@bobfrankston/mailx 1.0.386 → 1.0.391

package/bin/mailx.js

@@ -15,6 +15,8 @@
  *   mailx -test              Test IMAP/SMTP connectivity
  *   mailx -rebuild           Wipe local cache, re-sync from IMAP
  *   mailx -repair            Re-sync metadata (fix corrupt subjects) keeping .eml files
+ *   mailx -reauth            Clear cached OAuth tokens; next start re-consents
+ *                             (use when new Google scopes have been added)
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -87,7 +89,7 @@ function pidAlive(pid) {
 // on an old UI with no indication that the install has been upgraded.
 // Skip this logic for command-only flags (kill, rebuild, setup, ...) and for
 // the internal --daemon respawn.
-const __commandFlags = ["kill", "v", "version", "setup", "add", "test", "rebuild", "repair", "import", "log"];
+const __commandFlags = ["kill", "v", "version", "setup", "add", "test", "rebuild", "repair", "import", "log", "reauth"];
 const __isCommandInvocation = process.argv.slice(2).some(a => __commandFlags.includes(a.replace(/^--?/, "")));
 if (!isDaemon && !__isCommandInvocation) {
     const inst = readInstanceFile();
@@ -278,6 +280,39 @@ if (hasFlag("kill")) {
         console.log("No mailx processes found");
     process.exit(0);
 }
+// Re-auth: clear cached OAuth tokens so the next start forces a fresh
+// consent flow. Needed when scopes change (e.g. Google Tasks was added
+// 2026-04-23 but existing tokens were issued against the older scope
+// set, so tasks API calls 403ed with "insufficient authentication
+// scopes"). Safe — tokens are only a cache; fresh consent re-issues.
+if (hasFlag("reauth")) {
+    const { getConfigDir } = await import("@bobfrankston/mailx-settings");
+    const tokensDir = path.join(getConfigDir(), "tokens");
+    if (!fs.existsSync(tokensDir)) {
+        console.log("No tokens directory — nothing to clear.");
+        process.exit(0);
+    }
+    let cleared = 0;
+    for (const entry of fs.readdirSync(tokensDir)) {
+        const userDir = path.join(tokensDir, entry);
+        try {
+            const stat = fs.statSync(userDir);
+            if (!stat.isDirectory())
+                continue;
+            const tokenFile = path.join(userDir, "oauth-token.json");
+            if (fs.existsSync(tokenFile)) {
+                fs.unlinkSync(tokenFile);
+                console.log(`  Cleared token for ${entry}`);
+                cleared++;
+            }
+        }
+        catch { /* skip */ }
+    }
+    console.log(cleared === 0
+        ? "No cached tokens found."
+        : `Cleared ${cleared} cached token(s). Next 'mailx' start will open a browser OAuth consent so the new scopes (tasks, full contacts) get granted.`);
+    process.exit(0);
+}
 // Rebuild: wipe DB + message store, keep accounts/settings
 if (rebuildMode) {
     const { getConfigDir, getStorePath } = await import("@bobfrankston/mailx-settings");
@@ -1222,6 +1257,9 @@ RFC 5322 with CRLF line endings. Bodies are quoted-printable encoded (readable i
     imapManager.on("tasksUpdated", (payload) => {
         handle.send({ _event: "tasksUpdated", type: "tasksUpdated", ...payload });
     });
+    imapManager.on("authScopeError", (payload) => {
+        handle.send({ _event: "authScopeError", type: "authScopeError", ...payload });
+    });
     imapManager.on("bodyCached", (accountId, uid) => {
         pendingCached.push({ accountId, uid });
         if (!cachedTimer) {
@@ -1303,6 +1341,18 @@ RFC 5322 with CRLF line endings. Bodies are quoted-printable encoded (readable i
     // initial sync finishes so IMAP accounts get instant-push new-mail (the
     // 5-min STATUS poll is only a safety net).
     if (settings.accounts.some(a => a.enabled)) {
+        // Fast-path: fire a quick INBOX check on every account IMMEDIATELY,
+        // parallel to the full syncAll. quickInboxCheckAccount uses a fresh
+        // client + a cached folder list from the DB, so it skips the
+        // folder-list fetch that syncAll's step 1 does. On a cold Dovecot
+        // session that folder LIST can take several seconds on big trees
+        // (bobma = ~105 folders) — no reason the user should wait for it
+        // before seeing mail that arrived overnight in INBOX.
+        for (const acct of settings.accounts) {
+            if (!acct.enabled)
+                continue;
+            imapManager.quickInboxCheckAccount(acct.id).catch(e => console.error(`  [startup-check] ${acct.id}: ${e?.message || e}`));
+        }
         imapManager.syncAll()
             .then(() => imapManager.startWatching())
             .then(() => {

