@bobfrankston/mailx 1.0.383 → 1.0.385

package/bin/mailx.js

@@ -1213,6 +1213,15 @@ RFC 5322 with CRLF line endings. Bodies are quoted-printable encoded (readable i
     // with one IPC write per message — lets the UI flip many rows at once.
     let pendingCached = [];
     let cachedTimer = null;
+    // Calendar/tasks refresh completion — service emits when a pull merged
+    // new rows or reconciled a server-side delete. Client re-renders its
+    // sidebar on receipt. No payload beyond accountId.
+    imapManager.on("calendarUpdated", (payload) => {
+        handle.send({ _event: "calendarUpdated", type: "calendarUpdated", ...payload });
+    });
+    imapManager.on("tasksUpdated", (payload) => {
+        handle.send({ _event: "tasksUpdated", type: "tasksUpdated", ...payload });
+    });
     imapManager.on("bodyCached", (accountId, uid) => {
         pendingCached.push({ accountId, uid });
         if (!cachedTimer) {
@@ -1328,6 +1337,24 @@ RFC 5322 with CRLF line endings. Bodies are quoted-printable encoded (readable i
     setInterval(() => {
         svc.drainStoreSync().catch((e) => console.error(`  [store_sync] periodic drain error: ${e?.message || e}`));
     }, 30_000);
+    // Calendar + Tasks poll — pulls server-side changes so the sidebar
+    // reflects events added/edited/deleted on another device without
+    // needing a sidebar nav click. 5-minute cadence is well under the
+    // per-user rate limit and the 1M/day project quota. Webhooks would
+    // be cheaper in theory but need a public HTTPS endpoint; poll is
+    // the pragmatic choice (confirmed 2026-04-23). getCalendarEvents /
+    // getTasks emit the refresh event via imapManager, so the sidebar
+    // re-renders automatically.
+    const CAL_POLL_MS = 5 * 60_000;
+    const horizonDays = 90; // larger than sidebar's default so background
+    // poll catches upcoming-week events the sidebar hasn't asked for yet.
+    setInterval(() => {
+        const now = Date.now();
+        svc.getCalendarEvents(now, now + horizonDays * 86400_000)
+            .catch((e) => console.error(`  [calendar] poll error: ${e?.message || e}`));
+        svc.getTasks(false)
+            .catch((e) => console.error(`  [tasks] poll error: ${e?.message || e}`));
+    }, CAL_POLL_MS);
     // Auto-update: periodically check npm for a newer version and push a
     // notification to the WebView so the user can update with one click.
     const UPDATE_CHECK_MS = 30 * 60_000; // 30 minutes

package/client/app.js

@@ -971,6 +971,36 @@ async function refreshSpamButtonVisibility() {
 }
 document.addEventListener("mailx-message-shown", refreshSpamButtonVisibility);
 document.addEventListener("mailx-folder-changed", refreshSpamButtonVisibility);
+// Q100 placeholder — append a row to ~/.mailx/spam.csv for later analysis.
+// No folder move, no flag change, no auto-delete. Button is always visible
+// (no configuration required; unlike btn-spam which needs a junk folder).
+document.getElementById("btn-spam-report")?.addEventListener("click", async () => {
+    const current = getCurrentMessage();
+    const msg = current?.message;
+    const accountId = current?.accountId;
+    if (!msg || !accountId)
+        return;
+    const btn = document.getElementById("btn-spam-report");
+    const originalLabel = btn.textContent;
+    btn.disabled = true;
+    btn.textContent = "…";
+    try {
+        const { recordSpamReport } = await import("./lib/api-client.js");
+        await recordSpamReport(accountId, msg.uid, msg.folderId);
+        btn.textContent = "✓";
+        const status = document.getElementById("status-sync");
+        if (status)
+            status.textContent = "Logged to ~/.mailx/spam.csv";
+        setTimeout(() => { btn.textContent = originalLabel; btn.disabled = false; }, 1500);
+    }
+    catch (e) {
+        btn.textContent = "✗";
+        const status = document.getElementById("status-sync");
+        if (status)
+            status.textContent = `Spam log failed: ${e?.message || e}`;
+        setTimeout(() => { btn.textContent = originalLabel; btn.disabled = false; }, 2500);
+    }
+});
 document.getElementById("btn-compose")?.addEventListener("click", () => openCompose("new"));
 document.getElementById("btn-mark-unread")?.addEventListener("click", () => {
     // Toggle \Seen on the currently-selected message. Mirrors the R
@@ -1031,16 +1061,40 @@ document.getElementById("rail-help")?.addEventListener("click", () => {
     document.getElementById("btn-about")?.click();
 });
 document.getElementById("rail-theme")?.addEventListener("click", () => {
-    // Cycle theme: system → dark → light → system.
+    // Rail theme icon cycles system → dark → light → system. Settings menu
+    // exposes the same three as radio buttons for direct selection.
     const root = document.documentElement;
     const cur = root.getAttribute("data-theme") || "system";
     const next = cur === "system" ? "dark" : cur === "dark" ? "light" : "system";
-    root.setAttribute("data-theme", next);
+    applyTheme(next);
+});
+function applyTheme(theme) {
+    document.documentElement.setAttribute("data-theme", theme);
     try {
-        localStorage.setItem("mailx-theme", next);
+        localStorage.setItem("mailx-theme", theme);
     }
     catch { /* private mode */ }
-});
+    // Reflect in the Settings menu radios so the two paths stay in sync.
+    const radio = document.getElementById(`opt-theme-${theme}`);
+    if (radio)
+        radio.checked = true;
+}
+// Restore saved theme + wire the Settings radios. Defaults to "system".
+(() => {
+    const saved = (() => { try {
+        return localStorage.getItem("mailx-theme") || "system";
+    }
+    catch {
+        return "system";
+    } })();
+    applyTheme(saved);
+    for (const t of ["system", "light", "dark"]) {
+        document.getElementById(`opt-theme-${t}`)?.addEventListener("change", (e) => {
+            if (e.target.checked)
+                applyTheme(t);
+        });
+    }
+})();
 // Highlight the current rail target. For now just inbox is the default; once
 // calendar/tasks ship, update this on view change.
 function setRailActive(id) {

