@bobfrankston/mailx 1.0.317 → 1.0.327

package/bin/build-icon-ico.js

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+/**
+ * Wrap client/icon.png into client/icon.ico using the ICO-with-embedded-PNG
+ * format (Windows Vista+). No image decoding needed — Windows accepts a PNG
+ * bitstream inside an ICONDIR + ICONDIRENTRY prelude, so we can hand-roll the
+ * binary without any imaging dependency.
+ *
+ * Run: node bin/build-icon-ico.js
+ *
+ * Output: client/icon.ico derived from client/icon.png. Re-run whenever the
+ * source PNG changes.
+ */
+import fs from "node:fs";
+import path from "node:path";
+
+const root = path.resolve(import.meta.dirname, "..");
+const src = path.join(root, "client", "icon.png");
+const dst = path.join(root, "client", "icon.ico");
+
+if (!fs.existsSync(src)) {
+    console.error(`build-icon-ico: source not found: ${src}`);
+    process.exit(1);
+}
+
+const png = fs.readFileSync(src);
+
+// Parse PNG IHDR for width / height. PNG magic (8 bytes) + IHDR chunk length
+// (4 bytes) + "IHDR" (4 bytes), then width (4) + height (4) at offsets 16/20.
+if (png.length < 24 || png.toString("ascii", 12, 16) !== "IHDR") {
+    console.error("build-icon-ico: source is not a PNG (missing IHDR)");
+    process.exit(1);
+}
+let width = png.readUInt32BE(16);
+let height = png.readUInt32BE(20);
+if (width > 256) width = 256;
+if (height > 256) height = 256;
+
+// ICONDIR (6 bytes): reserved=0, type=1 (icon), count=1
+// ICONDIRENTRY (16 bytes per image):
+//   width (1 byte, 0 = 256), height (1 byte, 0 = 256), palette (0), reserved (0),
+//   planes (1), bpp (32), size (4), offset (4)
+const dir = Buffer.alloc(6);
+dir.writeUInt16LE(0, 0);
+dir.writeUInt16LE(1, 2);
+dir.writeUInt16LE(1, 4);
+
+const entry = Buffer.alloc(16);
+entry.writeUInt8(width === 256 ? 0 : width, 0);
+entry.writeUInt8(height === 256 ? 0 : height, 1);
+entry.writeUInt8(0, 2); // palette
+entry.writeUInt8(0, 3); // reserved
+entry.writeUInt16LE(1, 4); // color planes
+entry.writeUInt16LE(32, 6); // bpp
+entry.writeUInt32LE(png.length, 8); // image data size
+entry.writeUInt32LE(22, 12); // offset = 6 (dir) + 16 (entry)
+
+const ico = Buffer.concat([dir, entry, png]);
+fs.writeFileSync(dst, ico);
+console.log(`build-icon-ico: wrote ${dst} (${ico.length} bytes, ${width}×${height} PNG-embedded)`);