package/client/components/calendar-sidebar.js

@@ -13,9 +13,10 @@
  * All storage goes through the service-side two-way cache (calendar_events
  * and tasks tables); this file does not use localStorage for data.
  */
-import { getCalendarEvents, createCalendarEvent, getTasks, createTask, updateTask, deleteTask, } from "../lib/api-client.js";
+import { getCalendarEvents, createCalendarEvent, getTasks, createTask, updateTask, deleteTask, reauthGoogleScopes, } from "../lib/api-client.js";
 const SIDEBAR_PREF = "mailx-calendar-sidebar-on";
 const SHOW_RECURRING_PREF = "mailx-cal-show-recurring";
+const SHOW_DONE_PREF = "mailx-task-show-done";
 const HORIZON_DAYS_PREF = "mailx-cal-horizon-days";
 const HORIZON_DEFAULT_DAYS = 30;
 let viewYear = new Date().getFullYear();
@@ -131,7 +132,8 @@ function renderEvents(events) {
     });
 }
 async function renderTasks() {
-    const showDone = document.getElementById("cal-side-show-done")?.checked || false;
+    const cb = document.getElementById("cal-side-show-done");
+    const showDone = cb?.checked ?? false;
     const tasks = await getTasks(showDone);
     const host = document.getElementById("cal-side-tasks");
     if (!host)
@@ -248,7 +250,18 @@ export function initCalendarSidebar() {
     const showDoneCb = document.getElementById("cal-side-show-done");
     if (showDoneCb && !showDoneCb.__wired) {
         showDoneCb.__wired = true;
-        showDoneCb.addEventListener("change", () => renderTasks());
+        // Sticky: restore prior state and persist on change. Default off.
+        try {
+            showDoneCb.checked = localStorage.getItem(SHOW_DONE_PREF) === "true";
+        }
+        catch { /* */ }
+        showDoneCb.addEventListener("change", () => {
+            try {
+                localStorage.setItem(SHOW_DONE_PREF, String(showDoneCb.checked));
+            }
+            catch { /* */ }
+            renderTasks();
+        });
     }
     // Recurring-events filter toggle — hides expanded recurring-series
     // instances when unchecked. Default on so new users see everything.
@@ -295,6 +308,40 @@ export function initCalendarSidebar() {
                     refresh();
                 else if (event?.type === "tasksUpdated")
                     renderTasks();
+                else if (event?.type === "authScopeError") {
+                    // Surface a visible hint right in the affected pane so the
+                    // user doesn't stare at an empty list wondering why. Only
+                    // writes to the matching pane; other panes keep rendering.
+                    //
+                    // Idempotent: if the banner is already shown for this
+                    // feature (class `.cal-side-auth-error` present), don't
+                    // re-write the DOM — stops the "flashing on and off
+                    // continually" effect when the service re-emits on every
+                    // 5-min poll or sidebar-nav click.
+                    const host = event.feature === "tasks"
+                        ? document.getElementById("cal-side-tasks")
+                        : document.getElementById("cal-side-body");
+                    if (host && !host.querySelector(".cal-side-auth-error")) {
+                        const msg = event.message || "Google access needs re-consent.";
+                        host.innerHTML = `<div class="cal-side-empty cal-side-auth-error">
+                            <div style="margin-bottom:0.6em">${escapeHtml(msg)}</div>
+                            <button type="button" class="cal-side-reauth-btn" style="padding:0.3em 0.8em;border-radius:4px;border:1px solid currentColor;background:transparent;color:inherit;cursor:pointer;font-size:0.9em">Re-authenticate Now</button>
+                        </div>`;
+                        const btn = host.querySelector(".cal-side-reauth-btn");
+                        btn?.addEventListener("click", async () => {
+                            btn.disabled = true;
+                            btn.textContent = "Opening browser…";
+                            try {
+                                await reauthGoogleScopes();
+                                btn.textContent = "Consent opened — complete it in the browser";
+                            }
+                            catch (err) {
+                                btn.disabled = false;
+                                btn.textContent = `Failed: ${err?.message || err}. Click to retry.`;
+                            }
+                        });
+                    }
+                }
             });
         }
     }

