@bobfrankston/rmfmail 1.2.79 → 1.2.81

package/README.md

@@ -15,9 +15,35 @@ npm install -g @bobfrankston/rmfmail
 rmfmail
 ```
 
-Requires Node.js 22 or later.
+Requires Node.js 24.2 or later.
 
-On Windows, the native WebView2 app launches automatically via IPC (no HTTP server needed). Use `rmfmail --server` for browser mode at `http://127.0.0.1:9333`.
+On Windows, the native WebView2 app launches automatically via IPC (no HTTP server needed).
+
+## Updating
+
+Update with [`@bobfrankston/bobup`](https://www.npmjs.com/package/@bobfrankston/bobup) — it lists and updates globally-installed `@bobfrankston/*` packages (cross-platform):
+
+```bash
+npm install -g @bobfrankston/bobup    # once
+bobup                                 # update rmfmail + any other @bobfrankston tools to latest
+bobup update rmfmail                  # update only rmfmail
+bobup list                            # preview what's outdated first
+```
+
+After updating, restart the app to pick up the new version: `rmfmail -kill` then `rmfmail`. (Plain `npm install -g @bobfrankston/rmfmail` still works as well.)
+
+## Platforms
+
+| Platform | Status | How it runs |
+|----------|--------|-------------|
+| Windows | ✅ | Native WebView2 window via the **msger** host (default); IPC, no HTTP server |
+| Linux | ✅ | **msger** host (WebKit WebView) |
+| macOS | ⏳ planned | **msgview** (Electron) host — set `MAILX_HOST=msgview` once the adapter ships |
+| Android | ✅ | Standalone **MAUI** app — its own local store + direct IMAP/Gmail sync; side-load the APK |
+
+The host is chosen at runtime via `@bobfrankston/mailx-host` (override with the `MAILX_HOST` env var). The Android app is a full standalone client — not a remote view of the desktop — so it works with the desktop turned off.
+
+> **`--server` (Express HTTP/browser) mode was removed (2026-06).** The client became IPC-only, leaving the browser path with no transport, so the mode was dead. Use the native desktop app or the standalone Android app instead.
 
 ## First-Time Setup
 
@@ -114,20 +140,17 @@ rmfmail --import my-accounts.jsonc
 
 This merges the accounts into your Google Drive settings (deduplicates by email address). Existing accounts are preserved.
 
-### Gmail OAuth Prerequisites
+### Gmail OAuth
 
-Gmail OAuth requires a one-time Google Cloud setup:
-1. Go to [Google Cloud Console](https://console.cloud.google.com/) and create a project
-2. Enable the **Gmail API** (and **People API** for contacts)
-3. Create **OAuth 2.0 credentials** (Desktop app type)
-4. Download `credentials.json` to the iflow package directory
-5. First connection opens a browser for consent. Tokens refresh automatically.
+No setup required for normal use — rmfmail **ships with OAuth credentials**, so the first Gmail connection just opens a browser for consent and tokens refresh automatically.
+
+**Advanced / self-hosting (optional):** to use your *own* OAuth app instead of the bundled credentials, create a project in the [Google Cloud Console](https://console.cloud.google.com/), enable the **Gmail API** (and **People API** for contacts), create **OAuth 2.0 credentials** (Desktop app type), and save them as `~/.rmfmail/google-credentials.json`. Outlook/Graph works the same way via `~/.rmfmail/microsoft-credentials.json`.
 
 ## Usage
 
 ### Layout
 
-A vertical **icon rail** sits on the far left (Thunderbird / Dovecot style) with one-click access to Compose, Inbox, All Inboxes, and Settings; Calendar / Tasks / Contacts slots are placeholders until those features land. The rail is always visible on wide and medium screens; it folds into the hamburger menu on narrow ones.
+A vertical **icon rail** sits on the far left (Thunderbird / Dovecot style) with one-click access to Compose, Inbox, All Inboxes, Contacts (Google address book), Calendar, Tasks, View options, and Settings. Calendar/Tasks open the right-side sidebar (Google Calendar + Tasks); Contacts opens the address book. The rail is always visible on wide and medium screens; it folds into the hamburger menu on narrow ones.
 
 ### Reading Mail
 
@@ -159,10 +182,12 @@ A vertical **icon rail** sits on the far left (Thunderbird / Dovecot style) with
 
 - **Delete** or **Ctrl+D** -- Delete selected messages (moves to Trash; second delete in Trash is a hard delete + EXPUNGE)
 - **Ctrl+Z** -- Undo the last **delete or move** (whichever came last, 60s window)
-- **Ctrl+A** -- Select all messages in the list
+- **Ctrl+A** -- Select all messages (enters multi-select; row avatars turn into checkboxes). **Escape** or a plain click exits multi-select.
+- **Multi-select actions** -- With rows selected, right-click → **Flag/Unflag**, **Mark read/unread**, or **Move** acts on the whole selection. Clicking the **star** on any selected row flags/unflags the *entire* selection at once.
