@bobfrankston/rmfmail 1.2.324 → 1.2.325

package/.commitmsg

@@ -1,24 +1,19 @@
-A proved, trusted sender vouches for its own links; the trust button appears whenever trust would clear the banner
+accounts.jsonc: crash-safe local cache + live reconcile instead of "restart to apply"
 
-Bob 2026-09-11, a Toast receipt: "Another message to flag as safe because
-I trust toasttakeout.com. There should be a trust button."
+A Kernel-Power 41 crash (2026-09-13 16:36) left ~/.rmfmail/accounts.jsonc
+zero-filled: cloudRead rewrote the local cache with a plain writeFileSync on
+EVERY cloud read (every 3 min via pollCloud), so the file was perpetually in a
+just-written window and NTFS committed the size but not the data. jsonc-parser
+returned undefined for the NULs without a single log line, the daemon booted
+with 0 accounts, and the cloud copy sat unused behind the "restart to apply"
+banner.
 
-The mail is dmarc=pass toasttab.com, toasttab.com is on his list, so the
-server's 19.9 spam verdict was already silent — what remained was the
-redirector warning: every link runs through toasttakeout.page.link
-(Firebase's per-app redirector) to toasttakeout.com. Two organisations by
-hostname, nobody signed for page.link, the sender is neither, so rules 1
-to 4 all missed, and the finding's own text said "only the sender could
-vouch for the link". Rule 5: when the proved sender is one the reader
-trusts, it has. Proof stays mandatory — trust without the server's pass
-clears nothing (tested), so a forger typing a trusted domain into From
-gets no vouching.
-
-The banner's "Stop warning about" buttons used to appear only when the
-server's verdict was the single finding. They now appear whenever every
-finding is one trust clears (the verdict, the redirector warning) and the
-sender is proved — the Toast receipt carried both and so had no button
-on the one message that needed it. A proved-but-untrusted sender's
-redirector warning now names the action; an unproved one says plainly
-that nothing proves who the sender is. mailx-types 0.1.99. Verified on
-the live receipt: two cautions before, nothing after.
+- mailx-settings 0.1.92: atomicWriteText (tmp + fsync + rename) exported and
+  used by every local-cache writer; writeTextIfChanged skips identical
+  content; readJsonc reports jsonc-parser errors instead of returning nothing.
+- mailx-imap 0.1.185: pollCloud writes through atomicWriteText.
+- bin/mailx.ts: reconcileAccountsFromDisk — new enabled accounts are added
+  live (addAccount + inbox check + sync + IDLE) on any accounts.jsonc change,
+  including the boot-time cloud refresh; configChanged carries restartNeeded.
+- client: the Restart banner shows only when restartNeeded; otherwise a
+  status-bar line names what changed.

package/.llm/config-cache-crash.md

@@ -0,0 +1,26 @@
+# accounts.jsonc zeroed by a kernel crash — daemon booted with 0 accounts (2026-09-13)
+
+Session: Claude Fable 5.1, started 2026-09-13 ~17:00 EDT.
+
+## Evidence
+- Windows System log: Kernel-Power 41 + 6008 (unexpected shutdown) at 16:36 today.
+- `~/.rmfmail/accounts.jsonc` (1932 bytes) came back as 1932 NUL bytes (NTFS commits size, not data).
+- Boot 16:50:58: `settings loaded (0 accounts)`, `addAccount loop starting` / `complete` with NO accounts.
+  jsonc-parser `parse()` returns undefined on NULs (no throw) → readJsonc returned nothing, no log line.
+- 16:51:12.489 background `loadAccountsAsync` read cloud (4 accounts), `cloudRead` rewrote the local cache
+  → fs.watch saw NULs→JSON → `configChanged` → client banner "accounts.jsonc changed — restart to apply".
+- Why the file was in a fresh-write window: `cloudRead` rewrites the cache with plain `writeFileSync` on
+  EVERY read, and pollCloud reads every 3 min (log: `[watch] accounts.jsonc fs.watch fired but content
+  unchanged` every 3 min all day).
+
+## Fix (in progress)
+1. mailx-settings `index.ts`: cloudRead / loadAccounts cache writes → skip when identical, else
+   atomic tmp+fsync+rename (`atomicWriteText`, now exported, with fsync). readJsonc logs parse errors.
+2. mailx-imap `index.ts` pollCloud write → atomicWriteText.
+3. bin/mailx.ts: cloud account refresh at boot APPLIES new accounts in-process (addAccount +
+   quick check + syncAll + startWatching) instead of only logging "restart to apply".
+4. Bump mailx-settings, mailx-imap; rebuild.cmd.
+
+## Status
+- [x] edits  - [x] tsc + bundles  - [ ] rebuild.cmd (running)  - [ ] Bob restarts app
+- DONE.md entry written as v1.2.325; .commitmsg written; versions: settings 0.1.92, imap 0.1.185