package/client/components/folder-tree.js

@@ -467,6 +467,9 @@ async function loadFolderTree(container) {
                             Email address
                             <input id="setup-email" type="email" placeholder="you@gmail.com" required style="display:block;width:100%;padding:0.5rem;margin-top:0.25rem;background:var(--color-bg-surface);color:var(--color-text);border:1px solid var(--color-border);border-radius:4px">
                         </label>
+                        <div id="setup-provider-preview" style="display:none;margin-bottom:0.5rem;padding:0.4rem 0.6rem;background:var(--color-bg-surface);border:1px solid var(--color-border);border-radius:4px;font-size:0.9rem">
+                            <span id="setup-provider-icon" style="display:inline-block;width:1.2em;text-align:center;margin-right:0.4em"></span><span id="setup-provider-label"></span>
+                        </div>
                         <label id="setup-name-row" style="display:none;margin-bottom:0.5rem">
                             Your name <span style="color:var(--color-text-muted);font-size:0.85rem">(optional — auto-detected from Google)</span>
                             <input id="setup-name" type="text" placeholder="Your Name (leave blank to use Google profile)" style="display:block;width:100%;padding:0.5rem;margin-top:0.25rem;background:var(--color-bg-surface);color:var(--color-text);border:1px solid var(--color-border);border-radius:4px">
@@ -496,6 +499,23 @@ async function loadFolderTree(container) {
                     "aol.com": "Use an app password: AOL Settings → Account Security → Generate app password",
                     "icloud.com": "Use an app-specific password: appleid.apple.com → Sign-In and Security → App-Specific Passwords",
                 };
+                // Q67: describe the detected provider so the user knows which
+                // auto-config path we're about to take BEFORE they hit Next.
+                // Gmail / Google Workspace domains auto-detect via MX in the
+                // service; here we can only name the known ones up front and
+                // say "will auto-detect" for everything else.
+                const PROVIDER_PREVIEW = {
+                    "gmail.com": { icon: "✉", label: "Gmail — OAuth (no password needed)" },
+                    "googlemail.com": { icon: "✉", label: "Gmail — OAuth (no password needed)" },
+                    "outlook.com": { icon: "✉", label: "Outlook.com — OAuth (no password needed)" },
+                    "hotmail.com": { icon: "✉", label: "Outlook.com — OAuth (no password needed)" },
+                    "live.com": { icon: "✉", label: "Outlook.com — OAuth (no password needed)" },
+                    "yahoo.com": { icon: "✉", label: "Yahoo Mail — IMAP (needs app password)" },
+                    "aol.com": { icon: "✉", label: "AOL Mail — IMAP (needs app password)" },
+                    "icloud.com": { icon: "✉", label: "iCloud Mail — IMAP (needs app-specific password)" },
+                    "me.com": { icon: "✉", label: "iCloud Mail — IMAP (needs app-specific password)" },
+                    "mac.com": { icon: "✉", label: "iCloud Mail — IMAP (needs app-specific password)" },
+                };
                 let oauthAutoFired = false;
                 emailInput?.addEventListener("input", () => {
                     const email = emailInput.value.trim();
@@ -503,6 +523,21 @@ async function loadFolderTree(container) {
                     const hasAt = email.includes("@") && domain.length > 0;
                     const isOAuth = ["gmail.com", "googlemail.com", "outlook.com", "hotmail.com", "live.com"].includes(domain);
                     const isGmailLike = ["gmail.com", "googlemail.com"].includes(domain);
+                    // Provider preview row
+                    const preview = document.getElementById("setup-provider-preview");
+                    const icon = document.getElementById("setup-provider-icon");
+                    const label = document.getElementById("setup-provider-label");
+                    if (preview && icon && label) {
+                        if (hasAt) {
+                            const hit = PROVIDER_PREVIEW[domain];
+                            icon.textContent = hit ? hit.icon : "❓";
+                            label.textContent = hit ? hit.label : `${domain} — will auto-detect via MX records`;
+                            preview.style.display = "block";
+                        }
+                        else {
+                            preview.style.display = "none";
+                        }
+                    }
                     // OAuth providers: auto-fire setup immediately once domain
                     // is recognized — don't show name/password (name is auto-
                     // detected from Google profile, no password needed). This