package/bin/mailx.js

@@ -23,7 +23,15 @@ import net from "node:net";
 import { ports } from "@bobfrankston/miscinfo";
 import { showMessageBox, showService, setAppName, setAppIcon } from "@bobfrankston/mailx-host";
 setAppName("mailx");
-setAppIcon(path.resolve(import.meta.dirname, "..", "client", "icon.png"));
+// Prefer the .ico (Windows Explorer / taskbar-pin shortcut uses the embedded
+// icon resource of the pinned exe, or a Windows icon resource referenced
+// via PKEY_AppUserModel_RelaunchIconResource — PNG can't play either role).
+// Fall back to PNG for the in-window / tao-level icon on non-Windows.
+{
+    const icoPath = path.resolve(import.meta.dirname, "..", "client", "icon.ico");
+    const pngPath = path.resolve(import.meta.dirname, "..", "client", "icon.png");
+    setAppIcon(fs.existsSync(icoPath) ? icoPath : pngPath);
+}
 const PORT = ports.mailx;
 const args = process.argv.slice(2);
 // Normalize: accept both -flag and --flag
@@ -227,6 +235,24 @@ if (hasFlag("kill")) {
             }
         }
         catch { /* */ }
+        // Kill orphaned msgernative.exe windows. When the node process dies
+        // without cascade-killing its WebView child (old crash, forced
+        // taskkill, etc.), the msgernative.exe stays on screen and looks
+        // like a live mailx. mailx -kill should leave no trace.
+        // Scoped to exes launched for mailx by filtering CommandLine — don't
+        // touch msger windows started by other apps (msga, bbs, etc.).
+        try {
+            const ps = execSync(`powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \\"name='msgernative.exe'\\" | Where-Object { $_.CommandLine -match 'mailx' -or $_.Path -match 'mailx' } | Select-Object -ExpandProperty ProcessId"`, { encoding: "utf-8" }).trim();
+            for (const pid of ps.split("\n").map(s => s.trim()).filter(s => /^\d+$/.test(s))) {
+                try {
+                    execSync(`taskkill /F /PID ${pid}`, { stdio: "pipe" });
+                    console.log(`Killed PID ${pid} (mailx msgernative/WebView)`);
+                    killed++;
+                }
+                catch { /* */ }
+            }
+        }
+        catch { /* */ }
     }
     else {
         try {
@@ -903,12 +929,20 @@ async function main() {
     }
     catch { /* no saved geometry — use defaults */ }
     const rootPkgVersion = JSON.parse(fs.readFileSync(path.join(import.meta.dirname, "..", "package.json"), "utf-8")).version;
+    // Prefer .ico over .png for the window icon: on Windows, the .ico
+    // path doubles as the PKEY_AppUserModel_RelaunchIconResource value
+    // so taskbar pins use mailx's icon instead of msgernative's embedded
+    // resource. msger auto-detects the .ico extension and wires the
+    // relaunch icon after window creation.
+    const __iconIco = path.join(clientDir, "icon.ico");
+    const __iconPng = path.join(clientDir, "icon.png");
+    const __iconPath = fs.existsSync(__iconIco) ? __iconIco : __iconPng;
     const handle = showService({
         title: `mailx v${rootPkgVersion}`,
         url: "index.html",
         contentDir: clientDir,
         initScript: mailxapiScript,
-        icon: path.join(clientDir, "icon.png"),
+        icon: __iconPath,
         aumid: "com.frankston.mailx",
         size: savedGeometry
             ? { width: savedGeometry.width, height: savedGeometry.height }
@@ -921,8 +955,21 @@ async function main() {
     // Register ourselves as the live instance so subsequent `mailx` invocations
     // can detect version-mismatch and upgrade us (see top of file). Clear on
     // any of: SIGINT, SIGTERM, normal exit.
+    //
+    // Critical: the SIGTERM handler must *close the WebView child process*
+    // (handle.close() → kills msgernative.exe) before Node exits. Without
+    // this, the auto-upgrade leaves the old WebView orphaned on screen and
+    // the user sees an apparently frozen "old mailx" while the new Node is
+    // trying to spawn a second one. Cascade-killing the child makes the
+    // version-mismatch auto-upgrade actually transparent to the user.
     writeInstanceFile(process.pid);
-    const __cleanupInstance = () => { clearInstanceFile(); };
+    const __cleanupInstance = () => {
+        clearInstanceFile();
+        try {
+            handle.close();
+        }
+        catch { /* already gone */ }
+    };
     process.once("exit", __cleanupInstance);
     process.once("SIGINT", () => { __cleanupInstance(); process.exit(0); });
     process.once("SIGTERM", () => { __cleanupInstance(); process.exit(0); });
@@ -957,6 +1004,27 @@ async function main() {
             handle.send({ _cbid: req._cbid, result: { ok: true } });
             return;
         }
+        // Restart the daemon in-place without npm install. Spawn a fresh
+        // detached child running `mailx`, then gracefully shut this process
+        // down. The new daemon's version-mismatch / startup flow (see top
+        // of bin/mailx.ts) will either take over instantly (version same)
+        // or auto-upgrade through the instance-file cascade. Used when the
+        // user edits accounts.jsonc and needs the change to take effect
+        // without a terminal round-trip.
+        if (req._action === "restartDaemon") {
+            handle.send({ _cbid: req._cbid, ok: true, status: "restarting" });
+            try {
+                const { spawn: spawnChild } = await import("child_process");
+                const child = spawnChild("mailx", [], { detached: true, stdio: "ignore", shell: true });
+                child.unref();
+                console.log("  [restart] Spawned fresh daemon; shutting down current");
+            }
+            catch (e) {
+                console.error(`  [restart] Spawn failed: ${e.message}`);
+            }
+            gracefulShutdown("User requested restart");
+            return;
+        }
         // Auto-update action: run npm install then restart
         if (req._action === "performUpdate") {
             handle.send({ _cbid: req._cbid, ok: true, status: "updating" });

