Merge branch 'dev'

Author: sspaeti

AGENTS.md

@@ -0,0 +1,187 @@
+# AGENTS.md — Feature Invariants
+
+This file lists the key **user-visible behaviors that must not break**. It exists because
+subtle regressions have slipped in before (e.g. the `·` reply indicator silently broke when
+reply detection was refactored — see CHANGELOG 2026-07-09).
+
+**How to use this file (for AI agents and humans):**
+
+1. **Before changing code**, scan the section(s) that touch your area and keep those
+   invariants intact.
+2. **After changing code**, re-scan the same section(s) and confirm each invariant still
+   holds — run the pinning test if one is listed (`go test ./internal/... -run TestName`).
+3. **When adding a feature**, add its invariant here (one bullet: behavior, code anchor,
+   pinning test).
+4. **At the end of every user-visible change, add a `CHANGELOG.md` entry** (dated heading,
+   bold title, what/why/where, test name).
+
+Build commands, architecture, and API quirks live in `CLAUDE.md`. Feature docs live in
+`README.md` and `docs/content/docs/`. This file is only the "do not break" list.
+
+---
+
+## Reply & Threading
+
+- **`·` reply indicator** — after sending a reply, the original email gets the IMAP
+  `\Answered` flag (`MarkAnswered` in `internal/imap/client.go`, called from `sendEmailCmd`
+  in `internal/ui/model.go`) and the inbox shows `·` (or `·╰` inside a thread,
+  `internal/ui/inbox.go`). The local flag also updates immediately on `sendDoneMsg` without
+  a refetch. Tests: `TestSendDoneMsgUpdatesAnsweredFlag`, `TestReplyIndicatorWithThread`.
+- **Reply tracking survives pre-send round-trips** — `pendingIsReply` is *session-scoped*:
+  re-edit (`e`), spell check (`s`), AI handoff (`i`), and CC/BCC edit (`ctrl+b`) from
+  pre-send must all preserve `replyToUID`/`replyToFolder` and the `In-Reply-To`/`References`
+  headers. The flag is cleared only when the compose session ends (send, discard, editor
+  abort/error/empty, new compose/forward). Test: `TestEditorDoneReplyTrackingSurvivesReEdit`.
+- **Threading headers on every reply-ish send** — regular replies, emoji reactions
+  (`ctrl+e`), and iCalendar RSVPs all set `In-Reply-To` + `References` so conversations
+  thread in Gmail/Outlook/Apple Mail. Tests: `TestBuildReactionMessage_ThreadingHeaders`,
+  `TestBuildRSVPMessage_ThreadingHeadersBracketed`.
+- **Reply prefix handling** — `Re:` is prepended only when the subject doesn't already
+  start with `re:`/`aw:`/`sv:`/`vs:` (case-insensitive); localized prefixes are treated as
+  replies, never double-prefixed. Test: `TestHasReplyPrefix`.
+- **Reply From auto-selection** — replying picks the From address matching the email's
+  To/CC; in the Sent folder the user's own address is in `From` instead
+  (`matchFromForReply`, `internal/ui/model.go`).
+- **Reply-all excludes all own addresses** — both IMAP login addresses (`account.User`)
+  and send-as addresses (accounts + `[[senders]]` aliases) are stripped from CC. Test:
+  `TestReplyAllExcludesAllOwnAddresses`.
+- **Threaded inbox rendering** — threads grouped via `In-Reply-To`/`Message-ID` with
+  subject+participant fallback, `│`/`╰` connectors, newest on top; the Sent folder is
+  intentionally **not** threaded. Tests: `TestNormalizeSubject`, `TestParticipantMatch`.
+
+## Compose → Pre-send → Send Pipeline
+
+- **Pre-send round-trip preservation** — every path that re-opens the editor or returns to
+  pre-send (`e`, `s`, `i`, `ctrl+b`, draft continue, `:recover`) must preserve: body,
+  attachments (re-injected as `# [attach]` lines — editor body is source of truth),
+  Bcc, selected From, and reply tracking (see above). History: CHANGELOG 2026-04-08,
+  2026-05-06, 2026-07-02, 2026-07-09 — this area regresses easily.
+- **MIME structure by content** (`BuildMessage` in `internal/smtp/sender.go`):
+  no attachments → `multipart/alternative`; file attachments → `mixed > alternative`;
+  inline images → `related > (alternative + image parts with Content-ID)`; both →
+  `mixed > (related > alt+images) + file parts`. Tests: `TestBuildMessage*`.
+- **Inline images** — local `<img src="/abs/path">` rewritten to `cid:`; paths with spaces