+- **R** or **Ctrl+Q** -- Toggle read/unread on the focused message (bare R defers while typing in a field; Ctrl+Q always works). Auto mark-as-read (with a configurable delay) is on by default — see Settings.
 - **Drag and drop** -- Move messages to a folder by dragging them
 - **Right-click a message → Move to folder…** -- Searchable folder picker; useful on narrow layouts where the folder tree is hidden
-- Click the **star** column to flag/unflag a message
+- Click the **star** column to flag/unflag a single message
 - **Unsubscribe** button appears when the message has a List-Unsubscribe header. One-click (RFC 8058) when the sender advertises `List-Unsubscribe-Post: List-Unsubscribe=One-Click`; otherwise opens the URL or a pre-filled compose for `mailto:` lists.
 - **Right-click on a From/To/Cc address** -- Copy name, Copy address, Copy both, Add to contacts, or Reply/Reply All/Forward
 - **Right-click in the message body → Translate** (opt-in) -- Uses the configured AI provider; select text first to translate just the selection. Off by default; enable under **Settings → AI translate**.
@@ -179,6 +204,8 @@ Type in the search bar and press **Enter**. Use the dropdown to search:
 
 Supports regex: wrap pattern in `/slashes/`.
 
+**Search as find:** selecting a result then closing the search (clear the box or press **Escape**) returns you to that message in its real folder, instead of bouncing back to where you started — so search doubles as a "jump to this message" tool. Search is **ephemeral**: it never persists across a restart. An empty result reads *No messages found by "query"* so it's clear the search (not the mailbox) is empty.
+
 ### Folder Operations
 
 Right-click a folder for options:
@@ -187,19 +214,29 @@ Right-click a folder for options:
 - Rename / Delete folder
 - Empty (Trash and Junk only)
 
+Drag a folder onto another to **reparent** it (server-side IMAP `RENAME` / Gmail label / Outlook move).
+
 ### View Options
 
 Under **View** in the toolbar:
 - **Two-line view** -- Show preview snippet below each subject
 - **Preview pane** -- Toggle the message reader panel
 - **Preview snippets** -- Show snippet text in message rows
-- **Flagged only** -- Show only starred messages
+- **Flag stars** -- Show the grey ☆ on every row (on by default). Turn it off to hide empty stars; flagged ★ rows keep their gold star, and a row's ☆ reappears on hover so you can still click to flag.
+- **Group by thread** -- Collapse reply chains to the newest message with a count pill; click the pill for a popup of the whole conversation
+- **Only this conversation** -- Filter the list to the selected message's thread
+- **Flagged only** -- Show only starred messages (the list takes a flag-coloured wash so the filter is obvious). Session-only — resets on restart.
+- **Priority senders only** -- Show only mail from senders/domains marked priority in `contacts.jsonc`
 - **Folder counts** -- Show total message counts on all folders
+- **Calendar sidebar** -- Show the right-side calendar / tasks panel
 
 ### Settings
 
 Under **Settings** in the toolbar:
-- **Editor** -- Choose between Quill (default) and tiptap for compose
+- **Editor** -- Choose between Quill (default), tiptap, or TinyMCE for compose
+- **External editor (Edit in Word)** -- Open the compose body in Microsoft Word or LibreOffice Writer for heavy editing (Auto / Word / LibreOffice)
+- **Auto mark-as-read** -- Mark a viewed message read after a short, configurable delay (delay in seconds; 0 = immediately). Turn off to require an explicit Mark-read.
+- **Check sender reputation (DNSBLs)** -- When opening a message with remote content, look the sender's domain up in three free blocklists in parallel (off by default; each query leaks the bare domain to that DNSBL)
 - **AI autocomplete** -- Enable LLM-powered writing suggestions (Ollama, Claude, or OpenAI)
 - **AI translate** -- Enable the right-click Translate item in the message viewer (off by default; uses the same provider as autocomplete)
 - **AI proofread** -- Enable the proofread path (off by default; provider method available, UI wiring in progress)
@@ -216,9 +253,10 @@ All AI features are opt-in. Provider + API key live in the autocomplete settings
 | Ctrl+F | Forward |
 | Delete / Ctrl+D | Delete |
 | Ctrl+Z | Undo last delete or move |
-| Ctrl+A | Select all |
+| Ctrl+A | Select all (enter multi-select) |
+| R / Ctrl+Q | Toggle read/unread on the focused message |
 | F5 | Sync all folders |
-| Escape | Clear search / close menus |
+| Escape | Exit multi-select / clear search / close menus |
 
 **In the compose editor:**
 
@@ -248,21 +286,24 @@ All AI features are opt-in. Provider + API key live in the autocomplete settings
 
 Flag style: single-dash is canonical (`-kill`, `-setup`, ...). The parser
 also accepts double-dash (`--kill`, `--setup`) as a synonym, so older
-scripts that used `--server` / `--email` keep working.
+scripts that used `--email` / `--import` keep working.
 
