@bobfrankston/rmfmail 1.1.245 → 1.1.246

package/client/app.js

@@ -1490,14 +1490,25 @@ async function deleteSelectedMessages() {
             return;
         selected.push({ accountId: current.accountId, uid: current.message.uid, folderId: current.message.folderId });
     }
-    // SAFETY GATE: confirm before a BULK delete. `Ctrl+A` selects every
-    // visible row, and in the "All Inboxes" view that's a scattered screenful
-    // across accounts — so a single Ctrl+A then Delete could silently trash
-    // dozens of messages with no prompt. That is exactly what trashed 114 of
-    // Bob's messages on 2026-06-12. A single-message delete (the common quick-
-    // triage case) stays instant; anything larger must be confirmed.
-    if (selected.length > 1) {
-        if (!confirm(`Move ${selected.length} messages to Trash?\n\n(Ctrl+Z restores them if this was a mistake.)`)) {
+    // Deleting a message that is ALREADY in Trash is a PERMANENT expunge, not
+    // a move — the service's trashMessage returns "expunged" in that case. So
+    // the prompt and the undo promise must change: permanent delete always
+    // confirms (even a single message) and can't be undone (Bob 2026-06-12).
+    const inTrash = currentFolderSpecialUse === "trash";
+    // SAFETY GATE.
+    //  - In Trash: any delete is permanent → always confirm, warn it's final.
+    //  - Elsewhere: a single delete is instant (quick triage); a BULK delete
+    //    confirms, because `Ctrl+A` selects every visible row and in All
+    //    Inboxes that's a scattered screenful — exactly what silently trashed
+    //    114 of Bob's messages on 2026-06-12.
+    const n = selected.length;
+    if (inTrash) {
+        if (!confirm(`Permanently delete ${n} message${n === 1 ? "" : "s"} from Trash?\n\nThis cannot be undone.`)) {
+            return;
+        }
+    }
+    else if (n > 1) {
+        if (!confirm(`Move ${n} messages to Trash?\n\n(Ctrl+Z restores them if this was a mistake.)`)) {
             return;
         }
     }
@@ -1510,15 +1521,21 @@ async function deleteSelectedMessages() {
     // re-populates the row and the catch block surfaces the error.
     const snapshot = [...selected];
     removeMessagesAndReconcile(selected);
-    // Undo restores the WHOLE batch, not just the first message — a bulk
-    // delete must be fully recoverable via Ctrl+Z (the old single-slot undo
-    // left the other N-1 unrecoverable, which made an accidental mass-delete
-    // unrecoverable; Bob 2026-06-12).
-    pushUndo({ kind: "delete", at: Date.now(), payload: snapshot.map(m => ({ ...m, subject: "" })) });
-    if (statusSync)
-        statusSync.textContent = snapshot.length === 1
-            ? `Trashed 1 message (syncing) — Ctrl+Z to undo`
-            : `Trashed ${snapshot.length} messages (syncing) — Ctrl+Z to undo`;
+    if (inTrash) {
+        // Permanent — no undo entry (there's nothing to restore to).
+        if (statusSync)
+            statusSync.textContent = `Permanently deleted ${n} message${n === 1 ? "" : "s"}`;
+    }
+    else {
+        // Undo restores the WHOLE batch, not just the first message — a bulk
+        // delete must be fully recoverable via Ctrl+Z (the old single-slot undo
+        // left the other N-1 unrecoverable; Bob 2026-06-12).
+        pushUndo({ kind: "delete", at: Date.now(), payload: snapshot.map(m => ({ ...m, subject: "" })) });
+        if (statusSync)
+            statusSync.textContent = n === 1
+                ? `Trashed 1 message (syncing) — Ctrl+Z to undo`
+                : `Trashed ${n} messages (syncing) — Ctrl+Z to undo`;
+    }
     // Fire-and-forget per local-first: optimistic remove above already
     // updated the UI; the daemon-side trash is sync DB + queued IMAP.
     // An IPC 120s timeout doesn't mean the trash failed — surfacing it