@bobfrankston/rmfmail 1.0.570 → 1.0.589

package/TODO.md

@@ -14,12 +14,15 @@ These items don't need user input — source-only changes, compile-verified befo
 |---|---|---|---|
 | **1** | **C118 — STATUS-before-SELECT in syncFolder** | S | Issue `STATUS folder (UIDNEXT)` before SELECT. If `UIDNEXT - 1 <= local highestUid` skip SELECT and FETCH entirely — folder is up to date. Cuts SELECT calls by ~99% on idle folders. Avoids the bobma/Sent SELECT-wedge case Bob hit (server is fine, but SELECT on idle huge folder + dead-socket-not-detected = 300s timeout). `mailx-imap/index.ts:909`. |
 | **2** | **C119 — Lazy folder sync** | M | Don't sync all 96 bobma folders on every periodic pass. Only sync (a) folders the user has expanded in the tree, (b) special-use folders (INBOX/Sent/Drafts/Trash), (c) folders touched by recent local actions. Other folders sync on-demand when user clicks them. Closes most of the Thunderbird-vs-mailx speed gap. Touches `mailx-imap/index.ts` syncAll loop. |
-| **3** | **C120 — Read TCP transport diagnostics in syncFolder error path** | S | `node-tcp-transport@1.0.21` exposes `transport.diagnostics` (connId, bytesRead/Written, sinceLastRead). iflow-direct@0.1.31 includes them in the timeout error message. Surface in mailx-imap's caught-error log so `[sync] folder error` lines have full forensic context (was it dead silently? did it write? how long since last byte?). Already half-wired — extend the catch in `syncFolder` to log the full string. |
+| **3** | **C121 — Counting timer for server connect** | S | Visible elapsed-time counter while the connection is being established, so Bob can tell "DNS slow", "TCP handshake stuck", "TLS hung", "IMAP greeting missing", or "LOGIN slow" apart at a glance. Phases: `dns → tcp connect → tls handshake → imap greeting → LOGIN ack`. Each phase emits a start event with `phase` + `accountId`; client renders `Connecting to <host> (<phase>, 3.2s)` in the status bar with a 100 ms ticking elapsed counter. On success or failure, drop the indicator and log per-phase durations. Touches `node-tcp-transport.connect()` + `iflow-direct.imap-native.ts:connect`/`login` + a new `imapManager.emit("connectProgress", ...)` chain. Pairs naturally with C120 — same `connId` ID space so the timer indicator can name the connection that later times out. |
+| **4** | **C122 — Recent-unread count overlay on taskbar icon** | S | Show recent-unread count as a numeric overlay on the running mailx taskbar icon (Win11 style: small badge in the lower-right corner of the icon). `setOverlayIcon` is already wired (used as a placeholder); needs (a) a number-rendered overlay bitmap (1 / 2 / … / 9+ glyphs at 16×16 or via `DrawText` to a memory DC) and (b) hook into the unread-counter event chain so the badge updates when `folderCountsChanged` or `idle` events arrive. Distinct from S65 — that one is "badge persists when mailx isn't running" and is blocked on tray-process / Win11 Notification Center integration; this one is the *while-running* number. |
+| **6** | **C125 — Unify desktop + Android IMAP code paths** | M | Today's split (`mailx-imap` Node-only + `mailx-store-web` browser-only) duplicates orchestration that's protocol-identical. Differences boil down to (a) transport factory choice (b) whether clients are persistent — both parameters, not architectural divides. Plan: extract `mailx-imap-core` with ImapManager + ops queue + fast-lane + sync orchestration over a `Transport` and a `Storage` interface, no Node-specific imports. `mailx-imap` and `mailx-store-web` become thin shims that wire engine-specific Storage + Transport. `{persistent: true\|false}` flag on ImapManager covers the lifetime split (no fast-lane queue when ephemeral). Pre-req for Android non-Gmail IMAP without forking sync code. |
+| **5** | **C124 — mailto handler on Linux + macOS** | S | Counterpart to P115 (Win). Linux: write a `~/.local/share/applications/rmfmail.desktop` with `MimeType=x-scheme-handler/mailto;` + `Exec=node /path/to/mailx.js --mailto %u`, `xdg-mime default rmfmail.desktop x-scheme-handler/mailto`, `update-desktop-database`. No exe-launcher needed — Linux pickers read `Name=` from the `.desktop` directly. macOS: real `.app` bundle (LaunchServices won't register a bare script) with `Info.plist` `CFBundleURLTypes` declaring `mailto` + a tiny launcher binary; `LSSetDefaultHandlerForURLScheme` programmatically sets the default. Rust `rmfmailto-src/` crate already portable — drop the Win32 imports and `cargo build --target x86_64-apple-darwin` produces the macOS launcher. |
+~~done — C120 read transport diagnostics~~ shipped v1.0.583 (per-folder timeout error now includes `[conn#X r=YB w=ZB writes=N sinceLastRead=Tms]` snapshot for the doomed socket).