 ```
 rmfmail                        Start the app (native window via IPC)
 rmfmail -email <addr>          First-time setup with this email (skips prompt)
 rmfmail -verbose               Show log output in terminal (default: log file only)
 rmfmail -import <file>         Import accounts.jsonc into Google Drive
-rmfmail -server                Start HTTP server for dev/remote (http://localhost:9333)
 
 rmfmail -kill                  Kill running rmfmail processes + clean up WAL files
-rmfmail -repair                Re-sync message metadata (fix garbled subjects)
-rmfmail -rebuild               Wipe local cache and re-download everything from IMAP
 rmfmail -setup                 Interactive first-time setup (CLI)
+rmfmail -add                   Add another account (CLI)
 rmfmail -test                  Test IMAP/SMTP connectivity for all accounts
+rmfmail -repair                Re-sync message metadata, keep .eml files (fix garbled subjects)
+rmfmail -rebuild               Wipe local cache and re-download everything from IMAP
+rmfmail -recover               Rebuild the DB index from the .eml files on disk (no network)
+rmfmail -fix-flags             Reconcile local ★ flags against the server's actual flagged set
 rmfmail -reauth                Clear cached OAuth tokens; next start re-consents
+rmfmail -log                   Print the log file path and exit
 rmfmail -v                     Show version
 
 rmfmail -send <file>           Enqueue a .ltr/.eml for sending. Daemon parses
@@ -319,12 +360,14 @@ MSIX packaging or a hash-aware helper.
 `-register-mailto` if the picker is showing a stale "Node.js JavaScript
 Runtime" entry from an older install.
 
-### -repair vs -rebuild
+### -repair vs -rebuild vs -recover
 
 **-repair** clears message metadata (subjects, flags, sender names) from the database but preserves your downloaded `.eml` message files. Folder sync state resets so rmfmail re-fetches all envelopes on next run. Use this when subjects show garbled characters.
 