package/bin/mailx.js

@@ -2098,7 +2098,7 @@ async function main() {
     // for nothing — each was independent. Same for node-tcp-transport
     // and mailx-store/file-store.js further down; folded in here so the
     // resolution + module-init cost happens once, in parallel.
-    const [{ MailxDB, prewarmParseWorker, storeBus, Store }, { ImapManager }, { MailxService, spawnSyncWorker }, { dispatch, setDebugEvalSink }, { loadSettings, loadAccountsAsync, loadAllowlistAsync, getConfigDir, getStorageInfo, getStorePath }, { NodeTcpTransport }, { FileMessageStore },] = await Promise.all([
+    const [{ MailxDB, prewarmParseWorker, storeBus, Store }, { ImapManager }, { MailxService, spawnSyncWorker }, { dispatch, setDebugEvalSink }, { loadSettings, loadAccounts, loadAccountsAsync, loadAllowlistAsync, getConfigDir, getStorageInfo, getStorePath }, { NodeTcpTransport }, { FileMessageStore },] = await Promise.all([
         import("@bobfrankston/mailx-store"),
         import("@bobfrankston/mailx-imap"),
         import("@bobfrankston/mailx-service"),
@@ -2124,29 +2124,11 @@ async function main() {
     prewarmParseWorker();
     let settings = loadSettings();
     _tick(`settings loaded (${settings.accounts?.length || 0} accounts)`);
-    // CRITICAL: don't await cloud refresh of accounts.jsonc here — it adds
-    // 1-3s of GDrive latency to startup BEFORE the IPC dispatcher is even
-    // registered. WebView opens, hits "Connecting to server..." overlay,
-    // and sits there waiting for the daemon to finish a cloud read it
-    // doesn't actually need at boot.
-    //
-    // The local accounts.jsonc cache (loaded synchronously above) has the
-    // last-known state; that's what every account+folder+message UI read
-    // depends on. Cloud refresh's only job is "another device added an
-    // account" — fire-and-forget, log + warn if it diverges, the user can
-    // restart for it to take effect. Was a band-aid hidden in a sync
-    // path; per feedback_no_bandaids, fix the real cause.
-    void (async () => {
-        try {
-            const cloudAccounts = await loadAccountsAsync();
-            if (cloudAccounts.length > 0 && cloudAccounts.length !== settings.accounts.length) {
-                console.log(`  [cloud] accounts diverged: cache=${settings.accounts.length} cloud=${cloudAccounts.length} — restart to apply`);
-            }
-        }
-        catch (e) {
-            console.error(`  [cloud] background account refresh failed: ${e?.message || e}`);
-        }
-    })();
+    const cloudAccountsRefresh = loadAccountsAsync().catch((e) => {
+        // The boot snapshot stays in force; the 3-minute cloud poll retries.
+        console.error(`  [cloud] background account refresh failed: ${e?.message || e}`);
+        return [];
+    });
     const db = new MailxDB(getConfigDir());
     _tick("DB opened");
     // Store — the architectural nexus (DB + .eml files + bus + operations).
@@ -2984,8 +2966,81 @@ RFC 5322 with CRLF line endings. Bodies are quoted-printable encoded (readable i
     imapManager.on("accountError", (accountId, error, hint, isOAuth) => {
         handle.send({ _event: "accountError", type: "accountError", accountId, error, hint, isOAuth });
     });
+    /** Bring the running daemon in line with accounts.jsonc as it is on disk.
+     *  New enabled accounts are added live (addAccount + inbox check + sync +
+     *  IDLE). Anything that can't be applied to a live account — one removed,
+     *  disabled, or with changed settings — is reported with restartNeeded so
+     *  the client shows the Restart banner only when a restart really is the
+     *  fix. Idempotent: addAccount ignores ids it already has, and the boot
+     *  snapshot (settings.accounts) is updated in place.
+     *
+     *  2026-09-13 17:20 EDT — Claude Code (Fable 5.1), at Bob's direction.
+     *  Before this every accounts.jsonc change, including the daemon's own
+     *  repair of a crash-zeroed cache from the cloud copy, produced only
+     *  "restart to apply". */
+    async function reconcileAccountsFromDisk() {
+        const onDisk = loadAccounts();
+        if (onDisk.length === 0) {
+            // A file that reads as empty is a broken file, not a request to
+            // drop every account (readJsonc has already logged the parse error).
+            return { restartNeeded: false, detail: "accounts.jsonc has no accounts — keeping the running set" };
+        }
+        const snapshot = new Map(settings.accounts.map(a => [a.id, a]));
+        const diskIds = new Set(onDisk.map(a => a.id));
+        const added = onDisk.filter(a => a.enabled && !snapshot.has(a.id));