package/client/components/calendar-sidebar.js

@@ -15,19 +15,42 @@
  */
 import { getCalendarEvents, createCalendarEvent, getTasks, createTask, updateTask, deleteTask, } from "../lib/api-client.js";
 const SIDEBAR_PREF = "mailx-calendar-sidebar-on";
+const SHOW_RECURRING_PREF = "mailx-cal-show-recurring";
+const HORIZON_DAYS_PREF = "mailx-cal-horizon-days";
+const HORIZON_DEFAULT_DAYS = 30;
 let viewYear = new Date().getFullYear();
 let viewMonth = new Date().getMonth();
 let viewDay = new Date().getDate();
 let lastEvents = [];
+function getHorizonDays() {
+    try {
+        const v = localStorage.getItem(HORIZON_DAYS_PREF);
+        const n = v ? parseInt(v, 10) : NaN;
+        if (Number.isFinite(n) && n > 0 && n <= 365)
+            return n;
+    }
+    catch { /* */ }
+    return HORIZON_DEFAULT_DAYS;
+}
+function getShowRecurring() {
+    try {
+        return localStorage.getItem(SHOW_RECURRING_PREF) !== "false";
+    }
+    catch {
+        return true;
+    }
+}
 /** Fetch events from the local two-way cache; service returns local rows
  *  immediately and kicks a background refresh from Google. Next render
  *  (view-nav or user action) picks up the refreshed rows. No localStorage
  *  — everything lives in the service-side DB so phone / desktop share
  *  the same events. */
 async function fetchUpcoming(from) {
-    const horizon = from.getTime() + 30 * 86400_000;
+    const horizon = from.getTime() + getHorizonDays() * 86400_000;
     const rows = await getCalendarEvents(from.getTime(), horizon);
-    return rows.map((r) => ({
+    const showRecurring = getShowRecurring();
+    const filtered = showRecurring ? rows : rows.filter((r) => !r.recurringEventId);
+    return filtered.map((r) => ({
         id: r.uuid,
         title: r.title,
         start: r.startMs,
@@ -36,6 +59,8 @@ async function fetchUpcoming(from) {
         location: r.location,
         notes: r.notes,
         source: r.providerId ? "google" : "local",
+        recurringEventId: r.recurringEventId,
+        htmlLink: r.htmlLink,
     }));
 }
 function formatDayHeader(d, today, tomorrow) {
@@ -81,13 +106,29 @@ function renderEvents(events) {
             html += `<div class="cal-side-day">${escapeHtml(formatDayHeader(d, today, tomorrow))}</div>`;
             lastDayKey = dayKey;
         }
-        html += `<div class="cal-side-event" data-id="${e.id}">
+        const recurMark = e.recurringEventId ? `<span class="cal-side-event-recur" title="Recurring event">↻</span>` : "";
+        const link = e.htmlLink || "";
+        html += `<div class="cal-side-event" data-id="${e.id}" data-link="${escapeHtml(link)}" ${link ? 'title="Click to open in Google Calendar"' : ""}>
             <span class="cal-side-event-dot ${e.source === "google" ? "g" : "l"}"></span>
             <span class="cal-side-event-time">${escapeHtml(formatTime(e))}</span>
-            <span class="cal-side-event-title">${escapeHtml(e.title)}</span>
+            <span class="cal-side-event-title">${escapeHtml(e.title)}${recurMark}</span>
         </div>`;
     }
     body.innerHTML = html;
+    // Click-to-open — interim per user 2026-04-23: route to Google Calendar's
+    // web UI via openExternal until we build an in-app event editor.
+    body.querySelectorAll(".cal-side-event").forEach(el => {
+        el.addEventListener("click", () => {
+            const link = el.dataset.link;
+            if (link) {
+                const api = window.mailxapi;
+                if (api?.openExternal)
+                    api.openExternal(link);
+                else
+                    window.open(link, "_blank");
+            }
+        });
+    });
 }
 async function renderTasks() {
     const showDone = document.getElementById("cal-side-show-done")?.checked || false;
@@ -209,5 +250,53 @@ export function initCalendarSidebar() {
         showDoneCb.__wired = true;
         showDoneCb.addEventListener("change", () => renderTasks());
     }
+    // Recurring-events filter toggle — hides expanded recurring-series
+    // instances when unchecked. Default on so new users see everything.
+    const recurCb = document.getElementById("cal-side-show-recurring");
+    if (recurCb && !recurCb.__wired) {
+        recurCb.__wired = true;
+        recurCb.checked = getShowRecurring();
+        recurCb.addEventListener("change", () => {
+            try {
+                localStorage.setItem(SHOW_RECURRING_PREF, String(recurCb.checked));
+            }
+            catch { /* */ }
+            refresh();
+        });
+    }
+    // Horizon input — how many days ahead to list events. Bounded 1..365.
+    const horizonInput = document.getElementById("cal-side-horizon");
+    if (horizonInput && !horizonInput.__wired) {
+        horizonInput.__wired = true;
+        horizonInput.value = String(getHorizonDays());
+        const commit = () => {
+            const n = parseInt(horizonInput.value, 10);
+            const clamped = Number.isFinite(n) && n > 0 ? Math.min(365, Math.max(1, n)) : HORIZON_DEFAULT_DAYS;
+            horizonInput.value = String(clamped);
+            try {
+                localStorage.setItem(HORIZON_DAYS_PREF, String(clamped));
+            }
+            catch { /* */ }
+            refresh();
+        };
+        horizonInput.addEventListener("change", commit);
+        horizonInput.addEventListener("blur", commit);
+    }
+    // Subscribe to service events — when a background Google pull finishes
+    // and upserted/reconciled rows, re-render without waiting for a nav
+    // click. Uses the mailxapi.onEvent bus. Idempotent flag keeps multiple
+    // initCalendarSidebar calls from dup-subscribing.
+    if (!window.__mailxCalEventsWired) {
+        const api = window.mailxapi;
+        if (api?.onEvent) {
+            window.__mailxCalEventsWired = true;
+            api.onEvent((event) => {
+                if (event?.type === "calendarUpdated")
+                    refresh();
+                else if (event?.type === "tasksUpdated")
+                    renderTasks();
+            });
+        }
+    }
 }
 //# sourceMappingURL=calendar-sidebar.js.map