 | 11 | **[P116](#ext116) — Signature edit in Settings menu** | M | Deferred v1.0.401 — turns out to be M (multi-account modal + save path + JSONC round-trip), not S. Real work when Settings UI gets its proper pass. |
 | 13 | **S56 full AbortController plumbing** | L | Thread `AbortSignal` through `getMessage → fetchMessageBody → provider.fetchOne`. Touches IMAP + Gmail + Outlook providers. |
-| **18** | **[P115](#ext115) — register mailx as Windows default `mailto:` handler** | M | User-priority. Click any `mailto:` link in browser/Word/Outlook → opens mailx compose. Registry-only (no MSIX). Owed: (a) HKCU\\SOFTWARE\\Classes registry write at install/setup, (b) `--mailto <url>` CLI in `bin/mailx.ts` that parses the URL and forwards to the running daemon's compose IPC, (c) `bin/mailx.ts -register-mailto` / `-unregister-mailto` admin commands, (d) "Default mail" toggle in Settings UI that calls the same. Split out of [C46](#ext46) — only the mailto half; Share-target + MSIX stay blocked. |
 
-*Items 1–10, 12, 14–17 shipped — see [Done section](#done-recent).*
+*Items 1–10, 12, 14–18 shipped — see [Done section](#done-recent). P115 mailto handler shipped v1.0.583 (CLI + registry + IPC + client wiring). The Settings-UI "Default mail" toggle (item d in the original brief) is still owed; lands with the wider Settings UI rework alongside [P116](#ext116).*
 
 ### Deferred (not autonomous — blocked on user input or external system)
 
@@ -782,6 +785,18 @@ Was part of S1 "local-first reconciliation refactor" until 2026-04-23 when S1's
 
 | Item | Version |
 |---|---|
+| **C123 — Dynamic fast-lane connection (per-account)** — second persistent IMAP client per account (`fastClients` map) lazy-allocated alongside the existing slow-lane `opsClients`. `withConnection` fast tasks queue and drain on the fast client; slow tasks continue on the original ops client. Both lanes drain CONCURRENTLY now (`runningFast` / `runningSlow` independent flags) — click-time body fetch and flag toggle never wait behind a multi-minute prefetch / backfill again. Costs +1 IMAP socket per active account (Bob's bobma: 3 sockets per account = ops + fast + IDLE, well under Dovecot's 20-conn cap). Stale-detect, error-discard, shutdown, disconnectOps all updated to handle both lanes. Ops verbose-IMAP wire trace propagated to the fast lane so click-time wedges show in the log. Replaces the chunking-as-yield-point hack from v1.0.586 (which is still useful but no longer load-bearing). | v1.0.587 |
+| **Pull-to-refresh on Android (and any touch context)** — Thunderbird-style drag-down at the top of the message list fires a sync, same path as F5 / btn-sync. Indicator slides in with the pull, chevron rotates at 80px to signal "Release to refresh", spinner replaces it during the actual sync. Touch-only — desktop keeps F5 / sync button. Lives in `client/app.ts` so it ships to Android MAUI through the shared WebView build automatically. | v1.0.587 |
+| **Click-time body fetch unblocked by long-running sync/prefetch** — `mailx-imap.syncFolder` set-diff backfill loop and `prefetchBodies` IMAP path both held the persistent ops client for entire-folder durations. A 33-UID prefetch that grew to 222 mid-flight held it for 100 minutes (Bob log 2026-05-08 08:30→10:11). During the hold, every interactive click went into iflow's commandChain BEHIND the slow ops, so the user's preview pane stayed blank. Fix: chunk both paths — prefetch through `withConnection({slow:true})` per 25-UID slice, syncFolder backfill ditto per 100 UIDs (was 500). Each chunk releases the queue between fetches so fast-lane body clicks interleave roughly every 1-30s instead of waiting for the whole folder. The chunk sizes balance throughput (one FETCH per chunk, iflow's `fetchChunkSize:10` makes that 1-3 sub-FETCHes) against latency (worst-case click wait). | v1.0.586 |
+| **Body fetch silent-null no longer hangs the viewer** — `Reconciler.pumpBodyFetches` only emitted `bodyAvailable` when `fetchMessageBody` returned a buffer; on null (Gmail format=raw cap, UID hash collision, IMAP source-extraction empty) it neither emitted `bodyAvailable` NOR `bodyFetchError`, so the viewer's placeholder + listener-armed loop stayed waiting forever. Now: null result emits `bodyFetchError` with `transient:false` and a concrete reason, so the existing `mv-body-fetch-error` banner shows instead of a permanent blank. | v1.0.586 |
+| **Prefetch data-loss fix — guard against "0 of N returned"** — `mailx-imap.prefetchBodies` was pruning the entire requested batch when `fetchBodiesBatch` returned successfully but with no bodies (FETCH parser miss, wrong-folder, transient that didn't throw). User-reported on 2026-05-08: `[prefetch] bobma: 0 bodies cached, 66 stale rows pruned (done)` — 66 messages silently deleted from local DB. Earlier fix only covered "thrown batch ⇒ don't prune" (the 296-message loss); this one closes the parallel "successful but empty batch" hole on both IMAP and Gmail-API paths. Now: prune only when at least one body returned. Zero-return logs `batch returned 0/N bodies — NOT pruning (set-diff reconcile owns deletion)` and defers to syncFolder's grace-window reconcile. Per Bob's 2026-05-07 set-diff insight: deletion is exclusively the set-diff path's responsibility. | v1.0.585 |
+| **mailx → rmfmail (CLI strings + log filename + post-register hint)** — daily log file is now `rmfmail-YYYY-MM-DD.log`; the 30-day retention scanner also matches the legacy `mailx-` prefix so old files age out cleanly. `mailx-store/db.ts` schema-mismatch error: "Run 'rmfmail -rebuild'". `mailx-server/index.ts` startup banner: "rmfmail server starting…" / "rmfmail server running on …". `--register-mailto` post-output rewritten to point at the right Win11 Settings path, name the Store-app warning, and explain the hash-protected `UrlAssociations\mailto\UserChoice` so the user understands why a registry write alone can't flip the active default. `openLocalPath("log")` opens `rmfmail-…` first, falls back to legacy filename if the daemon hasn't restarted since the upgrade. | v1.0.584 |