package/client/app.js

@@ -15,12 +15,16 @@ function updateBadge(count) {
     badgeCount = count;
     // Update title
     document.title = count > 0 ? `(${count}) ${baseTitle}` : baseTitle;
-    // Update favicon with badge
+    // Generate a single badge bitmap used for both the favicon (visible on
+    // browser tabs / mobile homescreen) AND the Windows taskbar overlay
+    // icon (visible as a Thunderbird-style corner pill on the taskbar
+    // button when running via msger). Rendered once, consumed twice.
     const canvas = document.createElement("canvas");
     canvas.width = 32;
     canvas.height = 32;
     const ctx = canvas.getContext("2d");
-    // Draw base icon (envelope)
+    // Base envelope icon (always drawn — so the favicon is a recognizable
+    // mailx icon even at 0 count).
     ctx.fillStyle = "#4a7ccc";
     ctx.fillRect(2, 8, 28, 20);
     ctx.fillStyle = "#6a9cec";
@@ -30,12 +34,11 @@ function updateBadge(count) {
     ctx.lineTo(30, 8);
     ctx.fill();
     if (count > 0) {
-        // Red badge circle
+        // Red badge circle with count
         ctx.fillStyle = "#e33";
         ctx.beginPath();
         ctx.arc(24, 8, 8, 0, Math.PI * 2);
         ctx.fill();
-        // Badge number
         ctx.fillStyle = "#fff";
         ctx.font = "bold 11px sans-serif";
         ctx.textAlign = "center";
@@ -49,7 +52,25 @@ function updateBadge(count) {
         link.rel = "icon";
         document.head.appendChild(link);
     }
-    link.href = canvas.toDataURL();
+    const dataUrl = canvas.toDataURL("image/png");
+    link.href = dataUrl;
+    // Also push to the Windows taskbar overlay via msger's IPC helper —
+    // no-op on Linux/Mac. For count=0, render a dedicated "no-overlay"
+    // icon that's all-transparent so the base icon shows cleanly.
+    try {
+        const msgapi = window.msgapi;
+        if (msgapi?.setTaskbarOverlay) {
+            if (count > 0) {
+                // strip "data:image/png;base64," prefix → base64 only
+                const b64 = dataUrl.split(",")[1] || "";
+                msgapi.setTaskbarOverlay(b64, `${count} unread`);
+            }
+            else {
+                msgapi.setTaskbarOverlay("", "");
+            }
+        }
+    }
+    catch { /* msgapi unavailable in browser fallback */ }
 }
 async function updateNewMessageCount() {
     try {
@@ -148,6 +169,48 @@ function hideAlert() {
     }
 }
 alertDismiss?.addEventListener("click", hideAlert);
+/** Show the alert banner with a "Restart" button wired to the mailxapi
+ *  restartDaemon action. Used when a watched config file whose changes
+ *  don't apply live (accounts.jsonc) has been modified. */
+function showRestartForConfigBanner() {
+    if (!alertBanner || !alertText)
+        return;
+    alertText.textContent = "accounts.jsonc changed — restart to apply.";
+    alertBanner.hidden = false;
+    alertBanner.dataset.key = "config-restart";
+    // Avoid duplicate buttons across repeat changes.
+    const existing = alertBanner.querySelector("#alert-restart-btn");
+    if (existing)
+        return;
+    const btn = document.createElement("button");
+    btn.id = "alert-restart-btn";
+    btn.textContent = "Restart now";
+    btn.style.cssText = "margin-left: 12px; padding: 3px 12px; cursor: pointer;";
+    btn.addEventListener("click", async () => {
+        btn.disabled = true;
+        btn.textContent = "Restarting…";
+        try {
+            const ipc = window.mailxapi;
+            if (ipc?.restartDaemon) {
+                await ipc.restartDaemon();
+                // Service is going down; the WebView should reload shortly
+                // when the replacement daemon takes over. Force a reload
+                // after a short delay in case the event doesn't arrive.
+                setTimeout(() => location.reload(), 2000);
+            }
+            else {
+                // Non-IPC (server/browser mode) — location reload won't
+                // restart the daemon but at least gives the user feedback.
+                location.reload();
+            }
+        }
+        catch (e) {
+            btn.textContent = `Failed: ${e?.message || e}`;
+            btn.disabled = false;
+        }
+    });
+    alertText.after(btn);
+}
 // ── Wire up components ──
 const folderTree = document.getElementById("folder-tree");
