@bobfrankston/rmfmail 1.1.244 → 1.1.246

package/client/app.js

@@ -1490,6 +1490,28 @@ async function deleteSelectedMessages() {
             return;
         selected.push({ accountId: current.accountId, uid: current.message.uid, folderId: current.message.folderId });
     }
+    // Deleting a message that is ALREADY in Trash is a PERMANENT expunge, not
+    // a move — the service's trashMessage returns "expunged" in that case. So
+    // the prompt and the undo promise must change: permanent delete always
+    // confirms (even a single message) and can't be undone (Bob 2026-06-12).
+    const inTrash = currentFolderSpecialUse === "trash";
+    // SAFETY GATE.
+    //  - In Trash: any delete is permanent → always confirm, warn it's final.
+    //  - Elsewhere: a single delete is instant (quick triage); a BULK delete
+    //    confirms, because `Ctrl+A` selects every visible row and in All
+    //    Inboxes that's a scattered screenful — exactly what silently trashed
+    //    114 of Bob's messages on 2026-06-12.
+    const n = selected.length;
+    if (inTrash) {
+        if (!confirm(`Permanently delete ${n} message${n === 1 ? "" : "s"} from Trash?\n\nThis cannot be undone.`)) {
+            return;
+        }
+    }
+    else if (n > 1) {
+        if (!confirm(`Move ${n} messages to Trash?\n\n(Ctrl+Z restores them if this was a mistake.)`)) {
+            return;
+        }
+    }
     const statusSync = document.getElementById("status-sync");
     // Optimistic UI: remove from list IMMEDIATELY, then queue the IPC.
     // Old order awaited the daemon round-trip (IPC + DB updates) before
@@ -1499,19 +1521,20 @@ async function deleteSelectedMessages() {
     // re-populates the row and the catch block surfaces the error.
     const snapshot = [...selected];
     removeMessagesAndReconcile(selected);
-    // Undo support set immediately too — Ctrl+Z works the moment rows
-    // disappear from the list, not only after the daemon ACKs. Multi-select
-    // deletes only support undo for the first message today (consistent with
-    // the previous single-slot semantics); the loop+push pattern can be
-    // generalized later if Bob hits it.
-    if (snapshot.length === 1) {
-        pushUndo({ kind: "delete", at: Date.now(), payload: { ...snapshot[0], subject: "" } });
+    if (inTrash) {
+        // Permanent — no undo entry (there's nothing to restore to).
         if (statusSync)
-            statusSync.textContent = `Trashed 1 message (syncing) — Ctrl+Z to undo`;
+            statusSync.textContent = `Permanently deleted ${n} message${n === 1 ? "" : "s"}`;
     }
     else {
+        // Undo restores the WHOLE batch, not just the first message — a bulk
+        // delete must be fully recoverable via Ctrl+Z (the old single-slot undo
+        // left the other N-1 unrecoverable; Bob 2026-06-12).
+        pushUndo({ kind: "delete", at: Date.now(), payload: snapshot.map(m => ({ ...m, subject: "" })) });
         if (statusSync)
-            statusSync.textContent = `Trashed ${snapshot.length} messages (syncing)`;
+            statusSync.textContent = n === 1
+                ? `Trashed 1 message (syncing) — Ctrl+Z to undo`
+                : `Trashed ${n} messages (syncing) — Ctrl+Z to undo`;
     }
     // Fire-and-forget per local-first: optimistic remove above already
     // updated the UI; the daemon-side trash is sync DB + queued IMAP.
@@ -1544,10 +1567,17 @@ async function performUndo() {
     const statusSync = document.getElementById("status-sync");
     try {
         if (op.kind === "delete") {
-            const { accountId, uid, folderId } = op.payload;
-            await undeleteMessage(accountId, uid, folderId);
+            // payload is the full batch (was a single object pre-2026-06-12;
+            // tolerate both shapes so an in-flight undo from an old build
+            // doesn't throw).
+            const msgs = Array.isArray(op.payload) ? op.payload : [op.payload];
+            for (const m of msgs) {
+                await undeleteMessage(m.accountId, m.uid, m.folderId);
+            }
             if (statusSync)
-                statusSync.textContent = "Message restored";
+                statusSync.textContent = msgs.length === 1
+                    ? "Message restored"
+                    : `Restored ${msgs.length} messages`;
         }
         else if (op.kind === "move") {
             const { messages } = op.payload;