imapflow 1.4.9 → 1.6.0

package/test/imap-flow-server-test.js

@@ -797,6 +797,8 @@ module.exports['Server: PREAUTH greeting skips login'] = async test => {
     await client.connect();
     test.equal(client.state, client.states.AUTHENTICATED);
     test.ok(client.usable);
+    // documented contract: `true` if the connection was authenticated by PREAUTH
+    test.strictEqual(client.authenticated, true);
 
     await client.logout();
     client.close();
@@ -845,6 +847,84 @@ module.exports['Server: unsolicited EXISTS and VANISHED reach the untagged handl
     test.done();
 };
 
+module.exports['Server: rev2-shaped SELECT response is tolerated through the full pipeline'] = async test => {
+    // RFC 9051 requires rev2 servers to include an untagged LIST in the SELECT
+    // response and a CLOSED response code when another mailbox was selected, and
+    // to omit RECENT/UNSEEN. The client must consume such a response cleanly.
+    let server = createServer({
+        capabilities: 'IMAP4rev2 ID ENABLE NAMESPACE',
+        handlers: {
+            SELECT(ctx) {
+                ctx.write('* OK [CLOSED] Previous mailbox closed\r\n');
+                ctx.write('* 3 EXISTS\r\n');
+                ctx.write('* LIST () "/" INBOX\r\n');
+                ctx.write('* FLAGS (\\Seen \\Answered \\Flagged \\Deleted \\Draft)\r\n');
+                ctx.write('* OK [PERMANENTFLAGS (\\Seen \\*)] Limited\r\n');
+                ctx.write('* OK [UIDVALIDITY 12345] UIDs valid\r\n');
+                ctx.write('* OK [UIDNEXT 100] Predicted next UID\r\n');
+                ctx.ok('[READ-WRITE] SELECT completed');
+            }
+        }
+    });
+    let port = await listen(server);
+    let client = makeClient(port);
+    let errors = [];
+    client.on('error', err => errors.push(err));
+
+    await client.connect();
+    test.ok(client.capabilities.has('IMAP4rev2'));
+
+    let mailbox = await client.mailboxOpen('INBOX');
+    test.equal(mailbox.path, 'INBOX');
+    test.equal(mailbox.exists, 3);
+    test.equal(mailbox.uidNext, 100);
+    test.equal(mailbox.uidValidity, 12345n);
+
+    // re-select drives the CLOSED response code through the live pipeline again
+    let again = await client.mailboxOpen('INBOX');
+    test.equal(again.exists, 3);
+    test.equal(errors.length, 0, 'no errors from the rev2-shaped response');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
+module.exports['Server: unsolicited STATUS for another mailbox is tolerated'] = async test => {
+    // RFC 9051 (Appendix E item 20): with rev2, servers may push updates that are
+    // unrelated to the selected mailbox (e.g. a STATUS for another mailbox during
+    // IDLE). The client must ignore them without corrupting the selected state.
+    let server = createServer({
+        handlers: {
+            NOOP(ctx) {
+                ctx.write('* STATUS "Other" (MESSAGES 5 UNSEEN 1)\r\n');
+                ctx.ok('NOOP completed');
+            }
+        }
+    });
+    let port = await listen(server);
+    let client = makeClient(port);
+    let errors = [];
+    client.on('error', err => errors.push(err));
+
+    await client.connect();
+    await client.mailboxOpen('INBOX');
+    test.equal(client.mailbox.exists, 3);
+
+    await client.noop();
+    await new Promise(r => setTimeout(r, 20));
+
+    test.equal(client.mailbox.path, 'INBOX', 'selected mailbox unchanged');
+    test.equal(client.mailbox.exists, 3, 'selected mailbox message count unchanged');
+    test.equal(errors.length, 0, 'unsolicited STATUS must not raise errors');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
 module.exports['Server: invalid tagged response rejects with InvalidResponse'] = async test => {
     let server = createServer({
         handlers: {
@@ -1023,6 +1103,155 @@ module.exports['Server: proxy connection failure rejects connect'] = async test
     test.done();
 };
 