 let currentFolderSpecialUse = "";
@@ -770,32 +833,46 @@ document.getElementById("btn-flag")?.addEventListener("click", async () => {
     }
 });
 async function spamSelectedMessages() {
+    console.log("[spam] click — finding selection");
     const selected = getSelectedMessages();
     if (selected.length === 0) {
         const current = getCurrentMessage();
-        if (!current)
+        if (!current) {
+            console.warn("[spam] no message selected and none in viewer — nothing to do");
+            alert("No message selected. Click a message first, then the spam button.");
             return;
+        }
         selected.push({ accountId: current.accountId, uid: current.message.uid, folderId: current.message.folderId });
     }
+    console.log(`[spam] marking ${selected.length} message(s):`, selected);
     const statusSync = document.getElementById("status-sync");
+    // Optimistic: remove from list immediately so the user sees action happen.
+    // If the IPC fails, put them back. This matches local-first — the server
+    // sync is a background detail, the user's action should feel instant.
+    const snapshot = [...selected];
+    messageState.removeMessages(selected);
     try {
         const byAccount = new Map();
-        for (const msg of selected) {
+        for (const msg of snapshot) {
             const uids = byAccount.get(msg.accountId) || [];
             uids.push(msg.uid);
             byAccount.set(msg.accountId, uids);
         }
         for (const [accountId, uids] of byAccount) {
-            await markAsSpamMessages(accountId, uids);
+            const result = await markAsSpamMessages(accountId, uids);
+            console.log(`[spam] ${accountId}: moved ${result?.moved ?? uids.length} to folderId=${result?.targetFolderId}`);
         }
         if (statusSync)
-            statusSync.textContent = `Spam: ${selected.length} queued — pending server sync`;
-        messageState.removeMessages(selected);
+            statusSync.textContent = `Spam: ${snapshot.length} queued — pending server sync`;
     }
     catch (e) {
+        console.error(`[spam] failed:`, e);
         if (statusSync)
-            statusSync.textContent = `Spam failed: ${e.message}`;
-        console.error(`Spam failed: ${e.message}`);
+            statusSync.textContent = `Spam failed: ${e?.message || e}`;
+        alert(`Mark-as-spam failed: ${e?.message || e}\n\n${selected.length} message(s) stayed in the list; check Settings → account spam folder and accounts.jsonc.`);
+        // Best-effort restore: re-set the messages we optimistically removed.
+        // removeMessages has no inverse in message-state, so we'll rely on the
+        // next folder reload to repopulate. Surface the failure clearly.
     }
 }
 document.getElementById("btn-spam")?.addEventListener("click", spamSelectedMessages);
@@ -1197,8 +1274,14 @@ onWsEvent((event) => {
         case "configChanged":
             // A watched config file was modified — could be user edit via the
             // JSONC editor, a GDrive sync, or mailx itself saving (e.g.
-            // allowlist update on "allow sender"). Show in the status bar
-            // briefly, NOT as an error banner — it's informational.
+            // allowlist update on "allow sender").
+            //
+            // For accounts.jsonc specifically, surface a sticky banner with a
+            // Restart button — the file change has no effect on the running
+            // daemon (IMAP connections, token caches, sync loops use the old
+            // config snapshot), and users shouldn't need `mailx -kill` just
+            // to apply an edit. For other files (allowlist / clients /
+            // config) the service handles live, a status-bar flash suffices.
             if (statusSync) {
                 statusSync.textContent = `${event.filename} updated`;
                 setTimeout(() => {
@@ -1206,6 +1289,9 @@ onWsEvent((event) => {
                         statusSync.textContent = "";
                 }, 8000);
             }
+            if (event.filename && /accounts\.jsonc/i.test(String(event.filename))) {
+                showRestartForConfigBanner();
+            }
             break;
         case "cloudError":
             // Cloud read/write failed (Google Drive auth/network/etc.). Show a

