@bobfrankston/rmfmail 1.0.667 → 1.0.668

package/TODO.md

@@ -237,6 +237,8 @@ Previously shown as showstoppers; moved here because they haven't recurred on re
 Small, self-contained items. Pick them up between higher-priority blocks without asking. Bump version per fix.
 
 - ~~**Q138 — Quoted-reply image sizes lost.**~~ DONE 2026-05-11 in `client/app.ts:1000` — strip skips `<img>`. Two-pass loop handles multiple stripped attrs per tag.
+- **Q140 — User-configurable holiday calendars (generalization).** Today the holiday-pull list is hardcoded to two Google calendars: `en.usa#holiday` and `en.jewish#holiday`, each with its own checkbox in the sidebar. Bob 2026-05-11: "Static calendars are OK. You can add generalization to the maybe-future list. Unlikely to do unless I want a more general audience." When that audience expands, generalize to `settings.calendar.holidayCalendars: Array<{ id: string; label: string; enabled: boolean }>`. The refresh loop iterates the array; the sidebar renders one checkbox per entry; a small editor in Settings → calendar lets the user add/remove entries by calendar ID (Google publishes `<locale>.<country>#holiday@group.v.calendar.google.com`, `en.christian#holiday`, etc.). Schema-side `calendar_id` column already partitions rows by source, so toggling one off doesn't affect the others — the existing reconcile logic carries straight over.
+- **Q139 — General app-message channel from daemon to msger popups.** Bob 2026-05-11: "when an exit handler kills the popups by sending them a message — and can there be a general app message?" Today reminder popups are one-shot `showMessageBoxEx` (we have the handle for cross-platform reap). For graceful close-via-message AND other patterns (theme changes, in-flight content updates), spawn popups in `service: true` mode and use the bidirectional pipe — daemon calls `handle.send({type: "close"})` and the popup's JS listens for `_msgapiServiceEvent` events and reacts (`window.close()`, refresh content, etc.). Reuses the same wire mailx's main WebView already uses. Adapter shape: `showServicePopup(opts)` in `mailx-host` returns a `ServiceHandle` + a `result: Promise`; popup HTML's `<script>` registers `window._msgapiServiceEvent = (msg) => { if (msg.type === "close") window.close(); /* future: themeChanged, eventUpdated, … */ }`. Then `gracefulShutdown` in `bin/mailx.ts` iterates open popup handles and sends `{type:"close"}` instead of relying on the OS reaping. Pre-req: confirm msger's service mode supports the `rawHtml` content shape we use for reminders (may need a small msger PR).
 - **Q138 (original entry) — Quoted-reply image sizes lost.** Bob 2026-05-10: in the reply quote of a marketing email (Qatar Airways), the App Store / Google Play / AppGallery button images render larger than in the original. Cause: `sanitizeQuotedBody` in `client/app.ts` strips `width` / `height` attributes (along with `align`, `valign`, `bgcolor`, `cellpadding`, `cellspacing`, `border`) to flatten marketing-email layout tables. Stripping those attrs from `<img>` is collateral damage — table-only attributes there, but they also size images. Fix: in the regex, scope the attr strip to non-img tags, OR leave width/height alone everywhere (the layout flattening doesn't actually need them on tables either — `<table>→<div>` rewrites are doing the heavy lifting). ~10 line change. Low priority — visual nit, not data loss.
 - **Q136 — Server / provider capability matrix (forward backlog).** Catalog of server-specific features mailx could exploit. Detection is dynamic everywhere — IMAP via `CAPABILITY` + RFC 2971 `ID`, non-IMAP via provider-type at account setup. Each row below is its own future work item; this entry is the index.