+module.exports['Server: close clears public session state'] = async test => {
+    // Callers inspect these properties in reconnect logic, so they must not keep describing a
+    // session that is gone.
+    let server = createServer();
+    let port = await listen(server);
+    let client = makeClient(port);
+    client.on('error', () => {});
+
+    let events = [];
+    client.on('mailboxClose', mailbox => events.push({ event: 'mailboxClose', path: mailbox.path }));
+    client.on('close', () => events.push({ event: 'close' }));
+
+    await client.connect();
+    await client.mailboxOpen('INBOX');
+
+    test.ok(client.mailbox, 'a mailbox is selected');
+    test.ok(client.authenticated, 'the session is authenticated');
+    test.ok(client.currentSelectCommand, 'the select command is remembered for polling');
+
+    client.close();
+
+    test.equal(client.mailbox, false, 'mailbox state cleared');
+    test.equal(client.currentSelectCommand, false, 'saved select command cleared');
+    test.equal(client.authenticated, false, 'authentication state cleared');
+    test.equal(client.preCheck, false, 'preCheck cleared');
+    test.equal(client.usable, false, 'connection no longer usable');
+    test.equal(client.idling, false, 'idling cleared');
+    test.equal(client.state, client.states.LOGOUT, 'state is LOGOUT');
+
+    // The selected mailbox transitions to closed exactly once, before 'close'
+    test.deepEqual(events, [{ event: 'mailboxClose', path: 'INBOX' }, { event: 'close' }], 'mailboxClose is emitted once, ahead of close');
+
+    // Repeated close() is idempotent and emits nothing more
+    client.close();
+    client.close();
+    test.equal(events.length, 2, 'no duplicate events from repeated close()');
+
+    server.close();
+    test.done();
+};
+
+module.exports['Server: close without a selected mailbox emits no mailboxClose'] = async test => {
+    let server = createServer();
+    let port = await listen(server);
+    let client = makeClient(port);
+    client.on('error', () => {});
+
+    let mailboxCloseCount = 0;
+    client.on('mailboxClose', () => mailboxCloseCount++);
+
+    await client.connect();
+    client.close();
+
+    test.equal(mailboxCloseCount, 0, 'nothing to close, nothing emitted');
+    server.close();
+    test.done();
+};
+
+module.exports['Server: GETQUOTA fallback releases the parser'] = async test => {
+    // Regression: the GETQUOTA fallback never handed its response back to the reader, so the
+    // parser stayed blocked on its backpressure callback and every later command hung.
+    let server = createServer({
+        capabilities: 'IMAP4rev1 ID ENABLE NAMESPACE QUOTA',
+        handlers: {
+            GETQUOTAROOT(ctx) {
+                // root only, no inline QUOTA response - forces the fallback command
+                ctx.write('* QUOTAROOT "INBOX" "userquota"\r\n');
+                ctx.ok('GETQUOTAROOT completed');
+            },
+            GETQUOTA(ctx) {
+                ctx.write('* QUOTA "userquota" (STORAGE 512 1024)\r\n');
+                ctx.ok('GETQUOTA completed');
+            }
+        }
+    });
+    let port = await listen(server);
+    let client = makeClient(port);
+    client.on('error', () => {});
+
+    await client.connect();
+
+    let quota = await client.getQuota();
+    test.ok(quota, 'quota resolved');
+    test.equal(quota.quotaRoot, 'userquota', 'quota root from the first command');
+    test.equal(quota.storage.usage, 512 * 1024, 'quota usage from the fallback command');
+
+    // The parser must still be live: a following command has to complete.
+    let noopResponse = await client.exec('NOOP', false, {});
+    noopResponse.next();
+    test.ok(noopResponse.response, 'the connection still processes commands after the fallback');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
+module.exports['Server: oversized literal cannot inject protocol'] = async test => {
+    // Response-injection regression. With a lowered maxLiteralSize the parser rejects the
+    // literal, and everything after the marker line is ordinary message content chosen by a
+    // third party. None of it may be parsed: no untagged handler may fire and the forged
+    // tagged completion may not settle the in-flight request.
+    let server = createServer({
+        handlers: {
+            NOOP(ctx) {
+                ctx.write(
+                    `* 1 FETCH (BODY[] {5000}\r\n` + //
+                        `INNOCENT MESSAGE TEXT\r\n` +
+                        `* 9999 EXISTS\r\n` +
+                        `${ctx.tag} OK forged completion\r\n`
+                );
+            }
+        }
+    });
+    let port = await listen(server);
+    let client = makeClient(port, { maxLiteralSize: 1024 });
+
+    let errors = [];
+    let existsEvents = [];
+    client.on('error', err => errors.push(err));
+    client.on('exists', ev => existsEvents.push(ev));
+
+    await client.connect();
+    let mailbox = await client.mailboxOpen('INBOX');
+    test.equal(mailbox.exists, 3, 'mailbox opened with the server reported count');
+
+    let noopErr = null;
+    try {
+        // exec() surfaces the raw command outcome, so a forged tagged completion would show
+        // up here as a resolved request (client.noop() would swallow it into `false`).
+        await client.exec('NOOP', false, {});
+        test.ok(false, 'the forged tagged completion must not resolve the in-flight command');
+    } catch (err) {
+        noopErr = err;
+    }
+
+    test.ok(noopErr, 'the in-flight command rejected instead of accepting injected content');
+    test.deepEqual(existsEvents, [], 'the injected untagged EXISTS never reached an untagged handler');
+    test.ok(
+        errors.some(err => err.code === 'LiteralTooLarge'),
+        'the limit violation is surfaced to the caller'
+    );
+    test.ok(client.isClosed || !client.usable, 'the connection failed closed');
+
+    client.close();
+    server.close();
+    test.done();
+};
+
 module.exports['Server: socket close triggers close handling'] = async test => {
     let server = createServer();
     let port = await listen(server);