 **-rebuild** deletes the entire database and message store, then re-downloads everything from IMAP. Accounts and settings are preserved. Use this for a clean start or to reclaim disk space.
 
+**-recover** rebuilds the database index purely from the `.eml` files already on disk — no network. Use it to get back everything you had after a DB loss when you'd rather not re-download from the server.
+
 ## Configuration
 
 All config files live in `~/.rmfmail/` (on Windows: `C:\Users\You\.rmfmail\`). On first start, an existing `~/.mailx/` directory is auto-renamed to `~/.rmfmail/`.
@@ -477,7 +520,6 @@ Use `rmfmail --verbose` to see logs in the terminal instead.
 
 - **IPC-first** -- Default mode uses msger (Rust/WebView2) with bidirectional IPC. No TCP server, no CLOSE_WAIT zombies.
 - **Host abstraction** -- rmfmail talks to the WebView host through `@bobfrankston/mailx-host`, which picks msger (default) or msgview (Electron, planned for Mac and niche Linux) at runtime. Override with `MAILX_HOST=msger|msgview`. Internal package names retain the historical `mailx-*` prefix; only the public package was renamed.
-- **HTTP fallback** -- `--server` flag starts Express for browser/remote access.
 - **Local-first** -- Changes update local DB immediately; background worker syncs to IMAP.
 - **Offline reading** -- Full message bodies cached as .eml files.
 - **IMAP IDLE** -- Instant new-mail notifications + periodic sync fallback.

