@bobfrankston/mailx 1.0.389 → 1.0.391

package/client/components/calendar-sidebar.js

@@ -13,7 +13,7 @@
  * All storage goes through the service-side two-way cache (calendar_events
  * and tasks tables); this file does not use localStorage for data.
  */
-import { getCalendarEvents, createCalendarEvent, getTasks, createTask, updateTask, deleteTask, } from "../lib/api-client.js";
+import { getCalendarEvents, createCalendarEvent, getTasks, createTask, updateTask, deleteTask, reauthGoogleScopes, } from "../lib/api-client.js";
 const SIDEBAR_PREF = "mailx-calendar-sidebar-on";
 const SHOW_RECURRING_PREF = "mailx-cal-show-recurring";
 const SHOW_DONE_PREF = "mailx-task-show-done";
@@ -312,11 +312,34 @@ export function initCalendarSidebar() {
                     // Surface a visible hint right in the affected pane so the
                     // user doesn't stare at an empty list wondering why. Only
                     // writes to the matching pane; other panes keep rendering.
+                    //
+                    // Idempotent: if the banner is already shown for this
+                    // feature (class `.cal-side-auth-error` present), don't
+                    // re-write the DOM — stops the "flashing on and off
+                    // continually" effect when the service re-emits on every
+                    // 5-min poll or sidebar-nav click.
                     const host = event.feature === "tasks"
                         ? document.getElementById("cal-side-tasks")
                         : document.getElementById("cal-side-body");
-                    if (host) {
-                        host.innerHTML = `<div class="cal-side-empty cal-side-auth-error">${escapeHtml(event.message || "Google access needs re-consent.")}</div>`;
+                    if (host && !host.querySelector(".cal-side-auth-error")) {
+                        const msg = event.message || "Google access needs re-consent.";
+                        host.innerHTML = `<div class="cal-side-empty cal-side-auth-error">
+                            <div style="margin-bottom:0.6em">${escapeHtml(msg)}</div>
+                            <button type="button" class="cal-side-reauth-btn" style="padding:0.3em 0.8em;border-radius:4px;border:1px solid currentColor;background:transparent;color:inherit;cursor:pointer;font-size:0.9em">Re-authenticate Now</button>
+                        </div>`;
+                        const btn = host.querySelector(".cal-side-reauth-btn");
+                        btn?.addEventListener("click", async () => {
+                            btn.disabled = true;
+                            btn.textContent = "Opening browser…";
+                            try {
+                                await reauthGoogleScopes();
+                                btn.textContent = "Consent opened — complete it in the browser";
+                            }
+                            catch (err) {
+                                btn.disabled = false;
+                                btn.textContent = `Failed: ${err?.message || err}. Click to retry.`;
+                            }
+                        });
                     }
                 }
             });