package/client/components/message-list.js

@@ -71,17 +71,24 @@ export function initMessageList(handler) {
     // Infinite scroll
     const body = document.getElementById("ml-body");
     if (body) {
-        // Touch scroll vs tap: track finger movement at the container level and
-        // flag "we were scrolling" so row click handlers can bail out. WebView
-        // sometimes fires click on touchend even when the user dragged — which
-        // was opening a message just from scrolling the list.
+        // Touch scroll vs tap: the WebView occasionally synthesizes a click on
+        // touchend even when the user clearly scrolled, which opened a message
+        // just from swiping the list. Multi-signal detection so a scroll is
+        // reliably classified:
+        //   1. touchmove movement ≥ TAP_SLOP — the primary signal
+        //   2. actual scrollTop change between touchstart and touchend — always
+        //      set the flag when the container moved, even if touchmove never
+        //      fired (some Android builds coalesce events under momentum)
+        //   3. longer TAP_SLOP (15px) — fingers are wide; 10px was too twitchy
         let touchStartY = 0;
         let touchStartX = 0;
-        const TAP_SLOP = 10;
+        let touchStartScrollTop = 0;
+        const TAP_SLOP = 15;
         body.addEventListener("touchstart", (e) => {
             const t = e.touches[0];
             touchStartY = t.clientY;
             touchStartX = t.clientX;
+            touchStartScrollTop = body.scrollTop;
             touchWasScroll = false;
         }, { passive: true });
         body.addEventListener("touchmove", (e) => {
@@ -90,6 +97,13 @@ export function initMessageList(handler) {
                 touchWasScroll = true;
             }
         }, { passive: true });
+        body.addEventListener("touchend", () => {
+            // If the container actually scrolled during this touch, the user
+            // was scrolling regardless of how small their finger movement was.
+            if (body.scrollTop !== touchStartScrollTop) {
+                touchWasScroll = true;
+            }
+        }, { passive: true });
         body.addEventListener("scroll", () => {
             if (loading)
                 return;