+| **Trailing-comma email validation** — `mailx-service.send()` `validateAndPrune` (was `validateList`) silently drops empty / whitespace-only address fragments instead of throwing "empty address". Pruned list replaces `msg.to/cc/bcc` so the artifact also doesn't reach SMTP envelope assembly. Bare-name fragments (no `@`) still throw — that's a different bug. | v1.0.584 |
+| **C120 — TCP transport diagnostics in per-folder timeout** — `mailx-imap`'s `syncOne` per-folder Promise.race timeout used to throw a bare `per-folder timeout (360s): <path>` error with no transport context. Now reads `client.transport.diagnostics` at the timeout moment and appends `[conn#N r=YB w=ZB writes=W sinceLastRead=Tms]` — same format iflow-direct uses for its own command-level timeouts. Lets the `[sync] folder error` log distinguish "server stopped sending data" (sinceLastRead climbing) from "we never finished writing" (writes climbing, no reads) without crossing into iflow's own log timeline. | v1.0.583 |
+| **P115 — Default mailto: handler (Windows registry)** — `mailx --mailto <url>` parses RFC 6068 fields and atomic-renames `~/.rmfmail/pending-mailto.json`; the running daemon's `fs.watch` on the dir picks the file up and emits an `openMailto` event, the client opens compose pre-populated. New `bin/mailto.ts` helper isolates URL parsing + write/consume. `mailx --register-mailto` / `--unregister-mailto` write/remove the `HKCU\Software\Classes\rmfmail` + `HKCU\Software\Clients\Mail\rmfmail` registry keys via `reg.exe`, so rmfmail shows up in Settings → Default apps → Email. Startup race avoided via service-side `consumePendingMailto` IPC: client polls on app init for a file that existed before the daemon's watcher armed (case: `--mailto` with no daemon running spawns one). Watch + poll both atomic-read+delete; whichever fires first wins, the other gets null. | v1.0.583 |
+| **Spring-loaded folders polish (Q117)** — drag-hover-expand was already partially in but persisted to localStorage on every transient expand; reworked to keep the expand transient (auto-collapse on `dragend`) and named the `DRAG_HOVER_EXPAND_MS = 600` constant so it isn't a magic number. Tracked auto-expanded folders in `dragAutoExpanded` set; global dragstart/dragend listeners scoped to mailx-message MIME types so the watcher doesn't fire on unrelated drags (image drag, text selection, etc.). | v1.0.583 |
+| **Calendar alarm popup actually fires** — `client/components/alarms.ts` `collectDueAlarms` was reading `ev.start` (undefined) instead of `ev.startMs` from the DB row; `alarm = -10 min epoch` was always less than `now - 1 hr` so the LOOKBACK filter rejected every event silently. After the fix, calendar reminders 10 min before start fire as designed; the OS popup + in-WebView fallback paths inherited from earlier implementation. Tasks were already correct (`t.dueMs`). | v1.0.583 |
+| **Mailx-server: NodeTransport → NodeTcpTransport** — `packages/mailx-server/index.ts` was importing the now-removed `@bobfrankston/iflow-node` package. Switched to the canonical `@bobfrankston/node-tcp-transport` import (same path the IPC daemon uses in `bin/mailx.ts`) so the legacy `--server` Express mode at least compiles. Runtime still needs the C34 wiring before it's usable end-to-end, but the package now builds clean. | v1.0.583 |
 | **Migrated from active tables — autonomous queue** — items 1–10, 12, 14–17 from the autonomous-work queue: C24 batch body prefetch (IMAP half via iflow-direct `fetchBodiesBatch`), Android keyboard input lag (rAF yield), Send leaves second compose open (parent postMessage close), prefetch priority (2-way + INBOX-first), custom From history (localStorage), multi-email contacts, duplicate Message-ID indicator (⇆ badge), per-field context menus (search-selected + search-from-sender), attachment drag-out (Chromium DownloadURL), elevated-run warning (`isElevated` + `--allow-elevated`), Send-pending virtual folder (pink-accented top-of-tree row), Copy-as-quoted in viewer menu, `MAILX_SERVER_TOKEN` for non-loopback `--server`, Gmail HTTP `/batch` for body prefetch (100 sub-requests), Android open native Contacts/Calendar via `mailxapi-intent://`. | v1.0.400–407 |
 | **Migrated from active tables — priority** — S52 per-feature primary flag (`primaryCalendar` / `primaryTasks` / `primaryContacts`); S64 pinned-taskbar icon + relaunch (msger PKEY_AppUserModel_RelaunchCommand/Icon/DisplayName via VT_LPWSTR PROPVARIANT + per-window AUMID); S54 narrow half (compose full-screen via `isSmall`); compose full-screen on narrow; word-paste sanitizer (tracked separately in Near-term). | 2026-04-26 / v1.0.376 |
 | **Migrated from active tables — categorized** — C27 unified outbox PARKED 2026-04-23 (stays on filesystem queue with atomic-rename claim); C47 Android send wired + persistent queue (`sync_actions` rows with raw RFC 2822, drained on startup + 2-min poll); C48 multi-instance audit (atomic-rename `.ltr` claim, `instance.json` PID lock, stale-claim sweeper); S4 dally retired 2026-04-23 (Ctrl+Z + compose Save/Discard/Cancel cover loss-recovery). | v1.0.376 |

package/bin/build-rmfmailto-exe.js

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+/**
+ * Build the rmfmailto.exe Win11 mailto-handler launcher.
+ *
+ * Hooked into `npm run build` after tsc + the icon build. Skips work when:
+ *   - We're not on Windows (the binary is Win-only; non-Win builds skip).
+ *   - The pre-built `bin/rmfmailto.exe` is newer than every source file in
+ *     `bin/rmfmailto-src/` (mtime gate — cargo's own incremental cache is
+ *     a separate optimization that runs anyway).
