@bobfrankston/rmfmail 1.2.324 → 1.2.326

package/packages/mailx-settings/index.ts

@@ -18,7 +18,7 @@
 
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { parse as parseJsonc } from "jsonc-parser";
+import { parse as parseJsonc, printParseErrorCode, type ParseError } from "jsonc-parser";
 import type { MailxSettings, AccountConfig, AutocompleteSettings, AiKeys, ReminderState } from "@bobfrankston/mailx-types";
 import { REMINDER_STATE_FILE, normalizeReminderState, mergeReminderStates, reminderStatesEqual } from "@bobfrankston/mailx-types";
 import { getCloudProvider, gDriveFindOrCreateFolder, gDriveValidateCachedFolder, type CloudProvider } from "./cloud.js";
@@ -312,11 +312,22 @@ export async function cloudRead(filename: string): Promise<string | null> {
             if (wroteAt >= startedAt) {
                 console.log(`  [cloud] ${filename} changed locally during the read — keeping the local copy`);
             } else {
-                fs.mkdirSync(LOCAL_DIR, { recursive: true });
+                // 2026-09-13 17:20 EDT — Claude Code (Fable 5.1), at Bob's direction.
+                // Was an unconditional plain writeFileSync on EVERY cloud read —
+                // and pollCloud reads every 3 min — so accounts.jsonc was rewritten
+                // all day even when identical (the log showed "fs.watch fired but
+                // content unchanged" every 3 minutes). A kernel crash at 16:36
+                // today caught one of those rewrites and NTFS left the file
+                // zero-filled; the daemon then booted with 0 accounts. Now: skip
+                // when identical, and write crash-safe (tmp + fsync + rename).
                 stashPrev(filename, content);
-                fs.writeFileSync(path.join(LOCAL_DIR, filename), content);
+                writeTextIfChanged(path.join(LOCAL_DIR, filename), content);
             }
-        } catch { /* ignore cache write failure */ }
+        } catch (e: any) {
+            // The cloud content is still returned to the caller; only the local
+            // offline cache is stale, and the next read retries the write.
+            console.error(`  [cloud] ${filename}: local cache write failed: ${e?.message || e}`);
+        }
     }
     // Don't set error for missing files — they may not exist yet (e.g., clients.jsonc on first run)
     return content;
@@ -488,19 +499,31 @@ function readJsonc(filePath: string): any {
         if (!fs.existsSync(actual)) return null;
     }
     try {
-        return parseJsonc(fs.readFileSync(actual, "utf-8").replace(/\r/g, ""));
+        // 2026-09-13 17:20 EDT — Claude Code (Fable 5.1), at Bob's direction.
+        // jsonc-parser's parse() never throws: on garbage it returns undefined
+        // and only reports through the errors array. Without the array, the
+        // crash-zeroed accounts.jsonc (1932 NUL bytes) read as "no accounts"
+        // with not one log line — the daemon started with zero accounts and
+        // the only symptom was the "restart to apply" banner 14 s later.
+        const text = fs.readFileSync(actual, "utf-8").replace(/\r/g, "");
+        const errors: ParseError[] = [];
+        const data = parseJsonc(text, errors);
+        if (errors.length > 0) {
+            const first = errors[0];
+            console.error(`Failed to parse ${actual}: ${printParseErrorCode(first.error)} at offset ${first.offset} (${errors.length} error(s), ${text.length} chars)`);
+            return null;
+        }
+        return data;
     } catch (e: any) {
         console.error(`Failed to read ${actual}: ${e.message}`);
         return null;
     }
 }
 
+// 2026-09-13 17:20 EDT — Claude Code (Fable 5.1): one write mechanism; the
+// fsync lives in atomicWriteText (see its note).
 function atomicWrite(filePath: string, data: any): void {
-    const dir = path.dirname(filePath);
-    fs.mkdirSync(dir, { recursive: true });
-    const tmp = filePath + ".tmp";
-    fs.writeFileSync(tmp, JSON.stringify(data, null, 2));
-    fs.renameSync(tmp, filePath);
+    atomicWriteText(filePath, JSON.stringify(data, null, 2));
 }
 