package/client/lib/mailxapi.js

@@ -118,6 +118,20 @@
         aiTransform: function(req) {
             return callNode("aiTransform", req);
         },
+        // Restart the background service so edits to accounts.jsonc /
+        // allowlist.jsonc / other live config take effect without the user
+        // having to type `mailx -kill`. The service spawns a fresh detached
+        // daemon and then exits; the new daemon takes over.
+        restartDaemon: function() {
+            return new Promise(function(resolve) {
+                var id = String(++_callbackId);
+                _callbacks[id] = { resolve: resolve, reject: resolve, timer: setTimeout(function() {
+                    delete _callbacks[id];
+                    resolve({ ok: true, status: "service-gone" });
+                }, 5000) };
+                try { window.ipc.postMessage(JSON.stringify({ _action: "restartDaemon", _cbid: id })); } catch(e) { resolve({ ok: false }); }
+            });
+        },
         searchContacts: function(query) {
             return callNode("searchContacts", { query: query });
         },

package/client/styles/components.css

@@ -378,6 +378,15 @@ button.tb-menu-item { background: none; border: none; color: inherit; width: 100
     grid-template-columns: subgrid;
     align-content: start;
     scrollbar-gutter: stable;
+    /* Android WebView / Chromium: without an explicit touch-action, the
+     * browser waits on JS touch listeners (passive or not) before deciding
+     * to scroll. That delay makes the first row feel like it got tapped
+     * before the scroll actually starts. pan-y tells the compositor: treat
+     * any vertical drag as a scroll, don't wait on JS. overscroll-behavior
+     * contains the scroll so we don't chain into the outer page / pull-to-
+     * refresh when the user flicks at top/bottom. */
+    touch-action: pan-y;
+    overscroll-behavior-y: contain;
 }
 
 .ml-row {
@@ -387,6 +396,11 @@ button.tb-menu-item { background: none; border: none; color: inherit; width: 100
     padding: var(--gap-sm) var(--gap-sm);
     border-bottom: 1px solid color-mix(in oklch, var(--color-border) 50%, transparent);
     cursor: pointer;
+    /* Disable the 300ms double-tap-to-zoom delay on rows. Double-tap zoom
+     * makes no sense on a message row anyway; without this, Android often
+     * classifies a scroll-starting tap as a delayed-click because it's
+     * still in the double-tap wait window. */
+    touch-action: manipulation;
     font-size: var(--font-size-base);
     font-weight: 400;
     color: var(--color-text);
@@ -396,7 +410,10 @@ button.tb-menu-item { background: none; border: none; color: inherit; width: 100
     &:hover { background: var(--color-bg-hover); }
     &.selected { background: var(--color-brand); color: var(--color-brand-dark); font-weight: 500; }
     &.unread {
-        font-weight: 600;
+        /* Thunderbird-level emphasis: true bold (700) rather than semibold
+         *  (600). At smaller row heights the weight contrast is the cue the
+         *  eye tracks — color shifts alone read as noise on a dense list. */
+        font-weight: 700;
         color: var(--color-unread);
     }
 }
@@ -479,7 +496,7 @@ button.tb-menu-item { background: none; border: none; color: inherit; width: 100
 }
 .ml-thread-popup-item:hover { background: var(--color-bg-hover); }
 .ml-thread-popup-item.unread .ml-thread-popup-from,
-.ml-thread-popup-item.unread .ml-thread-popup-subject { font-weight: 600; }
+.ml-thread-popup-item.unread .ml-thread-popup-subject { font-weight: 700; }
 .ml-thread-popup-from {
     grid-column: 1;
     grid-row: 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx",
-  "version": "1.0.317",
+  "version": "1.0.327",
   "description": "Local-first email client with IMAP sync and standalone native app",
   "type": "module",
   "main": "bin/mailx.js",
@@ -12,7 +12,7 @@
     "client"
   ],
   "scripts": {
-    "build": "npm run build --workspaces --if-present && tsc -p bin",
+    "build": "npm run build --workspaces --if-present && tsc -p bin && node bin/build-icon-ico.js",
     "watch": "tsc -w",
     "start": "node --watch packages/mailx-server/index.js",
     "start:prod": "node packages/mailx-server/index.js",
@@ -24,7 +24,7 @@
     "@bobfrankston/iflow-node": "^0.1.7",
     "@bobfrankston/miscinfo": "^1.0.9",
     "@bobfrankston/oauthsupport": "^1.0.24",
-    "@bobfrankston/msger": "^0.1.343",
+    "@bobfrankston/msger": "^0.1.344",
     "@bobfrankston/mailx-host": "^0.1.3",
     "@capacitor/android": "^8.3.0",
     "@capacitor/cli": "^8.3.0",
@@ -88,7 +88,7 @@
       "@bobfrankston/iflow-node": "^0.1.7",
       "@bobfrankston/miscinfo": "^1.0.9",
       "@bobfrankston/oauthsupport": "^1.0.24",
-      "@bobfrankston/msger": "^0.1.343",
+      "@bobfrankston/msger": "^0.1.344",
       "@bobfrankston/mailx-host": "^0.1.3",
       "@capacitor/android": "^8.3.0",
       "@capacitor/cli": "^8.3.0",