+ *
+ * On a real rebuild, runs `cargo build --release` inside `bin/rmfmailto-src/`
+ * and copies `target/release/rmfmailto.exe` to `bin/rmfmailto.exe`. The
+ * pre-built binary is checked into git so `npm install -g
+ * @bobfrankston/rmfmail` ships it without needing Rust on the install
+ * machine — Rust is only required on the BUILD machine.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import { execSync, spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const SRC_DIR = path.join(__dirname, "rmfmailto-src");
+const BUILT_EXE = path.join(SRC_DIR, "target", "release", "rmfmailto.exe");
+const SHIPPED_EXE = path.join(__dirname, "rmfmailto.exe");
+
+if (process.platform !== "win32") {
+    console.log("[rmfmailto] non-Windows host — skipping (binary is Win-only)");
+    process.exit(0);
+}
+
+// Check cargo availability up-front so a missing toolchain produces a
+// clearer message than the spawn error.
+try {
+    execSync("cargo --version", { stdio: "pipe" });
+} catch {
+    console.log("[rmfmailto] cargo not found — skipping build (using checked-in bin/rmfmailto.exe).");
+    console.log("           Install rustup-init.exe to enable rebuilds when the Rust source changes.");
+    process.exit(0);
+}
+
+// mtime gate: if the shipped exe is newer than the latest mtime in the src
+// tree, skip. Avoids re-invoking cargo on every build when nothing's changed.
+function newestMtime(dir) {
+    let newest = 0;
+    const stack = [dir];
+    while (stack.length) {
+        const d = stack.pop();
+        for (const name of fs.readdirSync(d)) {
+            // Skip cargo's own output dir — `target/` mtimes are noise.
+            if (name === "target") continue;
+            const full = path.join(d, name);
+            const st = fs.statSync(full);
+            if (st.isDirectory()) stack.push(full);
+            else if (st.mtimeMs > newest) newest = st.mtimeMs;
+        }
+    }
+    return newest;
+}
+
+const srcMtime = newestMtime(SRC_DIR);
+let shippedMtime = 0;
+try { shippedMtime = fs.statSync(SHIPPED_EXE).mtimeMs; } catch { /* missing */ }
+if (shippedMtime > srcMtime) {
+    console.log("[rmfmailto] up-to-date — skipping cargo build");
+    process.exit(0);
+}
+
+console.log("[rmfmailto] building (cargo --release)...");
+const t0 = Date.now();
+const r = spawnSync("cargo", ["build", "--release"], {
+    cwd: SRC_DIR,
+    stdio: "inherit",
+    shell: true,
+});
+if (r.status !== 0) {
+    console.error(`[rmfmailto] cargo build failed (exit ${r.status})`);
+    process.exit(r.status || 1);
+}
+fs.copyFileSync(BUILT_EXE, SHIPPED_EXE);
+const sec = ((Date.now() - t0) / 1000).toFixed(1);
+console.log(`[rmfmailto] built and copied to bin/rmfmailto.exe (${sec}s)`);

package/bin/mailto.js

@@ -0,0 +1,130 @@
+/**
+ * mailto: URL handling per RFC 6068.
+ *
+ * Click flow when mailx is registered as the OS-level mailto handler:
+ *
+ *   1. User clicks mailto link in browser/Word/Outlook.
+ *   2. Windows runs the registered command — `node mailx.js --mailto "%1"`.
+ *   3. CLI calls writePendingMailto() with the parsed fields.
+ *   4. If a daemon is running, it picks up the file via fs.watch and emits
+ *      `openMailto` to the WebView; the client populates compose.
+ *   5. If no daemon is running, the CLI spawns one; the daemon scans the
+ *      pending file at startup before reaching the event loop.
+ *
+ * The file-drop indirection avoids having to hold an IPC socket open in
+ * the daemon — file-watch is enough for the click rate (one click = one
+ * file write) and works the same way the outbox queue does.
+ */
+import fs from "node:fs";
+import path from "node:path";
+/** Parse a mailto: URL per RFC 6068. Returns the parsed fields with empty
+ *  defaults for anything missing. Throws if the input doesn't start with
+ *  `mailto:` so the CLI can surface a clear error. */
+export function parseMailto(url) {
+    const trimmed = (url || "").trim();
+    if (!/^mailto:/i.test(trimmed)) {
+        throw new Error(`Not a mailto: URL — got ${trimmed.substring(0, 40)}`);
+    }
+    // Split path and query. RFC 6068 allows commas in the path (multiple
+    // recipients) and the standard URL encoding for both halves.
+    const noScheme = trimmed.replace(/^mailto:/i, "");
+    const qIdx = noScheme.indexOf("?");
+    const pathPart = qIdx === -1 ? noScheme : noScheme.substring(0, qIdx);
+    const queryPart = qIdx === -1 ? "" : noScheme.substring(qIdx + 1);
+    const decode = (s) => {
+        try {
+            return decodeURIComponent(s.replace(/\+/g, " "));
+        }
+        catch {
+            return s;
+        } // tolerate malformed %XX — better than crashing
+    };
+    const splitAddrs = (s) => s.split(",").map(a => decode(a).trim()).filter(Boolean);
+    const out = {
+        to: pathPart ? splitAddrs(pathPart) : [],
+        cc: [], bcc: [],
+        subject: "", body: "", inReplyTo: "",
+        writtenAt: Date.now(),
+    };
+    if (!queryPart)
+        return out;
+    for (const pair of queryPart.split("&")) {
+        const eq = pair.indexOf("=");
+        if (eq === -1)
+            continue;
+        const key = pair.substring(0, eq).toLowerCase();
+        const val = decode(pair.substring(eq + 1));
+        switch (key) {
+            case "to":
+                out.to.push(...splitAddrs(pair.substring(eq + 1)));
+                break;
+            case "cc":
+                out.cc.push(...splitAddrs(pair.substring(eq + 1)));
+                break;
+            case "bcc":
+                out.bcc.push(...splitAddrs(pair.substring(eq + 1)));
+                break;
+            case "subject":
+                out.subject = val;
+                break;
+            case "body":
+                out.body = val;
+                break;
+            case "in-reply-to":
+                out.inReplyTo = val;
+                break;
+            // RFC 6068 also lists `references` and arbitrary headers; mailx
+            // doesn't propagate those today (compose UI doesn't surface
+            // refs from a fresh-link click).