package/client/components/message-viewer.js

@@ -2,7 +2,7 @@
  * Message viewer component -- displays full message in sandboxed iframe.
  * Subscribes to message-state: clears when selected becomes null.
  */
-import { getMessage, updateFlags, allowRemoteContent, getAttachment, addContact } from "../lib/api-client.js";
+import { getMessage, updateFlags, allowRemoteContent, getAttachment, addContact, listContacts, upsertContact } from "../lib/api-client.js";
 import { showContextMenu } from "./context-menu.js";
 import * as state from "../lib/message-state.js";
 /** Currently displayed message (for reply/forward) */
@@ -297,10 +297,7 @@ export async function showMessage(accountId, uid, folderId, specialUse, isRetry
                     items.push({
                         label: `Add to contacts: ${addr.address}`,
                         action: async () => {
-                            try {
-                                await addContact(name, addr.address);
-                            }
-                            catch { /* ignore */ }
+                            await showAddContactDialog(name, addr.address);
                         },
                     });
                     items.push({ label: "", action: () => { }, separator: true });
@@ -746,6 +743,84 @@ function escapeText(s) {
     div.textContent = s;
     return div.innerHTML;
 }
+/** Minimal add-contact modal: name + email + organization with a duplicate
+ *  check (checks the contacts DB for an existing row with the same email
+ *  and surfaces it so the user can update instead of creating a second
+ *  row with a different name). Future: AI-extracted fields from the letter
+ *  body populate the form before it opens. */
+async function showAddContactDialog(nameIn, emailIn) {
+    let dup = null;
+    try {
+        const existing = await listContacts(emailIn, 1, 10);
+        const match = (existing?.items || []).find((c) => (c.email || "").toLowerCase() === emailIn.toLowerCase());
+        if (match)
+            dup = match;
+    }
+    catch { /* non-fatal — dialog still works without dup info */ }
+    const backdrop = document.createElement("div");
+    backdrop.className = "mailx-modal-backdrop";
+    const panel = document.createElement("div");
+    panel.className = "mailx-modal";
+    panel.innerHTML = `
+        <div class="mailx-modal-title">
+            <span class="mailx-modal-title-text">${dup ? "Update contact" : "Add contact"}</span>
+            <button type="button" class="mailx-modal-close" id="ac-close" aria-label="Close">&times;</button>
+        </div>
+        ${dup ? `<div class="mailx-modal-info">Already in address book as <strong>${escapeText(dup.name || "(no name)")}</strong> (${escapeText(dup.source)}). Saving will update the name.</div>` : ""}
+        <label class="mailx-modal-label">Name
+            <input class="mailx-modal-input" id="ac-name" type="text" value="${escapeText(dup?.name || nameIn || "")}" autofocus>
+        </label>
+        <label class="mailx-modal-label">Email
+            <input class="mailx-modal-input" id="ac-email" type="email" value="${escapeText(emailIn)}" readonly>
+        </label>
+        <label class="mailx-modal-label">Organization <span style="color:var(--color-text-muted);font-size:0.85em">(optional)</span>
+            <input class="mailx-modal-input" id="ac-org" type="text" placeholder="">
+        </label>
+        <div class="mailx-modal-buttons">
+            <span class="mailx-modal-spacer"></span>
+            <button type="button" class="mailx-modal-btn" data-action="cancel">Cancel</button>
+            <button type="button" class="mailx-modal-btn mailx-modal-btn-primary" data-action="save">${dup ? "Update" : "Save"}</button>
+        </div>`;
+    backdrop.appendChild(panel);
+    document.body.appendChild(backdrop);
+    const close = () => backdrop.remove();
+    panel.querySelector("#ac-close").addEventListener("click", close);
+    panel.querySelectorAll(".mailx-modal-btn").forEach(btn => {
+        btn.addEventListener("click", async () => {
+            if (btn.dataset.action === "cancel") {
+                close();
+                return;
+            }
+            const nameEl = panel.querySelector("#ac-name");
+            const emailEl = panel.querySelector("#ac-email");
+            btn.disabled = true;
+            btn.textContent = "Saving…";
+            try {
+                // upsertContact is the two-way cache path (enqueues a Google
+                // People push); for pure local-first addContact would also
+                // work but skips the Google sync. Use upsertContact so the
+                // row propagates to Google Contacts next drain tick.
+                await upsertContact(nameEl.value.trim(), emailEl.value.trim());
+                close();
+            }
+            catch (e) {
+                btn.disabled = false;
+                btn.textContent = dup ? "Update" : "Save";
+                alert(`Couldn't save: ${e?.message || e}`);
+            }
+        });
+    });
+    const onKey = (e) => {
+        if (e.key === "Escape") {
+            close();
+            document.removeEventListener("keydown", onKey, true);
+        }
+    };
+    document.addEventListener("keydown", onKey, true);
+    // addContact is kept as a legacy silent path (no-form) for any caller
+    // that still invokes it — currently none after this refactor.
+    void addContact;
+}
 function formatSize(bytes) {
     if (bytes < 1024)
         return `${bytes} B`;