package/packages/mailx-imap/index.d.ts

@@ -249,6 +249,7 @@ export declare class ImapManager extends EventEmitter {
     /** Stop Outbox worker */
     stopOutboxWorker(): void;
     private configWatchers;
+    private cloudPollTimers;
     /** Watch the local config files for external changes. On change, emit
      *  configChanged so the UI can show a "restart to apply" banner. Uses
      *  a debounce to coalesce rapid writes from save tools. */

package/packages/mailx-imap/index.js

@@ -2880,6 +2880,7 @@ export class ImapManager extends EventEmitter {
     }
     // ── Config file watcher ──
     configWatchers = [];
+    cloudPollTimers = [];
     /** Watch the local config files for external changes. On change, emit
      *  configChanged so the UI can show a "restart to apply" banner. Uses
      *  a debounce to coalesce rapid writes from save tools. */
@@ -2908,6 +2909,55 @@ export class ImapManager extends EventEmitter {
                 console.error(`  [watch] Failed to watch ${filename}: ${e.message}`);
             }
         }
+        // GDrive has no push/watch for arbitrary Drive files, so edits on
+        // another device (or via Drive web) never fire fs.watch locally.
+        // Poll the cloud copies of the replicated-to-cloud config files
+        // (accounts.jsonc, allowlist.jsonc, clients.jsonc) every 3 minutes,
+        // compare to local, and write-through on difference. The local
+        // fs.watch above then picks up the write and emits configChanged.
+        // config.jsonc is per-machine / local-only — never polled.
+        const cloudFiles = ["accounts.jsonc", "allowlist.jsonc", "clients.jsonc"];
+        const CLOUD_POLL_MS = 3 * 60 * 1000;
+        const pollCloud = async () => {
+            let cloudRead;
+            try {
+                ({ cloudRead } = await import("@bobfrankston/mailx-settings"));
+            }
+            catch {
+                return; /* cloud module unavailable */
+            }
+            for (const filename of cloudFiles) {
+                try {
+                    const cloudContent = await cloudRead(filename);
+                    if (!cloudContent)
+                        continue;
+                    const localPath = path.join(configDir, filename);
+                    let localContent = null;
+                    try {
+                        localContent = fs.readFileSync(localPath, "utf-8");
+                    }
+                    catch { /* missing */ }
+                    if (localContent === cloudContent)
+                        continue;
+                    // Cloud copy differs — write through so watchers / downstream
+                    // readers see the new value. fs.watch above will fire and
+                    // emit configChanged → UI banner.
+                    fs.writeFileSync(localPath, cloudContent);
+                    console.log(`  [cloud-poll] ${filename} updated from cloud copy`);
+                }
+                catch (e) {
+                    // Drive unreachable, auth expired, file missing in cloud —
+                    // silent retry on next tick; no user-visible fallout.
+                    console.log(`  [cloud-poll] ${filename} check skipped: ${e?.message || e}`);
+                }
+            }
+        };
+        // First poll ~10s after startup, then every 3 min.
+        setTimeout(() => {
+            pollCloud();
+            const interval = setInterval(pollCloud, CLOUD_POLL_MS);
+            this.cloudPollTimers.push(interval);
+        }, 10_000);
     }
     /** Stop all config file watchers */
     stopWatchingConfig() {
@@ -2918,6 +2968,13 @@ export class ImapManager extends EventEmitter {
             catch { /* ignore */ }
         }
         this.configWatchers = [];
+        for (const t of this.cloudPollTimers) {
+            try {
+                clearInterval(t);
+            }
+            catch { /* ignore */ }
+        }
+        this.cloudPollTimers = [];
     }
     // ── Google Contacts Sync ──
     contactsSyncToken = null;