package/test/imap-parser-test.js

@@ -435,6 +435,115 @@ module.exports['IMAP Parser: Literals: allow zero length literal in the end of a
         ])
     );
 
+module.exports['IMAP Parser: Literals: zero length literal keeps the literal queue aligned'] = test =>
+    asyncWrapper(test, async test =>
+        // ImapStream queues a Buffer for every literal marker it extracts, including
+        // {0}, so the parser must consume exactly one queue entry per marker.
+        // Otherwise every literal after a {0} in the same response is silently
+        // shifted to the wrong value (RFC 9051 4.3 allows {0} as an empty string).
+        test.deepEqual((await parser('TAG1 CMD ({0}\r\n {5}\r\n)', { literals: [Buffer.from(''), Buffer.from('hello')] })).attributes, [
+            [
+                {
+                    type: 'LITERAL',
+                    value: Buffer.from('')
+                },
+                {
+                    type: 'LITERAL',
+                    value: Buffer.from('hello')
+                }
+            ]
+        ])
+    );
+
+module.exports['IMAP Parser: Literals: zero length literal between literals keeps values aligned'] = test =>
+    asyncWrapper(test, async test =>
+        test.deepEqual(
+            (await parser('TAG1 CMD ({3}\r\n {0}\r\n {5}\r\n)', { literals: [Buffer.from('abc'), Buffer.from(''), Buffer.from('world')] })).attributes,
+            [
+                [
+                    {
+                        type: 'LITERAL',
+                        value: Buffer.from('abc')
+                    },
+                    {
+                        type: 'LITERAL',
+                        value: Buffer.from('')
+                    },
+                    {
+                        type: 'LITERAL',
+                        value: Buffer.from('world')
+                    }
+                ]
+            ]
+        )
+    );
+
+// RFC 9051 updated resp-text to allow empty text: resp-text = ["[" resp-text-code "]" SP] [text]
+module.exports['IMAP Parser: resp-text: bare OK with no text'] = test =>
+    asyncWrapper(test, async test => test.deepEqual(await parser('* OK'), { tag: '*', command: 'OK' }));
+
+module.exports['IMAP Parser: resp-text: tagged OK with no text'] = test =>
+    asyncWrapper(test, async test => test.deepEqual(await parser('TAG1 OK'), { tag: 'TAG1', command: 'OK' }));
+
+module.exports['IMAP Parser: resp-text: response code with no trailing text'] = test =>
+    asyncWrapper(test, async test => {
+        let parsed = await parser('* OK [UIDNEXT 5]');
+        test.equal(parsed.command, 'OK');
+        test.deepEqual(parsed.attributes, [
+            {
+                type: 'ATOM',
+                value: '',
+                section: [
+                    { type: 'ATOM', value: 'UIDNEXT' },
+                    { type: 'ATOM', value: '5' }
+                ]
+            }
+        ]);
+    });
+
+module.exports['IMAP Parser: resp-text: response code with trailing space and no text'] = test =>
+    asyncWrapper(test, async test => {
+        let parsed = await parser('* OK [READ-WRITE] ');
+        test.equal(parsed.command, 'OK');
+        test.deepEqual(parsed.attributes, [
+            {
+                type: 'ATOM',
+                value: '',
+                section: [{ type: 'ATOM', value: 'READ-WRITE' }]
+            }
+        ]);
+    });
+
+// RFC 9051 uses number64 (up to 2^63-1) for message and body sizes - values beyond
+// 2^32 must survive the tokenizer without truncation
+module.exports['IMAP Parser: number64: RFC822.SIZE beyond 32 bits'] = test =>
+    asyncWrapper(test, async test => {
+        let parsed = await parser('* 1 FETCH (RFC822.SIZE 12345678901234)');
+        test.deepEqual(parsed.attributes, [
+            { type: 'ATOM', value: 'FETCH' },
+            [
+                { type: 'ATOM', value: 'RFC822.SIZE' },
+                { type: 'ATOM', value: '12345678901234' }
+            ]
+        ]);
+    });
+
+module.exports['IMAP Parser: number64: response code argument beyond 32 bits'] = test =>
+    asyncWrapper(test, async test => {
+        let parsed = await parser('* OK [HIGHESTMODSEQ 90060115194045007] Ok');
+        test.deepEqual(parsed.attributes, [
+            {
+                type: 'ATOM',
+                value: '',
+                section: [
+                    { type: 'ATOM', value: 'HIGHESTMODSEQ' },
+                    { type: 'ATOM', value: '90060115194045007' }
+                ]
+            },
+            { type: 'TEXT', value: 'Ok' }
+        ]);
+    });
+
 module.exports['IMAP Parser: Section: empty'] = test =>
     asyncWrapper(test, async test =>
         test.deepEqual((await parser('TAG1 CMD BODY[]')).attributes, [
@@ -1284,7 +1393,9 @@ module.exports['IMAP Parser, FETCH with BODYSTRUCTURE'] = test =>
         ]);
     });
 