   - **Dovecot** (IMAP — bobma's primary server): `NOTIFY` (✅ shipped 2026-05-10, see startWatching), `IDLE` (✅), `MOVE` (✅), `QRESYNC` / `CONDSTORE` (📋 Q135 — fast incremental sync with VANISHED + flag-since-modseq), `LIST-EXTENDED` (📋 single-roundtrip folder list with status counts), `METADATA` (📋 per-mailbox annotations — could hold per-folder mailx state on the server), `UNSELECT` (📋 fast folder switch without EXPUNGE), Push Framework / RFC 5423 (📋 server-side HTTP push — requires bobma config change, would let us retire IDLE).

package/bin/mailx.js

@@ -22,8 +22,9 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import net from "node:net";
+import { execSync } from "node:child_process";
 import { ports } from "@bobfrankston/miscinfo";
-import { showMessageBox, showService, setAppName, setAppIcon } from "@bobfrankston/mailx-host";
+import { showMessageBox, showMessageBoxEx, showService, setAppName, setAppIcon } from "@bobfrankston/mailx-host";
 setAppName("rmfmail");
 // Prefer the .ico (Windows Explorer / taskbar-pin shortcut uses the embedded
 // icon resource of the pinned exe, or a Windows icon resource referenced
@@ -249,13 +250,32 @@ function readInstanceFile() {
     catch { /* missing or unreadable — treated as no instance */ }
     return null;
 }
-function writeInstanceFile(pid) {
+function writeInstanceFile(pid, childPids = []) {
     try {
         fs.mkdirSync(path.dirname(__instanceFile), { recursive: true });
-        fs.writeFileSync(__instanceFile, JSON.stringify({ pid, version: __selfVersion, startedAt: Date.now() }, null, 2));
+        const payload = { pid, version: __selfVersion, startedAt: Date.now(), childPids };
+        fs.writeFileSync(__instanceFile, JSON.stringify(payload, null, 2));
     }
     catch { /* non-fatal */ }
 }
+/** Add a child PID to the daemon's instance.json so a later `-kill`
+ *  knows to reap it. Caller is expected to remove it (via
+ *  removeChildPid) when the child exits naturally. */
+function addChildPid(pid) {
+    const inst = readInstanceFile();
+    if (!inst)
+        return;
+    const set = new Set(inst.childPids || []);
+    set.add(pid);
+    writeInstanceFile(inst.pid, [...set]);
+}
+function removeChildPid(pid) {
+    const inst = readInstanceFile();
+    if (!inst)
+        return;
+    const next = (inst.childPids || []).filter(p => p !== pid);
+    writeInstanceFile(inst.pid, next);
+}
 function clearInstanceFile() {
     try {
         fs.unlinkSync(__instanceFile);
@@ -279,18 +299,17 @@ function pidAlive(pid) {
  *  with "already running". Verify it's actually us. Non-Windows: fall back
  *  to pidAlive — POSIX PID reuse is rare enough that we don't bother. */
 function pidIsMailx(pid) {
-    if (!pidAlive(pid))
-        return false;
-    if (process.platform !== "win32")
-        return true;
-    try {
-        const { execSync } = require("node:child_process");
-        const out = execSync(`powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter \\"ProcessId=${pid}\\").CommandLine"`, { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], windowsHide: true }).toString();
-        return /(?:rmfmail|mailx)[\\\/](?:bin|packages|app)|mailx-server/i.test(out);
-    }
-    catch {
-        return false;
-    }
+    // Cross-platform: trust instance.json as the source of identity.
+    // We registered this PID at startup; if it's still alive, treat it
+    // as ours. Earlier Windows-only check used PowerShell + CimInstance
+    // to grep the command line, which violated the cross-platform rule
+    // (see memory: feedback_cross_platform_strong_rule). The downside is
+    // a brief PID-reuse window after a crash: if Windows recycles the
+    // PID between crash and the next launch, our SIGTERM hits an
+    // unrelated process. Mitigation: daemon clears instance.json on
+    // graceful exit; stale-instance file only persists across hard
+    // crashes, which is rare.