 /** Read a config file: shared first, local fallback, merge local overrides */
@@ -850,8 +873,9 @@ export function loadAccounts(): AccountConfig[] {
                 const norm = (s: string): string =>
                     s.replace(/^\uFEFF/, "").replace(/\r\n/g, "\n").replace(/[ \t\r\n]+$/, "");
                 if (norm(sharedContent) !== norm(localContent)) {
-                    fs.mkdirSync(LOCAL_DIR, { recursive: true });
-                    fs.writeFileSync(localPath, sharedContent);
+                    // 2026-09-13 17:20 EDT — Claude Code (Fable 5.1): crash-safe
+                    // write (tmp + fsync + rename); see atomicWriteText.
+                    atomicWriteText(localPath, sharedContent);
                 }
             } catch { /* ignore */ }
         }
@@ -1317,14 +1341,41 @@ function buildDictCsv(words: string[]): string {
     return "# rmfmail user dictionary — one word per line\n" + sorted.join("\n") + "\n";
 }
 
-function atomicWriteText(filePath: string, text: string): void {
+/** Crash-safe text write: tmp file → fsync → rename over the target.
+ *
+ *  2026-09-13 17:20 EDT — Claude Code (Fable 5.1), at Bob's direction.
+ *  Added the fsync and exported this for every local-cache writer. Kernel-Power
+ *  41 crash at 16:36 today left `~/.rmfmail/accounts.jsonc` as 1932 NUL bytes:
+ *  NTFS journals metadata (the new size) but not data, so a file rewritten
+ *  moments before a hard crash comes back zero-filled. A rename alone does not
+ *  close that window — the tmp file's data can be unflushed too — hence the
+ *  fsync before the rename. The daemon then booted with 0 accounts. */
+export function atomicWriteText(filePath: string, text: string): void {
     const dir = path.dirname(filePath);
     fs.mkdirSync(dir, { recursive: true });
     const tmp = filePath + ".tmp";
-    fs.writeFileSync(tmp, text);
+    const fd = fs.openSync(tmp, "w");
+    try {
+        fs.writeSync(fd, text);
+        fs.fsyncSync(fd);
+    } finally {
+        fs.closeSync(fd);
+    }
     fs.renameSync(tmp, filePath);
 }
 
+/** Write `text` to `filePath` only when it differs from what is already there.
+ *  Returns true when a write happened. Identical content is skipped so a
+ *  periodic cloud poll doesn't keep the file in a perpetual just-written
+ *  window (see atomicWriteText) and doesn't fire fs.watch for nothing. */
+export function writeTextIfChanged(filePath: string, text: string): boolean {
+    let existing: string = null;
+    try { existing = fs.readFileSync(filePath, "utf-8"); } catch { existing = null; /* missing or unreadable → write it */ }
+    if (existing === text) return false;
+    atomicWriteText(filePath, text);
+    return true;
+}
+
 /** Load user-added dictionary words. Mirrored to GDrive so "Add to dictionary"
  *  on one machine appears on every machine. Returns a deduped string array.
  *  Tries the cloud copy first (so a fresh machine sees prior words), then

package/packages/mailx-settings/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-settings",
-  "version": "0.1.91",
+  "version": "0.1.94",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/packages/mailx-store/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.126",
+  "version": "0.1.127",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/.commitmsg

@@ -1,24 +0,0 @@
-A proved, trusted sender vouches for its own links; the trust button appears whenever trust would clear the banner
-
-Bob 2026-09-11, a Toast receipt: "Another message to flag as safe because
-I trust toasttakeout.com. There should be a trust button."
-
-The mail is dmarc=pass toasttab.com, toasttab.com is on his list, so the
-server's 19.9 spam verdict was already silent — what remained was the
-redirector warning: every link runs through toasttakeout.page.link
-(Firebase's per-app redirector) to toasttakeout.com. Two organisations by
-hostname, nobody signed for page.link, the sender is neither, so rules 1
-to 4 all missed, and the finding's own text said "only the sender could
-vouch for the link". Rule 5: when the proved sender is one the reader
-trusts, it has. Proof stays mandatory — trust without the server's pass
-clears nothing (tested), so a forger typing a trusted domain into From
-gets no vouching.
-
-The banner's "Stop warning about" buttons used to appear only when the
-server's verdict was the single finding. They now appear whenever every
-finding is one trust clears (the verdict, the redirector warning) and the
-sender is proved — the Toast receipt carried both and so had no button
-on the one message that needed it. A proved-but-untrusted sender's
-redirector warning now names the action; an unproved one says plainly
-that nothing proves who the sender is. mailx-types 0.1.99. Verified on
-the live receipt: two cautions before, nothing after.