^0.1.2",
+    "@bobfrankston/iflow-direct": "^0.1.3",
     "@bobfrankston/iflow-node": "^0.1.1",
     "@bobfrankston/miscinfo": "^1.0.7",
     "@bobfrankston/oauthsupport": "^1.0.20",
-    "@bobfrankston/msger": "^0.1.217",
+    "@bobfrankston/msger": "^0.1.219",
     "@capacitor/android": "^8.3.0",
     "@capacitor/cli": "^8.3.0",
     "@capacitor/core": "^8.3.0",

package/packages/mailx-core/index.d.ts

@@ -113,7 +113,7 @@ export declare function getSyncPending(): {
 export declare function allowRemoteContent(params: {
     type: string;
     value: string;
-}): void;
+}): Promise<void>;
 export declare function getSettings(): import("@bobfrankston/mailx-types").MailxSettings;
 export declare function saveSettingsData(data: any): void;
 export declare function rebuildSearchIndex(): number;

package/packages/mailx-core/index.js

@@ -312,7 +312,7 @@ export async function syncAll() {
 export function getSyncPending() {
     return { pending: db.getTotalPendingSyncCount() };
 }
-export function allowRemoteContent(params) {
+export async function allowRemoteContent(params) {
     const list = loadAllowlist();
     if (params.type === "sender" && !list.senders.includes(params.value))
         list.senders.push(params.value);
@@ -324,7 +324,7 @@ export function allowRemoteContent(params) {
         if (!list.recipients.includes(params.value))
             list.recipients.push(params.value);
     }
-    saveAllowlist(list);
+    await saveAllowlist(list);
 }
 export function getSettings() {
     return loadSettings();

package/packages/mailx-imap/index.d.ts

@@ -94,7 +94,7 @@ export declare class ImapManager extends EventEmitter {
      *  If message count changed, triggers inbox sync for that account. */
     private lastInboxCounts;
     private quickCheckRunning;
-    /** Check a single account's inbox */
+    /** Check a single account's inbox — uses its own connection, never blocked by sync */
     quickInboxCheckAccount(accountId: string): Promise<void>;
     /** Check all accounts (used by legacy callers) */
     quickInboxCheck(): Promise<void>;

package/packages/mailx-imap/index.js

@@ -323,7 +323,7 @@ export class ImapManager extends EventEmitter {
             if (!fs.existsSync(credPath)) {
                 try {
                     const pkgDir = path.dirname(import.meta.resolve("@bobfrankston/iflow-direct").replace("file:///", "").replace("file://", ""));
-                    for (const name of ["credentials.json", "iflow-credentials.json"]) {
+                    for (const name of ["iflow-credentials.json"]) {
                         const p = path.join(pkgDir, name);
                         if (fs.existsSync(p)) {
                             credPath = p;
@@ -338,6 +338,7 @@ export class ImapManager extends EventEmitter {
                 const result = await authenticateOAuth(credPath, {
                     scope: "https://mail.google.com/ https://www.googleapis.com/auth/contacts.readonly",
                     tokenDirectory: tokenDir,
+                    credentialsKey: "installed",
                     loginHint: account.imap.user,
                 });
                 return result?.access_token || "";
@@ -825,31 +826,39 @@ export class ImapManager extends EventEmitter {
      *  If message count changed, triggers inbox sync for that account. */
     lastInboxCounts = new Map();
     quickCheckRunning = new Set(); // per-account guard
-    /** Check a single account's inbox */
+    /** Check a single account's inbox — uses its own connection, never blocked by sync */
     async quickInboxCheckAccount(accountId) {
-        if (this.quickCheckRunning.has(accountId) || this.syncing || this.inboxSyncing)
+        if (this.quickCheckRunning.has(accountId))
             return;
         if (this.reauthenticating.has(accountId))
             return;
         this.quickCheckRunning.add(accountId);
+        let client = null;
         try {
             const inbox = this.db.getFolders(accountId).find(f => f.specialUse === "inbox");
             if (!inbox)
                 return;
-            await this.withConnection(accountId, async (client) => {
-                const count = await client.getMessagesCount("INBOX");
-                const prev = this.lastInboxCounts.get(accountId) ?? count;
-                this.lastInboxCounts.set(accountId, count);
-                if (count !== prev) {
-                    console.log(`  [check] ${accountId} INBOX: ${prev} → ${count}`);
-                    await this.syncFolder(accountId, inbox.id, client);
-                }
-            });
+            client = this.newClient(accountId);
+            const count = await client.getMessagesCount("INBOX");
+            const prev = this.lastInboxCounts.get(accountId) ?? count;
+            this.lastInboxCounts.set(accountId, count);
+            if (count !== prev) {
+                console.log(`  [check] ${accountId} INBOX: ${prev} → ${count}`);
+                await this.syncFolder(accountId, inbox.id, client);
+            }
+            await client.logout();
+            client = null;
         }
         catch {
             // Lightweight check — silently ignore errors
         }
         finally {
+            if (client) {
+                try {
+                    await client.logout();
+                }
+                catch { /* */ }
+            }
             this.quickCheckRunning.delete(accountId);
         }
     }
@@ -867,7 +876,8 @@ export class ImapManager extends EventEmitter {
         //   Password (Dovecot etc): every 60s — conservative, 20-connection limit
         // IDLE gives instant notification when working; STATUS is the fallback.
         for (const [accountId] of this.configs) {
-            const interval = this.isOAuthAccount(accountId) ? 15000 : 60000;
+            const QUICK_CHECK_INTERVAL = 2500; // STATUS INBOX is one command, very cheap
+            const interval = QUICK_CHECK_INTERVAL;
             const timer = setInterval(() => {
                 this.quickInboxCheckAccount(accountId).catch(() => { });
             }, interval);