package/client/components/folder-tree.js

@@ -467,6 +467,9 @@ async function loadFolderTree(container) {
                             Email address
                             <input id="setup-email" type="email" placeholder="you@gmail.com" required style="display:block;width:100%;padding:0.5rem;margin-top:0.25rem;background:var(--color-bg-surface);color:var(--color-text);border:1px solid var(--color-border);border-radius:4px">
                         </label>
+                        <div id="setup-provider-preview" style="display:none;margin-bottom:0.5rem;padding:0.4rem 0.6rem;background:var(--color-bg-surface);border:1px solid var(--color-border);border-radius:4px;font-size:0.9rem">
+                            <span id="setup-provider-icon" style="display:inline-block;width:1.2em;text-align:center;margin-right:0.4em"></span><span id="setup-provider-label"></span>
+                        </div>
                         <label id="setup-name-row" style="display:none;margin-bottom:0.5rem">
                             Your name <span style="color:var(--color-text-muted);font-size:0.85rem">(optional — auto-detected from Google)</span>
                             <input id="setup-name" type="text" placeholder="Your Name (leave blank to use Google profile)" style="display:block;width:100%;padding:0.5rem;margin-top:0.25rem;background:var(--color-bg-surface);color:var(--color-text);border:1px solid var(--color-border);border-radius:4px">
@@ -496,6 +499,23 @@ async function loadFolderTree(container) {
                     "aol.com": "Use an app password: AOL Settings → Account Security → Generate app password",
                     "icloud.com": "Use an app-specific password: appleid.apple.com → Sign-In and Security → App-Specific Passwords",
                 };
+                // Q67: describe the detected provider so the user knows which
+                // auto-config path we're about to take BEFORE they hit Next.
+                // Gmail / Google Workspace domains auto-detect via MX in the
+                // service; here we can only name the known ones up front and
+                // say "will auto-detect" for everything else.
+                const PROVIDER_PREVIEW = {
+                    "gmail.com": { icon: "✉", label: "Gmail — OAuth (no password needed)" },
+                    "googlemail.com": { icon: "✉", label: "Gmail — OAuth (no password needed)" },
+                    "outlook.com": { icon: "✉", label: "Outlook.com — OAuth (no password needed)" },
+                    "hotmail.com": { icon: "✉", label: "Outlook.com — OAuth (no password needed)" },
+                    "live.com": { icon: "✉", label: "Outlook.com — OAuth (no password needed)" },
+                    "yahoo.com": { icon: "✉", label: "Yahoo Mail — IMAP (needs app password)" },
+                    "aol.com": { icon: "✉", label: "AOL Mail — IMAP (needs app password)" },
+                    "icloud.com": { icon: "✉", label: "iCloud Mail — IMAP (needs app-specific password)" },
+                    "me.com": { icon: "✉", label: "iCloud Mail — IMAP (needs app-specific password)" },
+                    "mac.com": { icon: "✉", label: "iCloud Mail — IMAP (needs app-specific password)" },
+                };
                 let oauthAutoFired = false;
                 emailInput?.addEventListener("input", () => {
                     const email = emailInput.value.trim();
@@ -503,6 +523,21 @@ async function loadFolderTree(container) {
                     const hasAt = email.includes("@") && domain.length > 0;
                     const isOAuth = ["gmail.com", "googlemail.com", "outlook.com", "hotmail.com", "live.com"].includes(domain);
                     const isGmailLike = ["gmail.com", "googlemail.com"].includes(domain);
+                    // Provider preview row
+                    const preview = document.getElementById("setup-provider-preview");
+                    const icon = document.getElementById("setup-provider-icon");
+                    const label = document.getElementById("setup-provider-label");
+                    if (preview && icon && label) {
+                        if (hasAt) {
+                            const hit = PROVIDER_PREVIEW[domain];
+                            icon.textContent = hit ? hit.icon : "❓";
+                            label.textContent = hit ? hit.label : `${domain} — will auto-detect via MX records`;
+                            preview.style.display = "block";
+                        }
+                        else {
+                            preview.style.display = "none";
+                        }
+                    }
                     // OAuth providers: auto-fire setup immediately once domain
                     // is recognized — don't show name/password (name is auto-
                     // detected from Google profile, no password needed). This

package/client/lib/api-client.js

@@ -128,6 +128,9 @@ export function syncAccount(accountId) {
 export function reauthenticate(accountId) {
     return ipc().reauthenticate(accountId);
 }
+export function reauthGoogleScopes() {
+    return ipc().reauthGoogleScopes();
+}
 export function getSyncPending() {
     return ipc().getSyncPending();
 }

package/client/lib/mailxapi.js

@@ -180,6 +180,7 @@
         listQueuedOutgoing: function() { return callNode("listQueuedOutgoing"); },
         cancelQueuedOutgoing: function(p) { return callNode("cancelQueuedOutgoing", { path: p }); },
         reauthenticate: function(accountId) { return callNode("reauthenticate", { accountId: accountId }); },
+        reauthGoogleScopes: function() { return callNode("reauthGoogleScopes"); },
 