package/client/index.html

@@ -35,6 +35,11 @@
             <div class="tb-menu" id="settings-menu">
                 <button class="tb-btn" id="btn-settings">Settings</button>
                 <div class="tb-menu-dropdown" id="settings-dropdown" hidden>
+                    <span class="tb-menu-label">Theme</span>
+                    <label class="tb-menu-item"><input type="radio" name="opt-theme" value="system" id="opt-theme-system"> System</label>
+                    <label class="tb-menu-item"><input type="radio" name="opt-theme" value="light" id="opt-theme-light"> Light</label>
+                    <label class="tb-menu-item"><input type="radio" name="opt-theme" value="dark" id="opt-theme-dark"> Dark</label>
+                    <hr class="tb-menu-sep">
                     <span class="tb-menu-label">Editor</span>
                     <label class="tb-menu-item"><input type="radio" name="opt-editor" value="quill" id="opt-editor-quill" checked> Quill</label>
                     <label class="tb-menu-item"><input type="radio" name="opt-editor" value="tiptap" id="opt-editor-tiptap"> tiptap</label>
@@ -133,6 +138,7 @@
                     <button class="tb-btn" id="btn-forward" title="Forward">→</button>
                     <button class="tb-btn" id="btn-delete" title="Delete (Del)">🗑</button>
                     <button class="tb-btn" id="btn-spam" title="Mark as spam — move to configured spam folder" hidden>⚠</button>
+                    <button class="tb-btn" id="btn-spam-report" title="Report as spam (append to ~/.mailx/spam.csv for later analysis)">🚫</button>
                     <button class="tb-btn" id="btn-flag" title="Flag">⚑</button>
                     <button class="tb-btn" id="btn-mark-unread" title="Mark unread (R)">◉</button>
                     <button class="tb-btn" id="mv-view-thread" title="View thread (conversation)" hidden>💬</button>
@@ -166,6 +172,12 @@
         </header>
         <div class="cal-side-actions">
             <button class="cal-side-new" id="cal-side-new" title="New event">＋ New event</button>
+            <label class="cal-side-opt" title="Include expanded instances of recurring events">
+                <input type="checkbox" id="cal-side-show-recurring" checked> Show recurring
+            </label>
+            <label class="cal-side-opt" title="How many days ahead to list">
+                Horizon <input type="number" id="cal-side-horizon" min="1" max="365" step="1" style="width:4em">
+            </label>
         </div>
         <div class="cal-side-body" id="cal-side-body">
             <div class="cal-side-empty">Loading…</div>

package/client/lib/api-client.js

@@ -170,6 +170,12 @@ export function deleteTask(uuid) {
 export function drainStoreSync() {
     return ipc().drainStoreSync?.();
 }
+/** Report the currently-viewed message as spam → appends a row to
+ *  `~/.mailx/spam.csv`. Placeholder: no folder move, no flag change, no
+ *  auto-delete. Training data for a smarter pass later. */
+export function recordSpamReport(accountId, uid, folderId) {
+    return ipc().recordSpamReport?.(accountId, uid, folderId);
+}
 export function getOutboxStatus() {
     return ipc().getOutboxStatus();
 }