-module.exports['IMAP Parser, FETCH with BODYSTRUCTURE'] = test =>
+// NB! must not share a name with the deep-BODYSTRUCTURE test above - a duplicate
+// module.exports key silently overwrites the earlier test and it never runs
+module.exports['IMAP Parser, FETCH exceeding max nesting depth'] = test =>
     asyncWrapper(test, async test => {
         try {
             let parsed = await parser('* 1 FETCH (UID 1 (((((((((((((((((((((((((');

package/test/imap-stream-test.js

@@ -66,6 +66,52 @@ A LOGOUT
     writer().catch(err => test.ifError(err));
 };
 
+module.exports['Literal8 marker activates literal extraction'] = test => {
+    // RFC 9051 folds the FETCH side of BINARY into base IMAP4rev2 - servers answer
+    // BINARY fetches with literal8 syntax (~{n}) whose content may contain NULs.
+    // The stream must treat the trailing {n} as a literal marker regardless of the
+    // '~' prefix and hand the raw bytes over unmodified.
+    let input = Buffer.from('* 1 FETCH (BINARY[1] ~{5}\r\nhel\x00o)\r\n', 'binary');
+
+    let stream = new ImapStream();
+
+    let reading = false;
+    let reader = async () => {
+        let cmd;
+        while ((cmd = stream.read()) !== null) {
+            test.equal(cmd.payload.toString('binary'), '* 1 FETCH (BINARY[1] ~{5}\r\n)');
+            test.equal(cmd.literals.length, 1);
+            test.deepEqual(cmd.literals[0], Buffer.from('hel\x00o', 'binary'));
+
+            // and the parser consumes the literal8 into a LITERAL node with the NUL intact
+            let parsed = await parser(cmd.payload, { literals: cmd.literals });
+            test.deepEqual(parsed.attributes[1][1], { type: 'LITERAL', value: Buffer.from('hel\x00o', 'binary') });
+            cmd.next();
+        }
+    };
+
+    stream.on('readable', () => {
+        if (!reading) {
+            reading = true;
+            reader()
+                .catch(err => test.ifError(err))
+                .finally(() => {
+                    reading = false;
+                });
+        }
+    });
+
+    stream.on('error', err => {
+        test.ifError(err);
+    });
+
+    stream.on('end', () => {
+        test.done();
+    });
+
+    stream.end(input);
+};
+
 module.exports['Single byte'] = test => {
     let input = Buffer.from(
         `A CAPABILITY

package/test/integration/README.md

@@ -3,8 +3,11 @@
 Runs the ImapFlow client against a real IMAP4rev2 server - Dovecot 2.4+ in
 Docker - instead of protocol mocks. Covers the ENABLE IMAP4rev2 negotiation,
 LIST RETURN (SUBSCRIBED) without LSUB, subscription round-trips, UTF-8 mailbox
-names, inline LIST-STATUS, ESEARCH responses to plain SEARCH, and a message
-lifecycle smoke test with UID EXPUNGE.
+names, inline LIST-STATUS (including the rev2 SIZE and DELETED status items),
+ESEARCH responses to plain SEARCH, STATUS SIZE/DELETED, the rev2-shaped SELECT
+response (untagged LIST, CLOSED on re-select), the folded-in FETCH BINARY,
+COPYUID from the untagged OK on MOVE, and a message lifecycle smoke test with
+UID EXPUNGE.
 