package/packages/mailx-service/index.d.ts

@@ -20,7 +20,7 @@ export declare class MailxService {
     getMessages(accountId: string, folderId: number, page?: number, pageSize?: number, sort?: string, sortDir?: string, search?: string): any;
     getMessage(accountId: string, uid: number, allowRemote?: boolean, folderId?: number): Promise<any>;
     updateFlags(accountId: string, uid: number, flags: string[]): Promise<void>;
-    allowRemoteContent(type: "sender" | "domain" | "recipient", value: string): void;
+    allowRemoteContent(type: "sender" | "domain" | "recipient", value: string): Promise<void>;
     search(q: string, page?: number, pageSize?: number, scope?: string, accountId?: string, folderId?: number): Promise<any>;
     rebuildSearchIndex(): number;
     getSyncPending(): {

package/packages/mailx-service/index.js

@@ -213,7 +213,7 @@ export class MailxService {
         await this.imapManager.updateFlagsLocal(accountId, uid, envelope?.folderId || 0, flags);
     }
     // ── Remote content allow-list ──
-    allowRemoteContent(type, value) {
+    async allowRemoteContent(type, value) {
         const list = loadAllowlist();
         if (type === "sender" && !list.senders.includes(value))
             list.senders.push(value);
@@ -225,7 +225,7 @@ export class MailxService {
             if (!list.recipients.includes(value))
                 list.recipients.push(value);
         }
-        saveAllowlist(list);
+        await saveAllowlist(list);
         console.log(`  [allow] Added ${type}: ${value}`);
     }
     // ── Search ──
@@ -571,7 +571,7 @@ export class MailxService {
             account.smtp = { host: detected.smtpHost, port: 587, tls: true, auth: detected.auth, user: email };
         }
         account.id = domain.split(".")[0] || "account";
-        saveAccounts([account]);
+        await saveAccounts([account]);
         // Re-read normalized settings and register
         const settings = loadSettings();
         for (const acct of settings.accounts) {
@@ -603,7 +603,7 @@ export class MailxService {
         if (restored.length === 0) {
             return { ok: false, error: "Could not parse cached account configs" };
         }
-        saveAccounts(restored);
+        await saveAccounts(restored);
         for (const acct of restored) {
             try {
                 await this.imapManager.addAccount(acct);

package/packages/mailx-service/jsonrpc.js

@@ -82,8 +82,13 @@ async function dispatchAction(svc, action, p) {
         case "syncAll":
             await svc.syncAll();
             return { ok: true };
+        case "syncAccount":
+            await svc.syncAccount(p.accountId);
+            return { ok: true };
         case "getSyncPending":
             return svc.getSyncPending();
+        case "reauthenticate":
+            return { ok: await svc.reauthenticate(p.accountId) };
         // Search & contacts
         case "searchMessages":
             return svc.search(p.query, p.page, p.pageSize, p.scope, p.accountId, p.folderId);

package/packages/mailx-settings/cloud.js

@@ -31,7 +31,7 @@ function findGoogleCredentials() {
         let dir = import.meta.dirname;
         for (let i = 0; i < 5; i++) {
             for (const pkg of ["iflow-direct", "iflow"]) {
-                for (const name of ["iflow-credentials.json", "credentials.json"]) {
+                for (const name of ["iflow-credentials.json"]) {
                     const p = path.join(dir, "node_modules", "@bobfrankston", pkg, name);
                     if (fs.existsSync(p))
                         return p;