package/client/lib/mailxapi.js

@@ -122,6 +122,9 @@
         updateTask: function(uuid, patch) { return callNode("updateTask", { uuid: uuid, patch: patch }); },
         deleteTask: function(uuid) { return callNode("deleteTask", { uuid: uuid }); },
         drainStoreSync: function() { return callNode("drainStoreSync"); },
+        recordSpamReport: function(accountId, uid, folderId) {
+            return callNode("recordSpamReport", { accountId: accountId, uid: uid, folderId: folderId });
+        },
         readJsoncFile: function(name) {
             return callNode("readJsoncFile", { name: name });
         },

package/client/styles/components.css

@@ -900,6 +900,19 @@ button.tb-menu-item { background: none; border: none; color: inherit; width: 100
    list empty when the selection is a singleton thread. */
 .ml-row.thread-filter-hidden { display: none; }
 
+/* Info banner inside a modal — used by the Add-contact dialog to surface
+   "already in address book" duplicate notices. Amber tone so it reads as
+   "heads up" not "error". */
+.mailx-modal-info {
+    padding: var(--gap-sm) var(--gap-md);
+    background: oklch(0.95 0.05 75);
+    border: 1px solid oklch(0.80 0.10 75);
+    border-radius: var(--radius-sm);
+    color: oklch(0.35 0.08 75);
+    font-size: var(--font-size-sm);
+    margin-bottom: var(--gap-sm);
+}
+
 /* Offline indicator — sits in the status bar; amber tone so it's visible
    but doesn't scream (being offline is normal local-first behavior, not
    an error). */
@@ -996,6 +1009,21 @@ body.calendar-sidebar-on .calendar-sidebar { display: flex; }
 .cal-side-event-dot.g { background: oklch(0.65 0.20 250); }  /* google — blue */
 .cal-side-event-time { color: var(--color-text); min-width: 44px; font-variant-numeric: tabular-nums; }
 .cal-side-event-title { flex: 1; }
+.cal-side-event-recur {
+    color: var(--color-text-muted);
+    margin-left: 4px;
+    font-size: 0.85em;
+    opacity: 0.8;
+}
+.cal-side-opt {
+    display: block;
+    padding: 2px 0;
+    font-size: 0.85em;
+    color: var(--color-text-muted);
+    cursor: pointer;
+}
+.cal-side-opt input[type=number] { margin-left: 4px; }
+.cal-side-event { cursor: pointer; }
 .cal-side-empty {
     padding: var(--gap-md) var(--gap-sm);
     color: var(--color-text-muted);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx",
-  "version": "1.0.383",
+  "version": "1.0.385",
   "description": "Local-first email client with IMAP sync and standalone native app",
   "type": "module",
   "main": "bin/mailx.js",
@@ -24,7 +24,7 @@
     "@bobfrankston/iflow-node": "^0.1.7",
     "@bobfrankston/miscinfo": "^1.0.9",
     "@bobfrankston/oauthsupport": "^1.0.24",
-    "@bobfrankston/msger": "^0.1.347",
+    "@bobfrankston/msger": "^0.1.348",
     "@bobfrankston/mailx-host": "^0.1.4",
     "@capacitor/android": "^8.3.0",
     "@capacitor/cli": "^8.3.0",
@@ -88,7 +88,7 @@
       "@bobfrankston/iflow-node": "^0.1.7",
       "@bobfrankston/miscinfo": "^1.0.9",
       "@bobfrankston/oauthsupport": "^1.0.24",
-      "@bobfrankston/msger": "^0.1.347",
+      "@bobfrankston/msger": "^0.1.348",
       "@bobfrankston/mailx-host": "^0.1.4",
       "@capacitor/android": "^8.3.0",
       "@capacitor/cli": "^8.3.0",

package/packages/mailx-service/google-sync.d.ts

@@ -24,6 +24,11 @@ export interface GCalEvent {
     location?: string;
     description?: string;
     etag?: string;
+    /** Set on instances expanded from a recurring series (singleEvents=true).
+     *  Absent for singletons. Lets the UI filter out recurring expansions. */
+    recurringEventId?: string;
+    /** Link to open the event in Google Calendar web. */
+    htmlLink?: string;
 }
 export declare function listCalendarEvents(tokenProvider: TokenProvider, fromMs: number, toMs: number, calendarId?: string): Promise<GCalEvent[]>;
 export declare function createCalendarEvent(tokenProvider: TokenProvider, event: any, calendarId?: string): Promise<GCalEvent>;
@@ -55,6 +60,8 @@ export declare function calendarEventToLocal(ev: GCalEvent, accountId: string):
     location: string;
     notes: string;
     etag: string;
+    recurringEventId: string | undefined;
+    htmlLink: string | undefined;
 };
 export declare function localToCalendarEvent(local: {
     title: string;

package/packages/mailx-service/google-sync.js

@@ -106,6 +106,8 @@ export function calendarEventToLocal(ev, accountId) {
         startMs, endMs, allDay,
         location: ev.location || "", notes: ev.description || "",
         etag: ev.etag || "",
+        recurringEventId: ev.recurringEventId,
+        htmlLink: ev.htmlLink,
     };
 }
 export function localToCalendarEvent(local) {