package/client/lib/api-client.js

@@ -128,6 +128,9 @@ export function syncAccount(accountId) {
 export function reauthenticate(accountId) {
     return ipc().reauthenticate(accountId);
 }
+export function reauthGoogleScopes() {
+    return ipc().reauthGoogleScopes();
+}
 export function getSyncPending() {
     return ipc().getSyncPending();
 }

package/client/lib/mailxapi.js

@@ -180,6 +180,7 @@
         listQueuedOutgoing: function() { return callNode("listQueuedOutgoing"); },
         cancelQueuedOutgoing: function(p) { return callNode("cancelQueuedOutgoing", { path: p }); },
         reauthenticate: function(accountId) { return callNode("reauthenticate", { accountId: accountId }); },
+        reauthGoogleScopes: function() { return callNode("reauthGoogleScopes"); },
 
         // Bulk operations
         deleteMessages: function(accountId, uids) {

package/client/styles/components.css

@@ -1024,6 +1024,17 @@ body.calendar-sidebar-on .calendar-sidebar { display: flex; }
 }
 .cal-side-opt input[type=number] { margin-left: 4px; }
 .cal-side-event { cursor: pointer; }
+.cal-side-auth-error {
+    color: oklch(0.55 0.18 25);
+    font-weight: 600;
+    padding: var(--gap-sm);
+    background: oklch(0.96 0.04 25);
+    border: 1px solid oklch(0.80 0.12 25);
+    border-radius: var(--radius-sm);
+    font-style: normal !important;
+    line-height: 1.4;
+    text-align: left !important;
+}
 .cal-side-empty {
     padding: var(--gap-md) var(--gap-sm);
     color: var(--color-text-muted);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx",
-  "version": "1.0.386",
+  "version": "1.0.391",
   "description": "Local-first email client with IMAP sync and standalone native app",
   "type": "module",
   "main": "bin/mailx.js",