 ## Running
 
@@ -18,8 +21,16 @@ on `127.0.0.1:31143`, runs `rev2-live-test.js` with nodeunit, and always
 removes the container afterwards.
 
 These tests are intentionally not part of `npm test` - the Gruntfile nodeunit
-config excludes `test/integration/**`, so CI and plain test runs stay
-Docker-free.
+config excludes `test/integration/**`, so plain test runs stay Docker-free.
+CI runs this suite in a dedicated `test-rev2` job on `ubuntu-latest` (amd64
+with Docker preinstalled), forcing `IMAPFLOW_DOVECOT_PLATFORM=linux/amd64` -
+that job is the authoritative linux/amd64 run, since Apple Silicon machines
+cannot execute the amd64 image (see below).
+
+If a local image for the configured tag exists but was pulled for a different
+architecture than the Docker host (e.g. an amd64 image left behind on an arm64
+host), the runner script detects the mismatch and re-pulls the host-native
+variant before starting the container.
 
 ## Environment overrides
 
@@ -28,7 +39,8 @@ Docker-free.
 - `IMAPFLOW_DOVECOT_PLATFORM` - e.g. `linux/amd64`; defaults to the host
   platform. Forcing `linux/amd64` on Apple Silicon does not work - Rosetta
   cannot start Dovecot's privilege-separated login processes
-  (`rosetta error: mmap_anonymous_rw mmap failed`)
+  (`rosetta error: mmap_anonymous_rw mmap failed`; reconfirmed with
+  dovecot/dovecot:2.4.4 in July 2026)
 - `IMAPFLOW_TEST_PORT` - host port to publish (default 31143)
 
 ## Test account model

package/test/integration/rev2-live-test.js

@@ -207,6 +207,131 @@ module.exports['Live rev2: returnOptions search is answered via a real ESEARCH r
     test.done();
 };
 