package/bin/mailx.js

@@ -8,8 +8,6 @@
  *
  * Launch:
  *   rmfmail                 Start daemon + open WebView (IPC, no TCP)
- *   rmfmail -server          Start Express HTTP server (dev/remote)
- *   rmfmail -no-browser      Server mode without auto-opening a browser
  *   rmfmail -another         Don't replace any existing rmfmail daemon
  *   rmfmail -verbose         Echo logs to terminal (default: log file only)
  *   rmfmail -debug-server    Launch debug introspection server
@@ -498,7 +496,7 @@ const repairMode = hasFlag("repair");
 const recoverMode = hasFlag("recover");
 const importMode = hasFlag("import");
 // Validate arguments
-const knownFlags = ["verbose", "kill", "v", "version", "setup", "add", "test", "rebuild", "repair", "recover", "fix-flags", "relink-bodies", "log", "import", "email", "mail", "daemon", "reauth", "mailto", "register-mailto", "unregister-mailto", "allow-elevated", "another", "server", "no-browser", "debug-server", "send", "account"];
+const knownFlags = ["verbose", "kill", "v", "version", "setup", "add", "test", "rebuild", "repair", "recover", "fix-flags", "relink-bodies", "log", "import", "email", "mail", "daemon", "reauth", "mailto", "register-mailto", "unregister-mailto", "allow-elevated", "another", "no-browser", "debug-server", "send", "account"];
 for (const arg of args) {
     // Strip a leading -/-- and any `=value` suffix before checking.
     const flag = arg.replace(/^--?/, "").split("=")[0];
@@ -507,7 +505,6 @@ for (const arg of args) {
         console.error("Usage: rmfmail [options]   (-- prefix also accepted for every flag)\n" +
             "  Launch:\n" +
             "    (no args)              Start daemon + open WebView (IPC, no TCP)\n" +
-            "    -server                Start Express HTTP server (dev/remote)\n" +
             "    -no-browser            Server mode without auto-opening a browser\n" +
             "    -another               Don't replace any existing rmfmail daemon\n" +
             "    -verbose               Echo logs to terminal (default: log file only)\n" +
@@ -1280,7 +1277,6 @@ if (hasFlag("v") || hasFlag("version")) {
     console.log(`  miscinfo  ${ver("@bobfrankston/miscinfo")}`);
     console.log(`  oauth     ${ver("@bobfrankston/oauthsupport")}`);
     console.log(`  store     ${ver("@bobfrankston/mailx-store")}`);
-    console.log(`  server    ${ver("@bobfrankston/mailx-server")}`);
     console.log(`  api       ${ver("@bobfrankston/mailx-api")}`);
     console.log(`  platform  ${process.platform} ${process.arch}`);
     process.exit(0);
@@ -1923,18 +1919,13 @@ RFC 5322 with CRLF line endings. Bodies are quoted-printable encoded (readable i
     catch (e) {
         console.error(`  [readme] Could not write sending README: ${e?.message || e}`);
     }
-    // `--server` mode — hand off to the Express HTTP server package (self-
-    // contained; initializes its own DB / IMAP manager / MailxService). No
-    // WebView2, no IPC bridge. Useful for remote access (phone before MAUI
-    // was a thing) and for JSON-RPC debugging from devtools. Loopback by
-    // default; passes --external through if the user asked for it. See C34.
-    if (hasFlag("server")) {
-        writeInstanceFile(process.pid);
-        await import("@bobfrankston/mailx-server");
-        // mailx-server's index.ts self-invokes `start()` — once imported,
-        // Express owns the event loop. Don't fall through to showService.
-        return;
-    }
+    // `--server` (Express HTTP browser mode) was REMOVED 2026-06-29. The client
+    // went IPC-only (everything through the msger `mailxapi` bridge; the old
+    // `fetch("/api/...")` path was deleted), and nothing injected a browser-side
+    // bridge — so the served page could no longer talk to the server and the
+    // mode was effectively dead. The Android app now covers the "use it from a
+    // phone" case it originally existed for. The `mailx-api` Express router lives
+    // on, used only by the optional `--debug-server` dev introspection endpoint.
     // Sync runs on its OWN thread now: spawn the sync worker (it hosts
     // ImapManager + its own write connection) and hand the main thread a proxy
     // that quacks like ImapManager (method calls forwarded over the bus,
@@ -1958,6 +1949,16 @@ RFC 5322 with CRLF line endings. Bodies are quoted-printable encoded (readable i
     void syncWorkerHandle;
     // Native client is the only option (iflow-direct)
     const svc = new MailxService(store, imapManager);
+    // Loopback popout-window server (lets the client window.open a message into
+    // its own OS window). Ephemeral port + per-launch token; best-effort.
+    let popoutInfo = null;
+    try {
+        const { startPopoutServer } = await import("./popout-server.js");
+        popoutInfo = await startPopoutServer(svc);
+    }
+    catch (e) {
+        console.error(`  [popout] disabled: ${e?.message || e}`);
+    }
     // Inject the popup function so MailxService.showReminderPopup can spawn
     // an OS-level always-on-top window via mailx-host. Kept as injection
     // (not import) so mailx-service stays host-agnostic.
@@ -2015,7 +2016,12 @@ RFC 5322 with CRLF line endings. Bodies are quoted-printable encoded (readable i
     // Open msger in service mode — custom protocol serves files from client dir
     const clientDir = path.join(import.meta.dirname, "..", "client");
     const mailxapiPath = path.join(clientDir, "lib", "mailxapi.js");
-    const mailxapiScript = fs.readFileSync(mailxapiPath, "utf-8");
+    let mailxapiScript = fs.readFileSync(mailxapiPath, "utf-8");
+    // Tell the client where the popout-window server lives (base URL + token) so
+    // the viewer's "open in separate window" can window.open it.
+    if (popoutInfo) {
+        mailxapiScript += `\nwindow.__rmfPopout=${JSON.stringify({ base: `http://127.0.0.1:${popoutInfo.port}`, token: popoutInfo.token })};`;
+    }
     // Restore saved window geometry (position + size) from previous session
     const windowJsonPath = path.join(getConfigDir(), "window.json");
     let savedGeometry = null;