         // Bulk operations
         deleteMessages: function(accountId, uids) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx",
-  "version": "1.0.389",
+  "version": "1.0.391",
   "description": "Local-first email client with IMAP sync and standalone native app",
   "type": "module",
   "main": "bin/mailx.js",

package/packages/mailx-imap/index.js

@@ -3067,18 +3067,50 @@ export class ImapManager extends EventEmitter {
             }
             return;
         }
-        // IMAP accounts: append to IMAP Outbox for multi-machine interlock
+        // IMAP accounts: append to IMAP Outbox for multi-machine interlock.
+        //
+        // Atomic claim (same pattern as the Gmail path above): rename the file
+        // to <file>.sending-<host>-<pid> BEFORE reading it, so two concurrent
+        // mailx instances scanning the same dir can't both APPEND the same
+        // message to IMAP Outbox and end up with a duplicate. Filesystem rename
+        // is atomic; the loser sees ENOENT and skips. On APPEND success, move
+        // the claimed file to sending/sent/; on APPEND failure, release the
+        // claim so the recovery sweeper picks it up next tick.
         try {
             const outboxPath = await this.ensureOutbox(accountId);
             const client = await this.createClientWithLimit(accountId);
             try {
                 for (const { dir, file } of filesToSend) {
                     const filePath = path.join(dir, file);
-                    const raw = fs.readFileSync(filePath, "utf-8");
-                    await client.appendMessage(outboxPath, raw, ["\\Seen"]);
-                    // Move to sent/
-                    fs.renameSync(filePath, path.join(sentDir, file));
-                    console.log(`  [outbox] Moved ${file} to IMAP Outbox → sent/`);
+                    const claimSuffix = `.sending-${this.hostname}-${process.pid}`;
+                    const claimedPath = filePath + claimSuffix;
+                    try {
+                        fs.renameSync(filePath, claimedPath);
+                    }
+                    catch (e) {
+                        if (e.code === "ENOENT")
+                            continue; // sibling claimed first
+                        throw e;
+                    }
+                    try {
+                        const raw = fs.readFileSync(claimedPath, "utf-8");
+                        await client.appendMessage(outboxPath, raw, ["\\Seen"]);
+                        fs.renameSync(claimedPath, path.join(sentDir, file));
+                        console.log(`  [outbox] Moved ${file} to IMAP Outbox → sent/`);
+                    }
+                    catch (e) {
+                        // APPEND failed (connection dropped mid-send, server
+                        // busy, etc.) — release the claim so next tick can
+                        // retry. Don't swallow: rethrow after release so the
+                        // outer catch ("IMAP still unreachable") bails out of
+                        // the remaining files too — whatever broke will break
+                        // the next file the same way.
+                        try {
+                            fs.renameSync(claimedPath, filePath);
+                        }
+                        catch { /* recovery sweeper will handle */ }
+                        throw e;
+                    }
                 }
             }
             finally {

package/packages/mailx-service/index.d.ts

@@ -47,6 +47,20 @@ export declare class MailxService {
      *  Called without `feature` it returns the catch-all primary — same
      *  semantics as the original single-flag version for back-compat. */
     getPrimaryAccount(feature?: string): any;
+    /** Feature names that have already emitted authScopeError this session.
+     *  Stops the "banner flashing on and off continually" loop where every
+     *  5-min poll / sidebar nav re-fired the event and the client re-rendered
+     *  the red banner. Cleared when the user hits Re-authenticate. */
+    private scopeErrorEmitted;
+    /** Delete the cached Google OAuth token (the one used for Calendar / Tasks
+     *  / Contacts scopes — NOT the IMAP token which `reauthenticate()` handles)
+     *  and clear the sticky auth-error state so a subsequent refresh can
+     *  re-trigger browser consent with the current scope set. Equivalent of
+     *  `mailx -reauth` but callable from the UI. Returns `{ cleared: N }` so
+     *  the caller can tell the user what happened. */
+    reauthGoogleScopes(): {
+        cleared: number;
+    };
     private primaryTokenProvider;
     /** Return cal events visible in [fromMs..toMs), refreshing from Google
      *  in the background. Caller displays local results immediately; after