package/packages/mailx-service/index.d.ts

@@ -49,9 +49,14 @@ export declare class MailxService {
     getPrimaryAccount(feature?: string): any;
     private primaryTokenProvider;
     /** Return cal events visible in [fromMs..toMs), refreshing from Google
-     *  in the background if enough time has passed. Caller displays local
-     *  results immediately; events updated from Google emit an event. */
+     *  in the background. Caller displays local results immediately; after
+     *  the refresh completes the service emits `calendarUpdated` so the UI
+     *  re-renders with pulled-in rows. Fire-and-forget-with-event, not
+     *  fire-and-forget-and-pray. */
     getCalendarEvents(fromMs: number, toMs: number): Promise<any[]>;
+    /** Pull events in [fromMs..toMs) from Google, upsert locally, reconcile
+     *  server-side deletions. Returns true if anything changed so callers
+     *  can decide whether to emit a refresh event. */
     private refreshCalendarEvents;
     createCalendarEventLocal(ev: {
         title: string;
@@ -109,6 +114,18 @@ export declare class MailxService {
         targetFolderId: number;
         moved: number;
     }>;
+    /** Append a spam report row to `~/.mailx/spam.csv` — placeholder mechanism
+     *  per user 2026-04-23 ("let's make it smart later; no auto-delete until
+     *  safety issues are addressed"). One row per click. Columns: timestamp
+     *  (ms since epoch), ISO date, ISO time, accountId, Delivered-To, From
+     *  address, Subject, eml file path. CSV fields RFC 4180-quoted so commas
+     *  and quotes in subjects survive. No move, no flag change, no server
+     *  hit — just the log. Useful as training data for a future classifier.
+     */
+    recordSpamReport(accountId: string, uid: number, folderId: number): Promise<{
+        ok: true;
+        row: string;
+    }>;
     undeleteMessage(accountId: string, uid: number, folderId: number): Promise<void>;
     deleteOnServer(accountId: string, folderPath: string, uid: number): Promise<void>;
     createFolder(accountId: string, parentPath: string, name: string): Promise<void>;