+        }
+    }
+    return out;
+}
+export function getPendingMailtoFile() {
+    const home = process.env.USERPROFILE || process.env.HOME || ".";
+    return path.join(home, ".rmfmail", "pending-mailto.json");
+}
+/** Write the pending-mailto file atomically. Atomic-rename so the daemon's
+ *  fs.watch never sees a partial write. */
+export function writePendingMailto(data) {
+    const target = getPendingMailtoFile();
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    const tmp = target + ".tmp";
+    fs.writeFileSync(tmp, JSON.stringify(data, null, 2));
+    fs.renameSync(tmp, target);
+}
+/** Read + delete the pending-mailto file. One-shot — caller acts on the
+ *  result, file is gone whether or not the action succeeded. Returns null
+ *  if no file present (or unparseable / older than 5 min). */
+export function consumePendingMailto() {
+    const target = getPendingMailtoFile();
+    let raw;
+    try {
+        raw = fs.readFileSync(target, "utf-8");
+    }
+    catch {
+        return null;
+    }
+    // Always unlink, even on parse failure — a corrupt file shouldn't wedge
+    // the next click.
+    try {
+        fs.unlinkSync(target);
+    }
+    catch { /* */ }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    // Tolerate older client writes that skipped writtenAt; treat as fresh.
+    const age = Date.now() - (parsed.writtenAt || Date.now());
+    if (age > 5 * 60_000) {
+        // Stale file from a crashed CLI invocation that wrote it but never
+        // got the daemon to start. Drop it; user can click again.
+        return null;
+    }
+    return parsed;
+}
+//# sourceMappingURL=mailto.js.map

package/bin/mailto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mailto.js","sourceRoot":"","sources":["mailto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAc7B;;sDAEsD;AACtD,MAAM,UAAU,WAAW,CAAC,GAAW;IACnC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE;QACjC,IAAI,CAAC;YAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAAC,CAAC;QACzD,MAAM,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC,CAAC,gDAAgD;IACxE,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,CAAS,EAAY,EAAE,CACvC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE5D,MAAM,GAAG,GAAe;QACpB,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;QACxC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE;QACf,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE;QACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;IAEF,IAAI,CAAC,SAAS;QAAE,OAAO,GAAG,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3C,QAAQ,GAAG,EAAE,CAAC;YACV,KAAK,IAAI;gBAAW,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,MAAM;YAC9E,KAAK,IAAI;gBAAW,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,MAAM;YAC9E,KAAK,KAAK;gBAAU,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,MAAM;YAC/E,KAAK,SAAS;gBAAM,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;gBAAC,MAAM;YAC7C,KAAK,MAAM;gBAAS,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;gBAAC,MAAM;YAC1C,KAAK,aAAa;gBAAE,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC;gBAAC,MAAM;YAC/C,gEAAgE;YAChE,4DAA4D;YAC5D,iCAAiC;QACrC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC;IAChE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;AAC9D,CAAC;AAED;2CAC2C;AAC3C,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IAC/C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC;IAC5B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;8DAE8D;AAC9D,MAAM,UAAU,oBAAoB;IAChC,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAC/C,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACtB,wEAAwE;IACxE,kBAAkB;IAClB,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;IAAC,CAAC;IAC/C,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACtB,uEAAuE;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1D,IAAI,GAAG,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC;QACnB,mEAAmE;QACnE,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/bin/mailto.ts

@@ -0,0 +1,122 @@
+/**
+ * mailto: URL handling per RFC 6068.
+ *
+ * Click flow when mailx is registered as the OS-level mailto handler:
+ *
+ *   1. User clicks mailto link in browser/Word/Outlook.
+ *   2. Windows runs the registered command — `node mailx.js --mailto "%1"`.
+ *   3. CLI calls writePendingMailto() with the parsed fields.
+ *   4. If a daemon is running, it picks up the file via fs.watch and emits
+ *      `openMailto` to the WebView; the client populates compose.
+ *   5. If no daemon is running, the CLI spawns one; the daemon scans the
+ *      pending file at startup before reaching the event loop.
+ *
+ * The file-drop indirection avoids having to hold an IPC socket open in
+ * the daemon — file-watch is enough for the click rate (one click = one
+ * file write) and works the same way the outbox queue does.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+
+export interface MailtoData {
+    to: string[];
+    cc: string[];
+    bcc: string[];
+    subject: string;
+    body: string;
+    inReplyTo: string;
+    /** Wall-clock when the file was written; lets the daemon ignore stale
+     *  files left behind by a crashed CLI invocation. */
+    writtenAt: number;
+}
+
+/** Parse a mailto: URL per RFC 6068. Returns the parsed fields with empty
+ *  defaults for anything missing. Throws if the input doesn't start with
+ *  `mailto:` so the CLI can surface a clear error. */
+export function parseMailto(url: string): MailtoData {
+    const trimmed = (url || "").trim();
+    if (!/^mailto:/i.test(trimmed)) {
+        throw new Error(`Not a mailto: URL — got ${trimmed.substring(0, 40)}`);
+    }
+    // Split path and query. RFC 6068 allows commas in the path (multiple
+    // recipients) and the standard URL encoding for both halves.