package/packages/mailx-settings/index.d.ts

@@ -65,7 +65,8 @@ export declare function loadAccounts(): AccountConfig[];
 /** Load accounts with cloud API fallback (async — use when cloud settings may not be mounted) */
 export declare function loadAccountsAsync(): Promise<AccountConfig[]>;
 /** Save account configs */
-export declare function saveAccounts(accounts: AccountConfig[]): void;
+/** Save accounts — merges with cloud copy by email (multi-client safe) */
+export declare function saveAccounts(accounts: AccountConfig[]): Promise<void>;
 /** Load preferences (shared + local overrides, with legacy fallback) */
 export declare function loadPreferences(): typeof DEFAULT_PREFERENCES;
 /** Save preferences */
@@ -76,12 +77,12 @@ export declare function loadAutocomplete(): AutocompleteSettings;
 export declare function saveAutocomplete(settings: AutocompleteSettings): void;
 /** Load remote content allow-list */
 export declare function loadAllowlist(): typeof DEFAULT_ALLOWLIST;
-/** Save allow-list */
-export declare function saveAllowlist(list: typeof DEFAULT_ALLOWLIST): void;
+/** Save allow-list — merges with existing cloud copy (multi-client safe) */
+export declare function saveAllowlist(list: typeof DEFAULT_ALLOWLIST): Promise<void>;
 /** Load settings — unified view combining all files (backward compatible) */
 export declare function loadSettings(): MailxSettings;
 /** Save settings — writes to split files */
-export declare function saveSettings(settings: MailxSettings): void;
+export declare function saveSettings(settings: MailxSettings): Promise<void>;
 /** Get the local store base path */
 export declare function getStorePath(): string;
 /** Get the local data directory (DB, store, etc.) */

package/packages/mailx-settings/index.js

@@ -454,7 +454,26 @@ export async function loadAccountsAsync() {
     return [];
 }
 /** Save account configs */
-export function saveAccounts(accounts) {
+/** Save accounts — merges with cloud copy by email (multi-client safe) */
+export async function saveAccounts(accounts) {
+    // Merge with cloud: keep all accounts, deduplicate by normalized email
+    try {
+        const cloudContent = await cloudRead("accounts.jsonc");
+        if (cloudContent) {
+            const cloud = parseJsonc(cloudContent);
+            const cloudAccts = cloud?.accounts || (Array.isArray(cloud) ? cloud : []);
+            if (cloudAccts.length > 0) {
+                const seen = new Set(accounts.map(a => normalizeEmail(a.email)));
+                for (const ca of cloudAccts) {
+                    if (ca.email && !seen.has(normalizeEmail(ca.email))) {
+                        accounts.push(ca);
+                        seen.add(normalizeEmail(ca.email));
+                    }
+                }
+            }
+        }
+    }
+    catch { /* cloud read failed — save local version */ }
     saveFile("accounts.jsonc", { accounts });
 }
 /** Load preferences (shared + local overrides, with legacy fallback) */
@@ -496,9 +515,26 @@ export function saveAutocomplete(settings) {
 export function loadAllowlist() {
     return loadFile("allowlist.jsonc", DEFAULT_ALLOWLIST);
 }
-/** Save allow-list */
-export function saveAllowlist(list) {
-    saveFile("allowlist.jsonc", list);
+/** Save allow-list — merges with existing cloud copy (multi-client safe) */
+export async function saveAllowlist(list) {
+    // Read current cloud version and merge (other clients may have added entries)
+    let merged = { ...list };
+    try {
+        const cloudContent = await cloudRead("allowlist.jsonc");
+        if (cloudContent) {
+            const cloud = parseJsonc(cloudContent);
+            if (cloud) {
+                const mergeArrays = (local, remote) => [...new Set([...local, ...remote])];
+                merged = {
+                    senders: mergeArrays(list.senders || [], cloud.senders || []),
+                    domains: mergeArrays(list.domains || [], cloud.domains || []),
+                    recipients: mergeArrays(list.recipients || [], cloud.recipients || []),
+                };
+            }
+        }
+    }
+    catch { /* cloud read failed — save local version */ }
+    saveFile("allowlist.jsonc", merged);
 }
 // ── Legacy compatibility ──
 function loadLegacySettings() {
@@ -529,8 +565,8 @@ export function loadSettings() {
     };
 }
 /** Save settings — writes to split files */
-export function saveSettings(settings) {
-    saveAccounts(settings.accounts);
+export async function saveSettings(settings) {
+    await saveAccounts(settings.accounts);
     savePreferences({ ui: settings.ui, sync: settings.sync });
 }
 /** Get the local store base path */