package/packages/mailx-service/index.js

@@ -459,30 +459,56 @@ export class MailxService {
         };
     }
     /** Return cal events visible in [fromMs..toMs), refreshing from Google
-     *  in the background if enough time has passed. Caller displays local
-     *  results immediately; events updated from Google emit an event. */
+     *  in the background. Caller displays local results immediately; after
+     *  the refresh completes the service emits `calendarUpdated` so the UI
+     *  re-renders with pulled-in rows. Fire-and-forget-with-event, not
+     *  fire-and-forget-and-pray. */
     async getCalendarEvents(fromMs, toMs) {
         const acct = this.getPrimaryAccount("calendar");
         if (!acct)
             return [];
-        // Fire-and-forget refresh; don't block the read on it.
-        this.refreshCalendarEvents(acct.id, fromMs, toMs).catch(e => console.error(`[calendar] refresh failed: ${e.message}`));
+        this.refreshCalendarEvents(acct.id, fromMs, toMs)
+            .then(changed => {
+            if (changed)
+                this.imapManager.emit("calendarUpdated", { accountId: acct.id });
+        })
+            .catch(e => console.error(`[calendar] refresh failed: ${e.message}`));
         return this.db.getCalendarEvents(acct.id, fromMs, toMs);
     }
+    /** Pull events in [fromMs..toMs) from Google, upsert locally, reconcile
+     *  server-side deletions. Returns true if anything changed so callers
+     *  can decide whether to emit a refresh event. */
     async refreshCalendarEvents(accountId, fromMs, toMs) {
         const tp = await this.primaryTokenProvider("calendar");
         const events = await gsync.listCalendarEvents(tp, fromMs, toMs);
+        let changed = false;
+        // Upsert by provider_id — dedup globally, not just within the window,
+        // so an event whose start moves outside the prior query range doesn't
+        // get a second row on the next pull.
+        const seenProviderIds = new Set();
         for (const ev of events) {
             const local = gsync.calendarEventToLocal(ev, accountId);
-            // Use provider_id as the uuid basis — existing local row with matching
-            // providerId stays; if we invent a new uuid every time we'd create
-            // duplicates on every poll. Look up by provider_id first.
-            const existing = this.db.getCalendarEvents(accountId, fromMs, toMs).find(e => e.providerId === ev.id);
-            this.db.upsertCalendarEvent({
-                uuid: existing?.uuid,
-                ...local,
-            });
+            seenProviderIds.add(ev.id);
+            const existing = this.db.getCalendarEventByProviderId(accountId, ev.id);
+            this.db.upsertCalendarEvent({ uuid: existing?.uuid, ...local });
+            changed = true;
+        }
+        // Server-side delete reconciliation: any local non-dirty row whose
+        // start falls in the queried window and whose provider_id wasn't
+        // returned must have been deleted on Google. Purge it. Dirty rows
+        // are local-only edits that haven't been pushed yet — don't touch.
+        const localWindow = this.db.getCalendarEvents(accountId, fromMs, toMs);
+        for (const row of localWindow) {
+            if (!row.providerId)
+                continue; // local-only, never pushed
+            if (row.dirty)
+                continue; // locally edited, pending push
+            if (seenProviderIds.has(row.providerId))
+                continue;
+            this.db.purgeCalendarEvent(row.uuid);
+            changed = true;
         }
+        return changed;
     }
     async createCalendarEventLocal(ev) {
         const acct = this.getPrimaryAccount("calendar");
@@ -532,18 +558,38 @@ export class MailxService {
         const acct = this.getPrimaryAccount("tasks");
         if (!acct)
             return [];
-        this.refreshTasks(acct.id, includeCompleted).catch(e => console.error(`[tasks] refresh failed: ${e.message}`));
+        this.refreshTasks(acct.id, includeCompleted)
+            .then(changed => {
+            if (changed)
+                this.imapManager.emit("tasksUpdated", { accountId: acct.id });
+        })
+            .catch(e => console.error(`[tasks] refresh failed: ${e.message}`));
         return this.db.getTasks(acct.id, includeCompleted);
     }
     async refreshTasks(accountId, includeCompleted) {
         const tp = await this.primaryTokenProvider("tasks");
         const tasks = await gsync.listTasks(tp, "@default", includeCompleted);
         const existing = this.db.getTasks(accountId, true);
+        let changed = false;
+        const seen = new Set();
         for (const t of tasks) {
             const local = gsync.taskToLocal(t, accountId);
             const prior = existing.find(e => e.providerId === t.id);
             this.db.upsertTask({ uuid: prior?.uuid, ...local });
+            seen.add(t.id);
+            changed = true;
+        }
+        // Server-side delete reconciliation: any non-dirty local task whose
+        // provider_id wasn't returned has been deleted on Google. Purge.
+        for (const row of existing) {
+            if (!row.providerId || row.dirty)
+                continue;
+            if (seen.has(row.providerId))
+                continue;
+            this.db.purgeTask(row.uuid);
+            changed = true;
         }
+        return changed;
     }
     async createTaskLocal(t) {
         const acct = this.getPrimaryAccount("tasks");
@@ -943,6 +989,56 @@ export class MailxService {
         await this.moveMessages(accountId, uids, target.id);
         return { targetFolderId: target.id, moved: uids.length };
     }
+    /** Append a spam report row to `~/.mailx/spam.csv` — placeholder mechanism
+     *  per user 2026-04-23 ("let's make it smart later; no auto-delete until
+     *  safety issues are addressed"). One row per click. Columns: timestamp
+     *  (ms since epoch), ISO date, ISO time, accountId, Delivered-To, From
+     *  address, Subject, eml file path. CSV fields RFC 4180-quoted so commas
+     *  and quotes in subjects survive. No move, no flag change, no server
+     *  hit — just the log. Useful as training data for a future classifier.
+     */
+    async recordSpamReport(accountId, uid, folderId) {
+        const env = this.db.getMessageByUid(accountId, uid, folderId);
+        if (!env)
+            throw new Error(`Message not found: ${accountId}/${uid}`);
+        const bodyPath = env.bodyPath || "";
+        // Prefer `body_path` (authoritative). `Delivered-To` isn't in the
+        // envelope struct, so parse from the cached `.eml` if available.
+        let deliveredTo = "";
+        if (bodyPath) {
+            try {
+                const raw = fs.readFileSync(bodyPath, "utf-8").slice(0, 4096);
+                const m = raw.match(/^Delivered-To:\s*(.+)$/mi);
+                if (m)
+                    deliveredTo = m[1].trim();
+            }
+            catch { /* not fatal — leave blank */ }
+        }
+        const now = new Date();
+        const isoDate = now.toISOString().slice(0, 10);
+        const isoTime = now.toISOString().slice(11, 19);
+        const fromAddr = env.from?.address || "";
+        const subject = env.subject || "";
+        const csvEscape = (s) => `"${String(s).replace(/"/g, '""')}"`;
+        const row = [
+            String(now.getTime()),
+            csvEscape(isoDate),
+            csvEscape(isoTime),
+            csvEscape(accountId),
+            csvEscape(deliveredTo),
+            csvEscape(fromAddr),
+            csvEscape(subject),
+            csvEscape(bodyPath),
+        ].join(",") + "\n";
+        const spamCsvPath = path.join(getConfigDir(), "spam.csv");
+        // Write a header if the file doesn't exist yet so the CSV is self-describing.
+        if (!fs.existsSync(spamCsvPath)) {
+            fs.writeFileSync(spamCsvPath, "timestamp_ms,date,time,account,delivered_to,from,subject,eml_path\n", "utf-8");
+        }
+        fs.appendFileSync(spamCsvPath, row, "utf-8");
+        console.log(`  [spam] reported ${accountId}/${uid} → spam.csv`);
+        return { ok: true, row };
+    }
     async undeleteMessage(accountId, uid, folderId) {
         // Clear the tombstone first so a subsequent sync can re-import if
         // the server still has the row. Messages with no Message-ID just