package/packages/mailx-imap/index.js

@@ -1020,23 +1020,41 @@ export class ImapManager extends EventEmitter {
         }
         if (newCount > 0)
             console.log(`    stored ${newCount} new messages`);
-        // Remove messages deleted on the server (skip on first sync — nothing to reconcile)
+        // Remove messages deleted on the server (skip on first sync — nothing to reconcile).
+        //
+        // SAFETY (same three guards the Gmail API path uses, see ~line 1388):
+        //   1. Skip if server returned an empty list but we have local messages
+        //      (transient Dovecot error / connection hiccup returning empty UID SEARCH
+        //      must not wipe the folder).
+        //   2. Refuse to delete more than 50% in one pass — indicates a sync bug,
+        //      never a real user action. User can fix with `mailx -rebuild` if real.
+        //   3. Log every deletion with Message-ID + subject so future reports have
+        //      data (the "ubiquiti letter disappeared after reply" case had no trace).
         let deletedCount = 0;
         if (!firstSync) {
             try {
-                // Reuse the passed-in client instead of opening a new connection
-                const serverUids = new Set(await client.getUids(folder.path));
+                const serverUidsArr = await client.getUids(folder.path);
+                const serverUids = new Set(serverUidsArr);
                 const localUids = this.db.getUidsForFolder(accountId, folderId);
-                for (const uid of localUids) {
-                    if (!serverUids.has(uid)) {
-                        // Read body_path BEFORE deleting the row, then unlink.
+                const toDelete = localUids.filter(uid => !serverUids.has(uid));
+                if (serverUidsArr.length === 0 && localUids.length > 0) {
+                    console.log(`  [sync] ${accountId}/${folder.path}: reconcile skipped — server UID list empty but local has ${localUids.length} (treating as transient)`);
+                }
+                else if (localUids.length > 0 && toDelete.length / localUids.length > 0.5) {
+                    console.log(`  [sync] ${accountId}/${folder.path}: reconcile REFUSED — would delete ${toDelete.length}/${localUids.length} (${Math.round(toDelete.length / localUids.length * 100)}%) — probably a sync bug, skipping`);
+                }
+                else {
+                    for (const uid of toDelete) {
+                        const env = this.db.getMessageByUid(accountId, uid);
+                        const tag = env ? `msgid=${env.messageId || "?"} subj="${(env.subject || "").slice(0, 60)}"` : "unknown";
+                        console.log(`  [reconcile-delete] ${accountId}/${folder.path} uid=${uid} ${tag}`);
                         this.unlinkBodyFile(accountId, uid, folderId).catch(() => { });
                         this.db.deleteMessage(accountId, uid);
                         deletedCount++;
                     }
+                    if (deletedCount > 0)
+                        console.log(`    removed ${deletedCount} deleted messages`);
                 }
-                if (deletedCount > 0)
-                    console.log(`    removed ${deletedCount} deleted messages`);
             }
             catch (e) {
                 console.error(`    deletion sync error: ${e.message}`);
@@ -1394,6 +1412,9 @@ export class ImapManager extends EventEmitter {
                 }
                 else {
                     for (const uid of toDelete) {
+                        const env = this.db.getMessageByUid(accountId, uid);
+                        const tag = env ? `msgid=${env.messageId || "?"} subj="${(env.subject || "").slice(0, 60)}"` : "unknown";
+                        console.log(`  [reconcile-delete] ${accountId}/${folder.path} uid=${uid} ${tag}`);
                         this.unlinkBodyFile(accountId, uid, folder.id).catch(() => { });
                         this.db.deleteMessage(accountId, uid);
                     }
@@ -3046,18 +3067,50 @@ export class ImapManager extends EventEmitter {
             }
             return;
         }
-        // IMAP accounts: append to IMAP Outbox for multi-machine interlock
+        // IMAP accounts: append to IMAP Outbox for multi-machine interlock.
+        //
+        // Atomic claim (same pattern as the Gmail path above): rename the file
+        // to <file>.sending-<host>-<pid> BEFORE reading it, so two concurrent
+        // mailx instances scanning the same dir can't both APPEND the same
+        // message to IMAP Outbox and end up with a duplicate. Filesystem rename
+        // is atomic; the loser sees ENOENT and skips. On APPEND success, move
+        // the claimed file to sending/sent/; on APPEND failure, release the
+        // claim so the recovery sweeper picks it up next tick.
         try {
             const outboxPath = await this.ensureOutbox(accountId);
             const client = await this.createClientWithLimit(accountId);
             try {
                 for (const { dir, file } of filesToSend) {
                     const filePath = path.join(dir, file);
-                    const raw = fs.readFileSync(filePath, "utf-8");
-                    await client.appendMessage(outboxPath, raw, ["\\Seen"]);
-                    // Move to sent/
-                    fs.renameSync(filePath, path.join(sentDir, file));
-                    console.log(`  [outbox] Moved ${file} to IMAP Outbox → sent/`);
+                    const claimSuffix = `.sending-${this.hostname}-${process.pid}`;
+                    const claimedPath = filePath + claimSuffix;
+                    try {
+                        fs.renameSync(filePath, claimedPath);
+                    }
+                    catch (e) {
+                        if (e.code === "ENOENT")
+                            continue; // sibling claimed first
+                        throw e;
+                    }
+                    try {
+                        const raw = fs.readFileSync(claimedPath, "utf-8");
+                        await client.appendMessage(outboxPath, raw, ["\\Seen"]);
+                        fs.renameSync(claimedPath, path.join(sentDir, file));
+                        console.log(`  [outbox] Moved ${file} to IMAP Outbox → sent/`);
+                    }
+                    catch (e) {
+                        // APPEND failed (connection dropped mid-send, server
+                        // busy, etc.) — release the claim so next tick can
+                        // retry. Don't swallow: rethrow after release so the
+                        // outer catch ("IMAP still unreachable") bails out of
+                        // the remaining files too — whatever broke will break
+                        // the next file the same way.
+                        try {
+                            fs.renameSync(claimedPath, filePath);
+                        }
+                        catch { /* recovery sweeper will handle */ }
+                        throw e;
+                    }
                 }
             }
             finally {
@@ -3323,7 +3376,11 @@ export class ImapManager extends EventEmitter {
             // After each full tick, refresh the UI indicator.
             this.emitOutboxStatus();
         };
-        setTimeout(() => processAll(), 3000);
+        // First tick at 500ms so any stale .sending-HOST-DEAD_PID claim file
+        // left behind by a prior crash gets recovered (renamed back to .ltr)
+        // within half a second of startup — otherwise the status-queue pill
+        // shows a red "1 queued" to the user until the first 10s tick passes.
+        setTimeout(() => processAll(), 500);
         this.outboxInterval = setInterval(processAll, 10000);
     }
     /** Stop Outbox worker */