+    return pidAlive(pid);
 }
 // Version-mismatch upgrade: if a daemon from an older version is running when
 // the user types `mailx`, kill it so the new one can take over. Without this,
@@ -322,27 +341,17 @@ if (!isDaemon && !__isCommandInvocation && !__keepOthers) {
         }
         catch { /* */ }
     }
-    // Backstop sweep: catches stragglers not in instance.json. Slow (~2s
-    // PowerShell+CIM startup) but only runs once per launch, and it's the
-    // only way to guarantee no orphan windows survive.
-    if (process.platform === "win32") {
-        try {
-            const { execSync } = require("node:child_process");
-            const out = execSync(`powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \\"name='node.exe'\\" | Where-Object { $_.CommandLine -match '(?:rmfmail|mailx)[\\\\/](?:bin|packages)|(?:rmfmail|mailx)-server' } | Select-Object -ExpandProperty ProcessId"`, { encoding: "utf-8", windowsHide: true }).toString();
-            for (const line of out.split("\n").map((s) => s.trim()).filter((s) => /^\d+$/.test(s))) {
-                const pid = Number(line);
-                if (pid === myPid)
-                    continue;
-                try {
-                    process.kill(pid, "SIGTERM");
-                    if (!killedPids.includes(pid))
-                        killedPids.push(pid);
-                }
-                catch { /* */ }
-            }
-        }
-        catch { /* sweep failed — proceed; instance.json kill above usually covers it */ }
-    }
+    // Replace-on-launch trusts the registered PID in instance.json. The
+    // graceful-shutdown handler in the prior daemon (this same file, below)
+    // is responsible for closing its own child msger/popup processes via
+    // handle.close() — name-based sweeps over `node.exe` / `msgernative.exe`
+    // / per-app exes are fragile and ALSO not portable (taskkill is
+    // Windows-only). If a daemon crashed without graceful shutdown, the
+    // instance file gets cleared next launch via the stale-PID check and
+    // the orphan stays until the user resolves it manually — preferable to
+    // a sweep that risks killing an unrelated `mailx` / `rmfmail` process
+    // owned by a different user (e.g., a developer running it from a
+    // sibling worktree).
     // Brief wait + SIGKILL anything that didn't exit gracefully.
     if (killedPids.length) {
         const deadline = Date.now() + 2000;
@@ -408,7 +417,6 @@ function log(...msg) { if (verbose)
 function isElevated() {
     try {
         if (process.platform === "win32") {
-            const { execSync } = require("node:child_process");
             execSync("net session >nul 2>&1", { stdio: "ignore", windowsHide: true });
             return true;
         }
@@ -444,77 +452,48 @@ if (hasFlag("kill")) {
     log("Killing rmfmail processes...");
     const { execSync } = await import("node:child_process");
     let killed = 0;
-    // Try graceful exit first
-    try {
-        execSync(`curl -s -m 2 http://localhost:${PORT}/api/exit`, { stdio: "pipe" });
-        log("Sent graceful exit");
-        execSync("timeout /t 1 /nobreak", { stdio: "pipe" });
-    }
-    catch { /* server may not be responding */ }
-    if (process.platform === "win32") {
-        // Kill by port
+    // Cross-platform kill via instance.json. Daemon writes its PID +
+    // child PIDs (msger WebView, popups) at startup and on each spawn;
+    // -kill reads them and SIGTERMs each. No name-based sweeps, no
+    // PowerShell, no taskkill — those were Windows-only AND fragile
+    // (could match unrelated processes). See memory:
+    // feedback_cross_platform_strong_rule.