+        const removed = settings.accounts.filter(a => !diskIds.has(a.id)).map(a => a.id);
+        const changed = onDisk
+            .filter(a => snapshot.has(a.id) && JSON.stringify(snapshot.get(a.id)) !== JSON.stringify(a))
+            .map(a => a.id);
+        if (added.length === 0 && removed.length === 0 && changed.length === 0) {
+            return { restartNeeded: false, detail: "accounts.jsonc updated — no account changes" };
+        }
+        const applied = [];
+        for (const account of added) {
+            try {
+                await imapManager.addAccount(account);
+                settings.accounts.push(account);
+                applied.push(account.label || account.name || account.id);
+                console.log(`  Account: ${account.label || account.name} (${account.id}) — added from accounts.jsonc`);
+                imapManager.quickInboxCheckAccount(account.id).catch(e => console.error(`  [startup-check] ${account.id}: ${e?.message || e}`));
+            }
+            catch (e) {
+                console.error(`  Failed: ${account.id}: ${e.message}`);
+            }
+        }
+        if (applied.length > 0) {
+            // syncAll is a no-op while a sync is already running; the periodic
+            // sweep picks the new account up then. startWatching is per-config
+            // and idempotent, so IDLE starts for the new account either way.
+            imapManager.syncAll()
+                .then(() => imapManager.startWatching())
+                .catch(e => console.error(`  Sync error: ${e.message}`));
+        }
+        const parts = [];
+        if (applied.length)
+            parts.push(`added ${applied.join(", ")}`);
+        if (removed.length)
+            parts.push(`removed ${removed.join(", ")}`);
+        if (changed.length)
+            parts.push(`changed ${changed.join(", ")}`);
+        const restartNeeded = removed.length > 0 || changed.length > 0;
+        const detail = `accounts.jsonc: ${parts.join("; ")}${restartNeeded ? " — restart to apply" : ""}`;
+        console.log(`  [accounts] ${detail}`);
+        return { restartNeeded, detail };
+    }
     imapManager.on("configChanged", (filename) => {
-        handle.send({ _event: "configChanged", type: "configChanged", filename });
+        if (filename !== "accounts.jsonc") {
+            handle.send({ _event: "configChanged", type: "configChanged", filename });
+            return;
+        }
+        reconcileAccountsFromDisk()
+            .then(r => handle.send({ _event: "configChanged", type: "configChanged", filename, restartNeeded: r.restartNeeded, detail: r.detail }))
+            .catch((e) => {
+            // Reconcile failed: fall back to the old behaviour — the user can
+            // always restart — and say why in the log.
+            console.error(`  [accounts] reconcile failed: ${e?.message || e}`);
+            handle.send({ _event: "configChanged", type: "configChanged", filename, restartNeeded: true, detail: `accounts.jsonc changed — restart to apply (${e?.message || e})` });
+        });
     });
     imapManager.on("outboxStatus", (status) => {
         handle.send({ _event: "outboxStatus", type: "outboxStatus", ...status });
@@ -3369,6 +3424,22 @@ RFC 5322 with CRLF line endings. Bodies are quoted-printable encoded (readable i
     imapManager.startOutboxWorker();
     imapManager.startSentSweep();
     imapManager.watchConfigFiles();
+    // 2026-09-13 17:20 EDT — Claude Code (Fable 5.1), at Bob's direction.
+    // Apply the background cloud refresh started before the DB was even open.
+    // cloudRead has already written the cloud copy into the local cache; if
+    // it differs from the boot snapshot, run it through the same configChanged
+    // path an on-disk edit takes (MailxService drops its accounts cache, then
+    // reconcileAccountsFromDisk adds new accounts live and tells the client).
+    // Emitting here rather than relying on fs.watch closes the race where the
+    // cloud read lands before watchConfigFiles() registered the watcher.
+    void cloudAccountsRefresh.then((cloudAccounts) => {
+        if (cloudAccounts.length === 0)
+            return;
+        if (JSON.stringify(cloudAccounts) === JSON.stringify(settings.accounts))
+            return;
+        console.log(`  [cloud] accounts.jsonc differs from the boot snapshot (cache=${settings.accounts.length} cloud=${cloudAccounts.length}) — reconciling`);
+        imapManager.emit("configChanged", "accounts.jsonc");
+    });
     // Deploy app-owned reference docs (.md per JSONC schema) to the cloud
     // folder so users see them next to the .jsonc they document. Versioned
     // by app version — only redeploys when the app updates. Fire-and-forget;