package/packages/mailx-service/index.js

@@ -447,6 +447,46 @@ export class MailxService {
         return all.find((a) => a.primary) || all[0] || null;
     }
     // ── Calendar / Tasks / Contacts: two-way cache (2026-04-23) ──
+    /** Feature names that have already emitted authScopeError this session.
+     *  Stops the "banner flashing on and off continually" loop where every
+     *  5-min poll / sidebar nav re-fired the event and the client re-rendered
+     *  the red banner. Cleared when the user hits Re-authenticate. */
+    scopeErrorEmitted = new Set();
+    /** Delete the cached Google OAuth token (the one used for Calendar / Tasks
+     *  / Contacts scopes — NOT the IMAP token which `reauthenticate()` handles)
+     *  and clear the sticky auth-error state so a subsequent refresh can
+     *  re-trigger browser consent with the current scope set. Equivalent of
+     *  `mailx -reauth` but callable from the UI. Returns `{ cleared: N }` so
+     *  the caller can tell the user what happened. */
+    reauthGoogleScopes() {
+        const tokensDir = path.join(getConfigDir(), "tokens");
+        let cleared = 0;
+        if (fs.existsSync(tokensDir)) {
+            for (const entry of fs.readdirSync(tokensDir)) {
+                const userDir = path.join(tokensDir, entry);
+                try {
+                    if (!fs.statSync(userDir).isDirectory())
+                        continue;
+                    const tokenFile = path.join(userDir, "oauth-token.json");
+                    if (fs.existsSync(tokenFile)) {
+                        fs.unlinkSync(tokenFile);
+                        console.log(`  [reauth-google] cleared ${tokenFile}`);
+                        cleared++;
+                    }
+                }
+                catch { /* skip */ }
+            }
+        }
+        // Reset the sticky set so the next failure (if re-consent didn't take)
+        // can fire a fresh banner. Also trigger a kickoff refresh so the
+        // browser consent pops open now instead of on next sidebar nav.
+        this.scopeErrorEmitted.clear();
+        const now = Date.now();
+        const horizonMs = 90 * 86400_000;
+        this.getCalendarEvents(now, now + horizonMs); // fire-and-forget — triggers consent via primaryTokenProvider
+        this.getTasks(false); // same path, `tasks` scope
+        return { cleared };
+    }
     async primaryTokenProvider(feature) {
         const acct = this.getPrimaryAccount(feature);
         if (!acct)
@@ -476,10 +516,13 @@ export class MailxService {
             const msg = String(e?.message || e);
             console.error(`[calendar] refresh failed: ${msg}`);
             if (/insufficient (authentication )?scope|PERMISSION_DENIED|403/i.test(msg)) {
-                this.imapManager.emit("authScopeError", {
-                    feature: "calendar",
-                    message: "Google Calendar access needs re-consent. Run `mailx -reauth` then restart.",
-                });
+                if (!this.scopeErrorEmitted.has("calendar")) {
+                    this.scopeErrorEmitted.add("calendar");
+                    this.imapManager.emit("authScopeError", {
+                        feature: "calendar",
+                        message: "Google Calendar access needs re-consent.",
+                    });
+                }
             }
         });
         return this.db.getCalendarEvents(acct.id, fromMs, toMs);
@@ -577,12 +620,14 @@ export class MailxService {
             const msg = String(e?.message || e);
             console.error(`[tasks] refresh failed: ${msg}`);
             if (/insufficient (authentication )?scope|PERMISSION_DENIED|403/i.test(msg)) {
-                console.error(`[tasks] Your cached OAuth token doesn't include the 'tasks' scope.`);
-                console.error(`[tasks] Run 'mailx -reauth' then 'mailx' to re-consent and pick up the new scope.`);
-                this.imapManager.emit("authScopeError", {
-                    feature: "tasks",
-                    message: "Google Tasks access needs re-consent. Run `mailx -reauth` then restart.",
-                });
+                if (!this.scopeErrorEmitted.has("tasks")) {
+                    this.scopeErrorEmitted.add("tasks");
+                    console.error(`[tasks] Your cached OAuth token doesn't include the 'tasks' scope.`);
+                    this.imapManager.emit("authScopeError", {
+                        feature: "tasks",
+                        message: "Google Tasks access needs re-consent.",
+                    });
+                }
             }
         });
         return this.db.getTasks(acct.id, includeCompleted);

package/packages/mailx-service/jsonrpc.js

@@ -133,6 +133,8 @@ async function dispatchAction(svc, action, p) {
             return svc.cancelQueuedOutgoing(p.path);
         case "reauthenticate":
             return { ok: await svc.reauthenticate(p.accountId) };
+        case "reauthGoogleScopes":
+            return svc.reauthGoogleScopes();
         // Search & contacts
         case "searchMessages":
             return svc.search(p.query, p.page, p.pageSize, p.scope, p.accountId, p.folderId);