package/packages/mailx-service/jsonrpc.js

@@ -123,6 +123,8 @@ async function dispatchAction(svc, action, p) {
         case "drainStoreSync":
             await svc.drainStoreSync();
             return { ok: true };
+        case "recordSpamReport":
+            return await svc.recordSpamReport(p.accountId, p.uid, p.folderId);
         case "getOutboxStatus":
             return svc.getOutboxStatus();
         case "listQueuedOutgoing":

package/packages/mailx-store/db.d.ts

@@ -46,6 +46,8 @@ export declare class MailxDB {
         notes?: string;
         etag?: string;
         dirty?: boolean;
+        recurringEventId?: string;
+        htmlLink?: string;
     }): string;
     getCalendarEvents(accountId: string, fromMs: number, toMs: number): any[];
     /** Lookup by uuid only — used by patch/delete paths that don't have an
@@ -54,6 +56,9 @@ export declare class MailxDB {
     getTaskByUuid(uuid: string): any | null;
     getDirtyCalendarEvents(accountId: string): any[];
     private calendarRowToObject;
+    /** Find a calendar event by its Google Calendar event id (provider_id).
+     *  Global lookup — not window-scoped — so repeat pulls dedup cleanly. */
+    getCalendarEventByProviderId(accountId: string, providerId: string): any | null;
     markCalendarEventClean(uuid: string, providerId: string, etag: string): void;
     deleteCalendarEventLocal(uuid: string): void;
     purgeCalendarEvent(uuid: string): void;

package/packages/mailx-store/db.js

@@ -244,6 +244,11 @@ export class MailxDB {
             this.db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_messages_uuid ON messages(uuid)");
         }
         catch { /* already exists */ }
+        // calendar_events: recurring_event_id carries the Google Calendar
+        // series id when the event is an expanded instance of a recurrence.
+        // Filters like "hide recurring events" check this column.
+        this.addColumnIfMissing("calendar_events", "recurring_event_id", "TEXT");
+        this.addColumnIfMissing("calendar_events", "html_link", "TEXT");
         // Backfill UUIDs for any pre-existing rows that were inserted before
         // this column landed. One UPDATE + an id roundtrip per row — cheap
         // at our row counts, runs once per DB upgrade.
@@ -375,8 +380,9 @@ export class MailxDB {
         this.db.prepare(`
             INSERT INTO calendar_events
                 (uuid, account_id, provider_id, calendar_id, title, start_ms, end_ms,
-                 all_day, location, notes, etag, last_synced, dirty, deleted, updated_at)
-            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?)
+                 all_day, location, notes, etag, last_synced, dirty, deleted, updated_at,
+                 recurring_event_id, html_link)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, ?)
             ON CONFLICT(uuid) DO UPDATE SET
                 account_id=excluded.account_id, provider_id=excluded.provider_id,
                 calendar_id=excluded.calendar_id, title=excluded.title,
@@ -384,8 +390,10 @@ export class MailxDB {
                 all_day=excluded.all_day, location=excluded.location,
                 notes=excluded.notes, etag=excluded.etag,
                 last_synced=excluded.last_synced, dirty=excluded.dirty,
-                updated_at=excluded.updated_at
-        `).run(uuid, ev.accountId, ev.providerId || null, ev.calendarId || "primary", ev.title, ev.startMs, ev.endMs, ev.allDay ? 1 : 0, ev.location || "", ev.notes || "", ev.etag || null, ev.dirty ? 0 : Date.now(), ev.dirty ? 1 : 0, Date.now());
+                updated_at=excluded.updated_at,
+                recurring_event_id=excluded.recurring_event_id,
+                html_link=excluded.html_link
+        `).run(uuid, ev.accountId, ev.providerId || null, ev.calendarId || "primary", ev.title, ev.startMs, ev.endMs, ev.allDay ? 1 : 0, ev.location || "", ev.notes || "", ev.etag || null, ev.dirty ? 0 : Date.now(), ev.dirty ? 1 : 0, Date.now(), ev.recurringEventId || null, ev.htmlLink || null);
         return uuid;
     }
     getCalendarEvents(accountId, fromMs, toMs) {
@@ -418,8 +426,16 @@ export class MailxDB {
             calendarId: r.calendar_id, title: r.title, startMs: r.start_ms,
             endMs: r.end_ms, allDay: !!r.all_day, location: r.location, notes: r.notes,
             etag: r.etag, lastSynced: r.last_synced, dirty: !!r.dirty, deleted: !!r.deleted,
+            recurringEventId: r.recurring_event_id || null,
+            htmlLink: r.html_link || null,
         };
     }
+    /** Find a calendar event by its Google Calendar event id (provider_id).
+     *  Global lookup — not window-scoped — so repeat pulls dedup cleanly. */
+    getCalendarEventByProviderId(accountId, providerId) {
+        const r = this.db.prepare("SELECT * FROM calendar_events WHERE account_id = ? AND provider_id = ?").get(accountId, providerId);
+        return r ? this.calendarRowToObject(r) : null;
+    }
     markCalendarEventClean(uuid, providerId, etag) {
         this.db.prepare(`
             UPDATE calendar_events SET dirty=0, provider_id=?, etag=?, last_synced=? WHERE uuid=?