+    const inst = readInstanceFile();
+    const targets = [];
+    if (inst && pidAlive(inst.pid))
+        targets.push(inst.pid);
+    for (const cp of (inst?.childPids || [])) {
+        if (pidAlive(cp))
+            targets.push(cp);
+    }
+    for (const pid of targets) {
         try {
-            const out = execSync(`netstat -ano | findstr :${PORT} | findstr LISTENING`, { encoding: "utf-8" }).trim();
-            const pids = [...new Set(out.split("\n").map(l => l.trim().split(/\s+/).pop()).filter(Boolean))];
-            for (const pid of pids) {
-                try {
-                    execSync(`taskkill /F /PID ${pid}`, { stdio: "pipe" });
-                    console.log(`Killed PID ${pid} (port ${PORT})`);
-                    killed++;
-                }
-                catch { /* */ }
-            }
+            process.kill(pid, "SIGTERM");
+            console.log(`SIGTERM → PID ${pid}`);
+            killed++;
         }
-        catch { /* no process on port */ }
-        // Kill any node.exe running rmfmail (server or IPC service). Match
-        // the legacy `mailx` path too — source tree dir is still
-        // `Y:\dev\email\mailx\` and per-app exes from older installs are
-        // under `%LOCALAPPDATA%\mailx\` until those get cleaned up.
-        try {
-            const ps = execSync(
-            // Match both `\` and `/` path separators — node CommandLine
-            // can show either depending on how it was invoked. The
-            // earlier `\\packages` / `\\bin` variants missed forward-
-            // slash paths and left a daemon running. The character
-            // class [\\\\/] covers both. `(?:...)` keeps the regex
-            // unanchored — substring match anywhere in CommandLine.
-            `powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \\"name='node.exe'\\" | Where-Object { $_.CommandLine -match '(?:rmfmail|mailx)[\\\\/](?:bin|packages)|(?:rmfmail|mailx)-server' } | Select-Object -ExpandProperty ProcessId"`, { encoding: "utf-8" }).trim();
-            for (const pid of ps.split("\n").map(s => s.trim()).filter(s => /^\d+$/.test(s))) {
-                try {
-                    execSync(`taskkill /F /PID ${pid}`, { stdio: "pipe" });
-                    console.log(`Killed PID ${pid} (rmfmail node process)`);
-                    killed++;
-                }
-                catch { /* */ }
-            }
+        catch (e) {
+            // ESRCH: stale PID, already dead. Anything else is unexpected.
+            if (e?.code !== "ESRCH")
+                console.error(`  kill ${pid}: ${e?.message || e}`);
         }
-        catch { /* */ }
-        // Kill orphaned msgernative.exe windows. When the node process dies
-        // without cascade-killing its WebView child (old crash, forced
-        // taskkill, etc.), the msgernative.exe stays on screen and looks
-        // like a live rmfmail. rmfmail -kill should leave no trace.
-        // Scoped to exes launched for rmfmail by filtering CommandLine —
-        // don't touch msger windows started by other apps (msga, bbs, etc.).
-        try {
-            const ps = execSync(`powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \\"name='msgernative.exe'\\" | Where-Object { $_.CommandLine -match 'rmfmail|mailx' -or $_.Path -match 'rmfmail|mailx' } | Select-Object -ExpandProperty ProcessId"`, { encoding: "utf-8" }).trim();
-            for (const pid of ps.split("\n").map(s => s.trim()).filter(s => /^\d+$/.test(s))) {
+    }
+    // Wait briefly for graceful shutdown, then SIGKILL anything still alive.