package/packages/mailx-service/index.d.ts

@@ -47,6 +47,20 @@ export declare class MailxService {
      *  Called without `feature` it returns the catch-all primary — same
      *  semantics as the original single-flag version for back-compat. */
     getPrimaryAccount(feature?: string): any;
+    /** Feature names that have already emitted authScopeError this session.
+     *  Stops the "banner flashing on and off continually" loop where every
+     *  5-min poll / sidebar nav re-fired the event and the client re-rendered
+     *  the red banner. Cleared when the user hits Re-authenticate. */
+    private scopeErrorEmitted;
+    /** Delete the cached Google OAuth token (the one used for Calendar / Tasks
+     *  / Contacts scopes — NOT the IMAP token which `reauthenticate()` handles)
+     *  and clear the sticky auth-error state so a subsequent refresh can
+     *  re-trigger browser consent with the current scope set. Equivalent of
+     *  `mailx -reauth` but callable from the UI. Returns `{ cleared: N }` so
+     *  the caller can tell the user what happened. */
+    reauthGoogleScopes(): {
+        cleared: number;
+    };
     private primaryTokenProvider;
     /** Return cal events visible in [fromMs..toMs), refreshing from Google
      *  in the background. Caller displays local results immediately; after

package/packages/mailx-service/index.js

@@ -447,6 +447,46 @@ export class MailxService {
         return all.find((a) => a.primary) || all[0] || null;
     }
     // ── Calendar / Tasks / Contacts: two-way cache (2026-04-23) ──
+    /** Feature names that have already emitted authScopeError this session.
+     *  Stops the "banner flashing on and off continually" loop where every
+     *  5-min poll / sidebar nav re-fired the event and the client re-rendered
+     *  the red banner. Cleared when the user hits Re-authenticate. */
+    scopeErrorEmitted = new Set();
+    /** Delete the cached Google OAuth token (the one used for Calendar / Tasks
+     *  / Contacts scopes — NOT the IMAP token which `reauthenticate()` handles)
+     *  and clear the sticky auth-error state so a subsequent refresh can
+     *  re-trigger browser consent with the current scope set. Equivalent of
+     *  `mailx -reauth` but callable from the UI. Returns `{ cleared: N }` so
+     *  the caller can tell the user what happened. */
+    reauthGoogleScopes() {
+        const tokensDir = path.join(getConfigDir(), "tokens");
+        let cleared = 0;
+        if (fs.existsSync(tokensDir)) {
+            for (const entry of fs.readdirSync(tokensDir)) {
+                const userDir = path.join(tokensDir, entry);
+                try {
+                    if (!fs.statSync(userDir).isDirectory())
+                        continue;
+                    const tokenFile = path.join(userDir, "oauth-token.json");
+                    if (fs.existsSync(tokenFile)) {
+                        fs.unlinkSync(tokenFile);
+                        console.log(`  [reauth-google] cleared ${tokenFile}`);
+                        cleared++;
+                    }
+                }
+                catch { /* skip */ }
+            }
+        }
+        // Reset the sticky set so the next failure (if re-consent didn't take)
+        // can fire a fresh banner. Also trigger a kickoff refresh so the
+        // browser consent pops open now instead of on next sidebar nav.
+        this.scopeErrorEmitted.clear();
+        const now = Date.now();
+        const horizonMs = 90 * 86400_000;
+        this.getCalendarEvents(now, now + horizonMs); // fire-and-forget — triggers consent via primaryTokenProvider
+        this.getTasks(false); // same path, `tasks` scope
+        return { cleared };
+    }
     async primaryTokenProvider(feature) {
         const acct = this.getPrimaryAccount(feature);
         if (!acct)
@@ -472,7 +512,19 @@ export class MailxService {
             if (changed)
                 this.imapManager.emit("calendarUpdated", { accountId: acct.id });
         })
-            .catch(e => console.error(`[calendar] refresh failed: ${e.message}`));
+            .catch(e => {
+            const msg = String(e?.message || e);
+            console.error(`[calendar] refresh failed: ${msg}`);
+            if (/insufficient (authentication )?scope|PERMISSION_DENIED|403/i.test(msg)) {
+                if (!this.scopeErrorEmitted.has("calendar")) {
+                    this.scopeErrorEmitted.add("calendar");
+                    this.imapManager.emit("authScopeError", {
+                        feature: "calendar",
+                        message: "Google Calendar access needs re-consent.",