+    const noScheme = trimmed.replace(/^mailto:/i, "");
+    const qIdx = noScheme.indexOf("?");
+    const pathPart = qIdx === -1 ? noScheme : noScheme.substring(0, qIdx);
+    const queryPart = qIdx === -1 ? ""        : noScheme.substring(qIdx + 1);
+
+    const decode = (s: string): string => {
+        try { return decodeURIComponent(s.replace(/\+/g, " ")); }
+        catch { return s; } // tolerate malformed %XX — better than crashing
+    };
+
+    const splitAddrs = (s: string): string[] =>
+        s.split(",").map(a => decode(a).trim()).filter(Boolean);
+
+    const out: MailtoData = {
+        to: pathPart ? splitAddrs(pathPart) : [],
+        cc: [], bcc: [],
+        subject: "", body: "", inReplyTo: "",
+        writtenAt: Date.now(),
+    };
+
+    if (!queryPart) return out;
+    for (const pair of queryPart.split("&")) {
+        const eq = pair.indexOf("=");
+        if (eq === -1) continue;
+        const key = pair.substring(0, eq).toLowerCase();
+        const val = decode(pair.substring(eq + 1));
+        switch (key) {
+            case "to":          out.to.push(...splitAddrs(pair.substring(eq + 1))); break;
+            case "cc":          out.cc.push(...splitAddrs(pair.substring(eq + 1))); break;
+            case "bcc":         out.bcc.push(...splitAddrs(pair.substring(eq + 1))); break;
+            case "subject":     out.subject = val; break;
+            case "body":        out.body = val; break;
+            case "in-reply-to": out.inReplyTo = val; break;
+            // RFC 6068 also lists `references` and arbitrary headers; mailx
+            // doesn't propagate those today (compose UI doesn't surface
+            // refs from a fresh-link click).
+        }
+    }
+    return out;
+}
+
+export function getPendingMailtoFile(): string {
+    const home = process.env.USERPROFILE || process.env.HOME || ".";
+    return path.join(home, ".rmfmail", "pending-mailto.json");
+}
+
+/** Write the pending-mailto file atomically. Atomic-rename so the daemon's
+ *  fs.watch never sees a partial write. */
+export function writePendingMailto(data: MailtoData): void {
+    const target = getPendingMailtoFile();
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    const tmp = target + ".tmp";
+    fs.writeFileSync(tmp, JSON.stringify(data, null, 2));
+    fs.renameSync(tmp, target);
+}
+
+/** Read + delete the pending-mailto file. One-shot — caller acts on the
+ *  result, file is gone whether or not the action succeeded. Returns null
+ *  if no file present (or unparseable / older than 5 min). */
+export function consumePendingMailto(): MailtoData | null {
+    const target = getPendingMailtoFile();
+    let raw: string;
+    try { raw = fs.readFileSync(target, "utf-8"); }
+    catch { return null; }
+    // Always unlink, even on parse failure — a corrupt file shouldn't wedge
+    // the next click.
+    try { fs.unlinkSync(target); } catch { /* */ }
+    let parsed: MailtoData;
+    try { parsed = JSON.parse(raw) as MailtoData; }
+    catch { return null; }
+    // Tolerate older client writes that skipped writtenAt; treat as fresh.
+    const age = Date.now() - (parsed.writtenAt || Date.now());
+    if (age > 5 * 60_000) {
+        // Stale file from a crashed CLI invocation that wrote it but never
+        // got the daemon to start. Drop it; user can click again.
+        return null;
+    }
+    return parsed;
+}

package/bin/mailx.js

@@ -40,6 +40,155 @@ const args = process.argv.slice(2);
 function hasFlag(name) { return args.includes(`-${name}`) || args.includes(`--${name}`); }
 const verbose = hasFlag("verbose");
 const isDaemon = hasFlag("daemon"); // internal: re-spawned detached process
+// ── mailto: handler hooks (P115) ──
+//
+// Three CLI entry points feed the OS-level mailto integration:
+//   --mailto <url>            Decode the URL, drop pending-mailto.json, then
+//                             continue to the existing instance check —
+//                             which exits if a daemon is already running
+//                             (the running daemon picks the file up via
+//                             fs.watch) or falls through to spawn one.
+//   --register-mailto         Write Windows registry keys (HKCU\SOFTWARE\Classes)
+//                             so click-to-mail flows in browsers / Word /
+//                             Outlook resolve to mailx. No-op on non-Windows.
+//   --unregister-mailto       Remove those registry keys.
+//
+// The decode step is done FIRST (before the version-mismatch instance check
+// near line 104) so the file is on disk regardless of which startup branch
+// is about to run.
+{
+    const mailtoIdx = args.findIndex(a => a === "--mailto" || a === "-mailto");
+    if (mailtoIdx !== -1) {
+        const url = args[mailtoIdx + 1];
+        if (!url) {
+            console.error("Usage: rmfmail --mailto <mailto:url>");
+            process.exit(1);
+        }
+        try {
+            const { parseMailto, writePendingMailto } = await import("./mailto.js");
+            writePendingMailto(parseMailto(url));
+            // Strip --mailto and its argument from argv so the rest of the
+            // file (instance check, auto-detach, daemon startup) sees a
+            // clean command line equivalent to a bare `mailx`.