+    if (targets.length) {
+        const deadline = Date.now() + 2000;
+        while (Date.now() < deadline && targets.some(p => pidAlive(p))) {
+            const sab = new SharedArrayBuffer(4);
+            Atomics.wait(new Int32Array(sab), 0, 0, 100);
+        }
+        for (const pid of targets) {
+            if (pidAlive(pid)) {
                 try {
-                    execSync(`taskkill /F /PID ${pid}`, { stdio: "pipe" });
-                    console.log(`Killed PID ${pid} (rmfmail msgernative/WebView)`);
-                    killed++;
+                    process.kill(pid, "SIGKILL");
+                    console.log(`SIGKILL → PID ${pid}`);
                 }
                 catch { /* */ }
             }
         }
-        catch { /* */ }
-    }
-    else {
-        try {
-            execSync(`fuser -k ${PORT}/tcp`, { stdio: "pipe" });
-            console.log(`Killed process on port ${PORT}`);
-            killed++;
-        }
-        catch { /* */ }
     }
     // Clean up stale SQLite WAL/SHM files
     const mailxDir = path.join(process.env.USERPROFILE || process.env.HOME || ".", ".rmfmail");
@@ -1337,9 +1316,25 @@ RFC 5322 with CRLF line endings. Bodies are quoted-printable encoded (readable i
     // Inject the popup function so MailxService.showReminderPopup can spawn
     // an OS-level always-on-top window via mailx-host. Kept as injection
     // (not import) so mailx-service stays host-agnostic.
+    //
+    // Uses showMessageBoxEx so we get a MessageBoxHandle back with
+    // `pid` and `close()`. The pid goes into instance.json's childPids
+    // for the lifetime of the popup, so a `rmfmail -kill` from another
+    // shell can SIGTERM it without name-based sweeps (cross-platform —
+    // see memory: feedback_cross_platform_strong_rule). Remove on
+    // resolution so the file doesn't accumulate stale PIDs.
     svc.setPopupFn(async (opts) => {
-        const r = await showMessageBox(opts);
-        return { button: r.button, closed: r.closed, dismissed: r.dismissed };
+        const h = showMessageBoxEx(opts);
+        if (typeof h.pid === "number")
+            addChildPid(h.pid);
+        try {
+            const r = await h.result;
+            return { button: r.button, closed: r.closed, dismissed: r.dismissed, form: r.form };
+        }
+        finally {
+            if (typeof h.pid === "number")
+                removeChildPid(h.pid);
+        }
     });
     // Open msger in service mode — custom protocol serves files from client dir
     const clientDir = path.join(import.meta.dirname, "..", "client");
@@ -1403,17 +1398,25 @@ RFC 5322 with CRLF line endings. Bodies are quoted-printable encoded (readable i
             : undefined,
         escapeCloses: false,
     });
-    // Register ourselves as the live instance so subsequent `mailx` invocations
-    // can detect version-mismatch and upgrade us (see top of file). Clear on
-    // any of: SIGINT, SIGTERM, normal exit.
+    // Register ourselves as the live instance so subsequent `rmfmail`
+    // invocations can detect version-mismatch and upgrade us (see top of
+    // file). Clear on any of: SIGINT, SIGTERM, normal exit.
     //
     // Critical: the SIGTERM handler must *close the WebView child process*
-    // (handle.close() → kills msgernative.exe) before Node exits. Without
-    // this, the auto-upgrade leaves the old WebView orphaned on screen and
-    // the user sees an apparently frozen "old mailx" while the new Node is
-    // trying to spawn a second one. Cascade-killing the child makes the
-    // version-mismatch auto-upgrade actually transparent to the user.
-    writeInstanceFile(process.pid);
+    // (handle.close() → SIGTERM to the msger child) before Node exits.
+    // Without this, the auto-upgrade leaves the old WebView orphaned on
+    // screen and the user sees an apparently frozen "old rmfmail" while
+    // the new Node is trying to spawn a second one. Cascade-closing the
+    // child makes the version-mismatch auto-upgrade transparent.
+    //
+    // Child PIDs (the msger WebView host + any reminder popups) go into
+    // instance.json so that a future `rmfmail -kill` can SIGTERM them
+    // cross-platform without resorting to name-based process sweeps.
+    const initialChildPids = [];
+    const handleChild = handle?.pid ?? handle?.child?.pid;
+    if (typeof handleChild === "number")
+        initialChildPids.push(handleChild);
+    writeInstanceFile(process.pid, initialChildPids);
     const __cleanupInstance = () => {
         // Only clear if WE are still the registered instance. Prevents the
         // restart-daemon sequence (clear → spawn → new daemon writes its