@bobfrankston/rmfmail 1.1.243 → 1.1.245

package/client/app.js

@@ -1490,6 +1490,17 @@ async function deleteSelectedMessages() {
             return;
         selected.push({ accountId: current.accountId, uid: current.message.uid, folderId: current.message.folderId });
     }
+    // SAFETY GATE: confirm before a BULK delete. `Ctrl+A` selects every
+    // visible row, and in the "All Inboxes" view that's a scattered screenful
+    // across accounts — so a single Ctrl+A then Delete could silently trash
+    // dozens of messages with no prompt. That is exactly what trashed 114 of
+    // Bob's messages on 2026-06-12. A single-message delete (the common quick-
+    // triage case) stays instant; anything larger must be confirmed.
+    if (selected.length > 1) {
+        if (!confirm(`Move ${selected.length} messages to Trash?\n\n(Ctrl+Z restores them if this was a mistake.)`)) {
+            return;
+        }
+    }
     const statusSync = document.getElementById("status-sync");
     // Optimistic UI: remove from list IMMEDIATELY, then queue the IPC.
     // Old order awaited the daemon round-trip (IPC + DB updates) before
@@ -1499,20 +1510,15 @@ async function deleteSelectedMessages() {
     // re-populates the row and the catch block surfaces the error.
     const snapshot = [...selected];
     removeMessagesAndReconcile(selected);
-    // Undo support set immediately too — Ctrl+Z works the moment rows
-    // disappear from the list, not only after the daemon ACKs. Multi-select
-    // deletes only support undo for the first message today (consistent with
-    // the previous single-slot semantics); the loop+push pattern can be
-    // generalized later if Bob hits it.
-    if (snapshot.length === 1) {
-        pushUndo({ kind: "delete", at: Date.now(), payload: { ...snapshot[0], subject: "" } });
-        if (statusSync)
-            statusSync.textContent = `Trashed 1 message (syncing) — Ctrl+Z to undo`;
-    }
-    else {
-        if (statusSync)
-            statusSync.textContent = `Trashed ${snapshot.length} messages (syncing)`;
-    }
+    // Undo restores the WHOLE batch, not just the first message — a bulk
+    // delete must be fully recoverable via Ctrl+Z (the old single-slot undo
+    // left the other N-1 unrecoverable, which made an accidental mass-delete
+    // unrecoverable; Bob 2026-06-12).
+    pushUndo({ kind: "delete", at: Date.now(), payload: snapshot.map(m => ({ ...m, subject: "" })) });
+    if (statusSync)
+        statusSync.textContent = snapshot.length === 1
+            ? `Trashed 1 message (syncing) — Ctrl+Z to undo`
+            : `Trashed ${snapshot.length} messages (syncing) — Ctrl+Z to undo`;
     // Fire-and-forget per local-first: optimistic remove above already
     // updated the UI; the daemon-side trash is sync DB + queued IMAP.
     // An IPC 120s timeout doesn't mean the trash failed — surfacing it
@@ -1544,10 +1550,17 @@ async function performUndo() {
     const statusSync = document.getElementById("status-sync");
     try {
         if (op.kind === "delete") {
-            const { accountId, uid, folderId } = op.payload;
-            await undeleteMessage(accountId, uid, folderId);
+            // payload is the full batch (was a single object pre-2026-06-12;
+            // tolerate both shapes so an in-flight undo from an old build
+            // doesn't throw).
+            const msgs = Array.isArray(op.payload) ? op.payload : [op.payload];
+            for (const m of msgs) {
+                await undeleteMessage(m.accountId, m.uid, m.folderId);
+            }
             if (statusSync)
-                statusSync.textContent = "Message restored";
+                statusSync.textContent = msgs.length === 1
+                    ? "Message restored"
+                    : `Restored ${msgs.length} messages`;
         }
         else if (op.kind === "move") {
             const { messages } = op.payload;