package/packages/mailx-settings/index.js

@@ -307,36 +307,43 @@ const PROVIDERS = {
         label: "Gmail",
         imap: { host: "imap.gmail.com", port: 993, tls: true, auth: "oauth2" },
         smtp: { host: "smtp.gmail.com", port: 587, tls: true, auth: "oauth2" },
+        spam: "SPAM", // Gmail labels, mailx tree shows as "SPAM"
     },
     "googlemail.com": {
         label: "Gmail",
         imap: { host: "imap.gmail.com", port: 993, tls: true, auth: "oauth2" },
         smtp: { host: "smtp.gmail.com", port: 587, tls: true, auth: "oauth2" },
+        spam: "SPAM",
     },
     "outlook.com": {
         label: "Outlook",
         imap: { host: "outlook.office365.com", port: 993, tls: true, auth: "oauth2" },
         smtp: { host: "smtp.office365.com", port: 587, tls: true, auth: "oauth2" },
+        spam: "Junk Email",
     },
     "hotmail.com": {
         label: "Hotmail",
         imap: { host: "outlook.office365.com", port: 993, tls: true, auth: "oauth2" },
         smtp: { host: "smtp.office365.com", port: 587, tls: true, auth: "oauth2" },
+        spam: "Junk Email",
     },
     "yahoo.com": {
         label: "Yahoo",
         imap: { host: "imap.mail.yahoo.com", port: 993, tls: true, auth: "password" },
         smtp: { host: "smtp.mail.yahoo.com", port: 587, tls: true, auth: "password" },
+        spam: "Bulk Mail",
     },
     "aol.com": {
         label: "AOL",
         imap: { host: "imap.aol.com", port: 993, tls: true, auth: "password" },
         smtp: { host: "smtp.aol.com", port: 587, tls: true, auth: "password" },
+        spam: "Bulk Mail",
     },
     "icloud.com": {
         label: "iCloud",
         imap: { host: "imap.mail.me.com", port: 993, tls: true, auth: "password" },
         smtp: { host: "smtp.mail.me.com", port: 587, tls: true, auth: "password" },
+        spam: "Junk",
     },
 };
 /** Fill in provider defaults for an account based on email domain */
@@ -372,6 +379,13 @@ function normalizeAccount(acct, globalName) {
         relayDomains: acct.relayDomains,
         deliveredToPrefix: acct.deliveredToPrefix,
         identityDomains: acct.identityDomains,
+        // Spam folder: explicit account config wins; otherwise fall back to
+        // the provider default (e.g. Gmail ships with built-in SPAM; Outlook
+        // with "Junk Email"). Before 2026-04-21 this field was dropped by
+        // normalizeAccount entirely — silent regression even for accounts
+        // that had it configured. `acct.spam` first so a user-set value on
+        // a recognized provider still overrides the default.
+        spam: acct.spam !== undefined ? acct.spam : provider?.spam,
     };
 }
 // ── Defaults ──