+            args.splice(mailtoIdx, 2);
+            process.argv.splice(mailtoIdx + 2, 2);
+        }
+        catch (e) {
+            console.error(`rmfmail --mailto: ${e.message}`);
+            process.exit(1);
+        }
+    }
+}
+if (hasFlag("register-mailto") || hasFlag("unregister-mailto")) {
+    const unregister = hasFlag("unregister-mailto");
+    if (process.platform !== "win32") {
+        console.error("--register-mailto / --unregister-mailto are Windows-only.");
+        process.exit(1);
+    }
+    const { execSync } = await import("node:child_process");
+    // Registered command points at the rmfmailto.exe launcher (per-app
+    // binary at %LOCALAPPDATA%\rmfmail\bin\rmfmailto.exe). The exe has its
+    // own VERSIONINFO with FileDescription="rmfmail" so the Win11 "Select
+    // an app" picker shows "rmfmail" instead of falling through to the
+    // host EXE's name (which made the picker show "Node.js JavaScript
+    // Runtime" when we registered `node.exe ... mailx.js --mailto "%1"`
+    // directly). rmfmailto.exe just shells out to node + mailx.js with the
+    // same argv. Postinstall copies the binary from `bin/rmfmailto.exe`
+    // (shipped in the npm package) to the per-app location below.
+    const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin");
+    const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe");
+    const __pkgRmfmailtoExe = path.join(import.meta.dirname, "rmfmailto.exe");
+    if (fs.existsSync(__pkgRmfmailtoExe) && (!fs.existsSync(__rmfmailtoExe) ||
+        fs.statSync(__pkgRmfmailtoExe).mtimeMs > fs.statSync(__rmfmailtoExe).mtimeMs)) {
+        try {
+            fs.mkdirSync(__perAppBin, { recursive: true });
+            fs.copyFileSync(__pkgRmfmailtoExe, __rmfmailtoExe);
+            console.log(`Installed rmfmailto.exe to ${__rmfmailtoExe}`);
+        }
+        catch (e) {
+            console.error(`Failed to copy rmfmailto.exe to per-app dir: ${e.message}`);
+            // Fall through and try registering the in-package path so
+            // mailto still works, just from inside node_modules.
+        }
+    }
+    const __launcherExe = fs.existsSync(__rmfmailtoExe) ? __rmfmailtoExe : __pkgRmfmailtoExe;
+    if (!fs.existsSync(__launcherExe)) {
+        console.error(`rmfmailto.exe not found at ${__launcherExe} — package may have been built without it. Re-run 'npm run build' on the build machine.`);
+        process.exit(1);
+    }
+    // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for
+    // cmd.exe's shell layer, which strips one level before the value reaches
+    // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before
+    // the EXE's argv layer.
+    const cmd = `\\"${__launcherExe}\\" \\"%1\\"`;
+    const keys = [
+        // [hive\\path, value-name, value-data]
+        [`HKCU\\Software\\Classes\\rmfmail\\shell\\open\\command`, "", cmd],
+        [`HKCU\\Software\\Classes\\rmfmail\\DefaultIcon`, "", `\\"${path.join(import.meta.dirname, "..", "client", "icon.ico")}\\",0`],
+        [`HKCU\\Software\\Classes\\rmfmail`, "URL Protocol", ""],
+        [`HKCU\\Software\\Classes\\rmfmail`, "", "URL:rmfmail Protocol"],
+        // Make rmfmail visible in Settings → Default apps → Email so the
+        // user can flip it to default with one click.
+        [`HKCU\\Software\\Clients\\Mail\\rmfmail`, "", "rmfmail"],
+        [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationName", "rmfmail"],
+        [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationDescription", "Local-first email client"],
+        [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities\\URLAssociations`, "mailto", "rmfmail"],
+        [`HKCU\\Software\\RegisteredApplications`, "rmfmail", "Software\\Clients\\Mail\\rmfmail\\Capabilities"],
+        // Belt-and-suspenders for the Win11 picker's display-name lookup:
+        // some code paths read `HKCU\Software\Classes\Applications\<exe>`
+        // for the FriendlyAppName even when the registered ProgId already
+        // has Capabilities\ApplicationName set. Setting both makes the
+        // picker show "rmfmail" regardless of which path it follows.
+        [`HKCU\\Software\\Classes\\Applications\\rmfmailto.exe`, "FriendlyAppName", "rmfmail"],
+        [`HKCU\\Software\\Classes\\Applications\\rmfmailto.exe`, "ApplicationName", "rmfmail"],
+        [`HKCU\\Software\\Classes\\Applications\\rmfmailto.exe\\shell\\open\\command`, "", cmd],
+    ];
+    if (unregister) {
+        // Best-effort recursive deletes. /f suppresses the y/n prompt.