+                    });
+                }
+            }
+        });
         return this.db.getCalendarEvents(acct.id, fromMs, toMs);
     }
     /** Pull events in [fromMs..toMs) from Google, upsert locally, reconcile
@@ -481,6 +533,7 @@ export class MailxService {
     async refreshCalendarEvents(accountId, fromMs, toMs) {
         const tp = await this.primaryTokenProvider("calendar");
         const events = await gsync.listCalendarEvents(tp, fromMs, toMs);
+        console.log(`  [calendar] pulled ${events.length} events from ${new Date(fromMs).toISOString().slice(0, 10)} to ${new Date(toMs).toISOString().slice(0, 10)}`);
         let changed = false;
         // Upsert by provider_id — dedup globally, not just within the window,
         // so an event whose start moves outside the prior query range doesn't
@@ -563,12 +616,26 @@ export class MailxService {
             if (changed)
                 this.imapManager.emit("tasksUpdated", { accountId: acct.id });
         })
-            .catch(e => console.error(`[tasks] refresh failed: ${e.message}`));
+            .catch(e => {
+            const msg = String(e?.message || e);
+            console.error(`[tasks] refresh failed: ${msg}`);
+            if (/insufficient (authentication )?scope|PERMISSION_DENIED|403/i.test(msg)) {
+                if (!this.scopeErrorEmitted.has("tasks")) {
+                    this.scopeErrorEmitted.add("tasks");
+                    console.error(`[tasks] Your cached OAuth token doesn't include the 'tasks' scope.`);
+                    this.imapManager.emit("authScopeError", {
+                        feature: "tasks",
+                        message: "Google Tasks access needs re-consent.",
+                    });
+                }
+            }
+        });
         return this.db.getTasks(acct.id, includeCompleted);
     }
     async refreshTasks(accountId, includeCompleted) {
         const tp = await this.primaryTokenProvider("tasks");
         const tasks = await gsync.listTasks(tp, "@default", includeCompleted);
+        console.log(`  [tasks] pulled ${tasks.length} tasks`);
         const existing = this.db.getTasks(accountId, true);
         let changed = false;
         const seen = new Set();
@@ -730,11 +797,40 @@ export class MailxService {
             for (const f of fs.readdirSync(dir)) {
                 if (!f.endsWith(".ltr") && !f.endsWith(".eml") && !/\.sending-/.test(f))
                     continue;
+                const fp = path.join(dir, f);
                 try {
-                    const raw = fs.readFileSync(path.join(dir, f), "utf-8");
+                    const raw = fs.readFileSync(fp, "utf-8");
                     out.push(parseEnv(raw, f, dir, accountId));
                 }
-                catch { /* unreadable — skip */ }
+                catch (err) {
+                    // Unreadable file — still show it so the user can cancel.
+                    // Previously silently skipped, which produced the user-reported
+                    // "outbox badge shows 1 but the modal is empty" symptom:
+                    // getOutboxStatus counted the file, listQueuedOutgoing dropped it.
+                    const st = (() => { try {
+                        return fs.statSync(fp);
+                    }
+                    catch {
+                        return null;
+                    } })();
+                    out.push({
+                        accountId,
+                        file: f,
+                        path: fp,
+                        dir,
+                        from: "",
+                        to: "",
+                        cc: "",
+                        bcc: "",
+                        subject: `[unreadable: ${err?.code || err?.message || "read failed"}]`,
+                        date: "",
+                        messageId: "",
+                        attempts: 0,
+                        sizeBytes: st?.size || 0,
+                        createdAt: st?.mtimeMs || 0,
+                        claimed: /\.sending-[^-]+-\d+$/.test(f),
+                    });
+                }
             }
         };
         try {

package/packages/mailx-service/jsonrpc.js

@@ -133,6 +133,8 @@ async function dispatchAction(svc, action, p) {
             return svc.cancelQueuedOutgoing(p.path);
         case "reauthenticate":
             return { ok: await svc.reauthenticate(p.accountId) };
+        case "reauthGoogleScopes":
+            return svc.reauthGoogleScopes();
         // Search & contacts
         case "searchMessages":
             return svc.search(p.query, p.page, p.pageSize, p.scope, p.accountId, p.folderId);