+module.exports['Live rev2: STATUS reports SIZE and DELETED'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        const raw = Buffer.from('Subject: sized\r\n\r\nsized body\r\n');
+        await client.append('INBOX', raw, ['\\Deleted']);
+        await client.append('INBOX', Buffer.from('Subject: kept\r\n\r\nkept body\r\n'));
+
+        const status = await client.status('INBOX', { messages: true, size: true, deleted: true });
+
+        test.ok(clientSent(logs, 'SIZE'), 'STATUS should request SIZE');
+        test.ok(clientSent(logs, 'DELETED'), 'STATUS should request DELETED');
+        test.equal(status.messages, 2);
+        test.equal(status.deleted, 1, 'one message carries the \\Deleted flag');
+        test.ok(Number.isSafeInteger(status.size) && status.size >= raw.length, 'mailbox size should cover at least the first appended message');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: statusQuery returns SIZE and DELETED inline via LIST-STATUS'] = async test => {
+    const client = await connectClient();
+    try {
+        await client.append('INBOX', Buffer.from('Subject: probe\r\n\r\nprobe body\r\n'), ['\\Deleted']);
+
+        const folders = await client.list({ statusQuery: { messages: true, size: true, deleted: true } });
+        const inbox = folders.find(folder => folder.path === 'INBOX');
+        test.equal(inbox.status.messages, 1);
+        test.equal(inbox.status.deleted, 1);
+        test.ok(Number.isSafeInteger(inbox.status.size) && inbox.status.size > 0);
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: SELECT response carries an untagged LIST and re-select gets CLOSED'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        await client.mailboxCreate('Closer');
+        const mailbox = await client.mailboxOpen('INBOX');
+        test.equal(mailbox.path, 'INBOX');
+
+        // RFC 9051 6.3.1: the SELECT response includes an untagged LIST for the
+        // selected mailbox - the client must consume it without issue
+        test.ok(serverSentUntagged(logs, 'LIST'), 'rev2 SELECT should include an untagged LIST response');
+
+        // switching mailboxes must produce a CLOSED response code for the old one
+        await client.mailboxOpen('Closer');
+        const closed = wireLines(logs).some(entry => entry.src === 's' && entry.msg.includes('[CLOSED]'));
+        test.ok(closed, 're-select should carry a CLOSED response code');
+        test.equal(client.mailbox.path, 'Closer', 'client state should track the newly selected mailbox');
+
+        await client.mailboxClose();
+        await client.mailboxDelete('Closer');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: binary fetch uses the folded-in FETCH BINARY'] = async test => {
+    const logs = [];
+    const client = await connectClient(null, logs);
+    try {
+        // BINARY sections only allow numeric part specifiers, so use a multipart
+        // message - part "1" of a single-part message would resolve to the TEXT
+        // section, which must stay a BODY fetch. The base64 encoding gives the
+        // server-side BINARY decoding something to undo.
+        const content = [
+            'Subject: bin',
+            'MIME-Version: 1.0',
+            'Content-Type: multipart/mixed; boundary=bb',
+            '',
+            '--bb',
+            'Content-Type: text/plain',
+            'Content-Transfer-Encoding: base64',
+            '',
+            Buffer.from('binary body').toString('base64'),
+            '--bb--',
+            ''
+        ].join('\r\n');
+        await client.append('INBOX', Buffer.from(content));
+
+        await client.mailboxOpen('INBOX');
+        const { content: downloadStream } = await client.download('1', '1', { binary: true });
+        const chunks = [];
+        for await (let chunk of downloadStream) {
+            chunks.push(chunk);
+        }
+
+        test.ok(clientSent(logs, 'BINARY.PEEK[1]'), 'client should issue a BINARY fetch for the numeric part on a rev2 session');
+        test.equal(Buffer.concat(chunks).toString().trim(), 'binary body', 'BINARY fetch should return the decoded content');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
+module.exports['Live rev2: MOVE reports COPYUID from the untagged OK'] = async test => {
+    const client = await connectClient();
+    try {
+        await client.append('INBOX', Buffer.from('Subject: mover\r\n\r\nmover body\r\n'));
+        await client.mailboxCreate('Moved');
+
+        await client.mailboxOpen('INBOX');
+        const result = await client.messageMove('1', 'Moved');
+
+        // RFC 9051 6.4.8: the server is REQUIRED to send COPYUID in an untagged OK
+        // before the EXPUNGEs - verify the client captured it
+        test.ok(result, 'move should succeed');
+        test.equal(result.path, 'INBOX');
+        test.equal(result.destination, 'Moved');
+        test.ok(result.uidMap && result.uidMap.size === 1, 'COPYUID must be captured from the untagged OK');
+
+        await client.mailboxClose();
+        await client.mailboxDelete('Moved');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
 module.exports['Live rev2: message lifecycle smoke test'] = async test => {
     const client = await connectClient();
     try {

package/test/integration/run-rev2-tests.sh

@@ -30,6 +30,20 @@ cleanup() {
 trap cleanup EXIT
 cleanup
 
+# Guard against a stale image cached for the wrong architecture: `docker run`
+# without --platform silently reuses a local image even when its architecture
+# does not match the host (e.g. an amd64 image left behind on an arm64 host),
+# and Dovecot then fails to start with confusing emulation errors. Only applies
+# when no explicit platform override was requested.
+if [ -z "${IMAPFLOW_DOVECOT_PLATFORM:-}" ] && docker image inspect "$IMAGE" >/dev/null 2>&1; then
+    image_arch="$(docker image inspect --format '{{.Architecture}}' "$IMAGE" 2>/dev/null || true)"
+    host_arch="$(docker version --format '{{.Server.Arch}}' 2>/dev/null || true)"
+    if [ -n "$image_arch" ] && [ -n "$host_arch" ] && [ "$image_arch" != "$host_arch" ]; then
+        echo "Local $IMAGE image is $image_arch but the Docker host is $host_arch - re-pulling for linux/$host_arch..."
+        docker pull --platform "linux/$host_arch" "$IMAGE"
+    fi
+fi
+
 docker run ${PLATFORM_ARG:+"$PLATFORM_ARG"} -d --name "$CONTAINER_NAME" \
     -e USER_PASSWORD=pass \
     -v "$SCRIPT_DIR/dovecot-test.conf:/etc/dovecot/conf.d/99-imapflow-test.conf:ro" \