+        for (const root of [
+            "HKCU\\Software\\Classes\\rmfmail",
+            "HKCU\\Software\\Clients\\Mail\\rmfmail",
+            "HKCU\\Software\\Classes\\Applications\\rmfmailto.exe",
+        ]) {
+            try {
+                execSync(`reg delete "${root}" /f`, { stdio: "pipe" });
+            }
+            catch { /* not present — fine */ }
+        }
+        try {
+            execSync(`reg delete "HKCU\\Software\\RegisteredApplications" /v rmfmail /f`, { stdio: "pipe" });
+        }
+        catch { /* */ }
+        console.log("rmfmail unregistered as a mailto: handler.");
+        console.log("Note: if rmfmail was the active default in Settings → Default apps → Email,");
+        console.log("Windows may keep the prior selection in UserChoice until you pick another app.");
+        process.exit(0);
+    }
+    for (const [keyPath, name, data] of keys) {
+        const valueArg = name ? `/v "${name}"` : "/ve";
+        const dataArg = data ? `/d "${data}"` : "";
+        const type = data ? "/t REG_SZ" : "/t REG_SZ /d \"\"";
+        const cmdLine = `reg add "${keyPath}" ${valueArg} ${type} ${dataArg} /f`;
+        try {
+            execSync(cmdLine, { stdio: "pipe" });
+        }
+        catch (e) {
+            console.error(`  failed: ${cmdLine}\n    ${e.message}`);
+        }
+    }
+    console.log("rmfmail registered as a mailto: handler.");
+    console.log("");
+    console.log("To make it the default in Windows 11:");
+    console.log("  Settings → Apps → Default apps → search \"rmfmail\" → click rmfmail");
+    console.log("  → \"Set default\" for the mailto link type.");
+    console.log("");
+    console.log("Win11 enforces a hash on `HKCU\\...\\UrlAssociations\\mailto\\UserChoice`,");
+    console.log("so the only programmatic ways to flip the active default are MSIX packaging");
+    console.log("(parked under C46) or a hash-aware tool like SetUserFTA. The picker may");
+    console.log("warn \"app must be from the Store\" — click \"More options\" / \"Choose another");
+    console.log("app on this PC\" to reach rmfmail.");
+    process.exit(0);
+}
 // Read our own version once — used for the instance file + upgrade check below.
 const __selfRoot = path.join(import.meta.dirname, "..");
 const __selfVersion = (() => {
@@ -169,7 +318,7 @@ const rebuildMode = hasFlag("rebuild");
 const repairMode = hasFlag("repair");
 const importMode = hasFlag("import");
 // Validate arguments
-const knownFlags = ["verbose", "kill", "v", "version", "setup", "add", "test", "rebuild", "repair", "log", "import", "email", "mail", "daemon"];
+const knownFlags = ["verbose", "kill", "v", "version", "setup", "add", "test", "rebuild", "repair", "log", "import", "email", "mail", "daemon", "reauth", "mailto", "register-mailto", "unregister-mailto", "allow-elevated"];
 for (const arg of args) {
     const flag = arg.replace(/^--?/, "");
     if (arg.startsWith("-") && !knownFlags.includes(flag)) {
@@ -950,7 +1099,10 @@ async function main() {
         const cutoff = Date.now() - LOG_RETENTION_DAYS * 86400000;
         try {
             for (const name of fs.readdirSync(logDir)) {
-                if (!/^mailx-\d{4}-\d{2}-\d{2}\.log$/.test(name))
+                // Match both legacy `mailx-` and current `rmfmail-` filenames
+                // so the 30-day prune cleans up history from before the
+                // rebrand without leaving the old files orphaned.
+                if (!/^(?:mailx|rmfmail)-\d{4}-\d{2}-\d{2}\.log$/.test(name))
                     continue;
                 const full = path.join(logDir, name);
                 try {
@@ -977,7 +1129,7 @@ async function main() {
             const d = new Date();
             return `${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}.${pad3(d.getMilliseconds())}`;
         };
-        const logPath = path.join(logDir, `mailx-${localDate()}.log`);
+        const logPath = path.join(logDir, `rmfmail-${localDate()}.log`);
         const logStream = fs.createWriteStream(logPath, { flags: "a" });
         console.log = (...a) => { logStream.write(`${ts()} ${a.join(" ")}\n`); };
         console.error = (...a) => { logStream.write(`${ts()} ERROR ${a.join(" ")}\n`); };
@@ -1416,6 +1568,50 @@ RFC 5322 with CRLF line endings. Bodies are quoted-printable encoded (readable i
     imapManager.on("messageRemoved", (payload) => {
         handle.send({ _event: "messageRemoved", type: "messageRemoved", ...payload });
     });
+    // Pending mailto: handler (P115).
+    //
+    // Two pickup paths, both safe to fire concurrently because the
+    // consume helpers atomically read+delete:
+    //   1. Startup — client calls service.consumePendingMailto via IPC once
+    //      app.ts is ready. Handles the case where `mailx --mailto <url>`
+    //      spawned us; the file existed before fs.watch armed.
+    //   2. Live click — fs.watch fires when a `mailx --mailto <url>` write
+    //      lands while we're already running. We push an `openMailto`
+    //      event; the client's onEvent listener opens compose.
+    //
+    // We do NOT pre-fire from the daemon at startup — that would race the
+    // client poll and one of them would lose the file (whichever read it
+    // first wins; the other gets null and never opens compose).
+    {
+        const { consumePendingMailto, getPendingMailtoFile } = await import("./mailto.js");
+        try {
+            const pendingPath = getPendingMailtoFile();
+            const dir = path.dirname(pendingPath);
+            const baseName = path.basename(pendingPath);
+            fs.mkdirSync(dir, { recursive: true });
+            fs.watch(dir, (_event, filename) => {
+                if (filename !== baseName)
+                    return;
+                if (!fs.existsSync(pendingPath))
+                    return;
+                // Brief debounce — atomic rename fires twice on Windows
+                // (rename + change). The second read returns null because
+                // consume deleted the file on the first; the early-return
+                // above just skips a wasted IPC frame.
+                setTimeout(() => {
+                    const data = consumePendingMailto();
+                    if (!data)
+                        return;
+                    handle.send({ _event: "openMailto", type: "openMailto",
+                        to: data.to, cc: data.cc, bcc: data.bcc,
+                        subject: data.subject, body: data.body, inReplyTo: data.inReplyTo });
+                }, 50);
+            });
+        }
+        catch (e) {
+            console.error(`  [mailto] watch setup failed: ${e.message}`);
+        }
+    }
     // Brief pause for WebView2 to initialize before starting IMAP (avoids stdin writes during init)
     await new Promise(r => setTimeout(r, 500));
     // Register all accounts (OAuth may open browser for Gmail — event loop stays free for IPC)