+  use the `![](<path>)` angle-bracket form and URL-decoding before file read; remote
+  `https://` images (HTML signatures) are fetched (10 s timeout) and embedded as `cid:`,
+  falling back to the URL on fetch failure. Tests: `TestBuildMessage_WithInlineImage`,
+  `TestBuildMessage_InlineImagePathWithSpaces`.
+- **`[attach]` markers are visible plain text** — `# [attach] /path` (header form) and
+  `[attach] /path` (inline form), never HTML comments (treesitter hides them in nvim).
+  Only regular files are accepted (`filterValidAttachments`); skipped paths are surfaced
+  in the status bar. Test: `TestFilterValidAttachments`.
+- **BCC privacy** — Bcc is excluded from message headers but included in SMTP `RCPT TO`;
+  comma-separated recipients are split into individual RCPT commands; `auto_bcc` is
+  deduped and visible (never silent). Test: `TestCollectRcptTo`.
+- **RFC compliance** — Message-ID uses the sender's domain (never `@neomd`/`@localhost`);
+  quoted-printable encodes trailing whitespace before CRLF (`=20`) so Markdown two-space
+  hard breaks survive SMTP relays; text/plain part comes before text/html.
+- **Signatures** — per-account `[accounts.signature_block]` overrides the global block
+  all-or-nothing via `Config.Signature(account)`; text signature goes to editor + plain
+  part, HTML signature to HTML part only; `[html-signature]` placeholder controls
+  inclusion per-email and is extracted right before send. Test: `TestSignature`.
+- **Drafts** — saved as plain text only (multipart caused round-trip corruption), keep
+  `Bcc`; every compose session is backed up to `~/.cache/neomd/drafts/` (`:recover`);
+  discarding unsent mail always asks y/n confirmation.
+- **Callouts** — `> [!note]` / `> [!tip]` / `> [!warning]` (with or without space after
+  `>`) render as styled boxes in the HTML part and as emoji text (no blockquote markers)
+  in the plain part. Tests: `TestToHTML_Callout_*`, `TestFormatCalloutsForPlainText_*`.
+- **Listmonk interception** — sending to a configured trigger address creates a scheduled
+  Listmonk campaign instead of SMTP delivery; pre-send shows list IDs + template + delay.
+  Tests: `TestResolveListIDs`, `TestResolveTemplateID`.
+- **From cycling (`ctrl+f`)** — SMTP credentials, Sent-folder destination, and From header
+  must all follow the selected identity (accounts first, then `[[senders]]` aliases).
+  Tests: `TestPresendSMTPAccount`, `TestReactionAutoSelectsCorrectFromAndSMTP`,
+  `TestSentDraftsIMAPClient_*`.
+
+## Screener (HEY-style)
+
+- **Priority order** — spam > screened_out > feed > papertrail > screened_in; per-address
+  entries always beat `@domain` entries. Tests: `TestClassify`, `TestClassifyForScreen`.
+- **Reclassification is atomic** — classifying removes the address from ALL conflicting
+  lists (snapshot/rollback on failure, both files and moved emails). Test:
+  `TestCrossListCleanup_Reclassification`.
+- **Empty lists pause screening** — TUI and headless daemon both skip auto-screening until
+  the first sender is classified (prevents sweeping a fresh inbox to ToScreen). Test:
+  `TestScreenInbox_EmptyScreenerLists`.
+- **Screener destinations may never be Trash** — refuses to run otherwise. Test:
+  `TestValidateScreenerSafetyRejectsTrashDestination`.
+- **ToScreen sender-level classify** — acting on one unmarked message applies to all
+  queued mail from that sender.
+- **Lists are line-based with `#` comments** (full-line and inline); daemon only reads
+  lists and moves mail, never writes classifications.
+
+## Inbox Display
+
+- **Rows never overflow the terminal width** — complex scripts (Bengali/Arabic/Thai/emoji)
+  collapse to `·` for display only; CJK passes through (East Asian Wide is deterministic);
+  the original subject is never mutated (reply/forward/thread logic uses the real RFC
+  subject). Tests: `TestRowFitsTerminalWidth`, `TestDisplaySafe`.
+- **Indicator columns** — unread, `·` replied, `°` spy pixel, `│`/`╰` thread connectors.
+- **Undo (`u`)** — reverses the last move/delete using UIDPLUS destination UIDs captured
+  on move; batch operations preserve partial-undo info on failure. Integration test:
+  `TestIntegration_IMAPMoveAndUndo`.
+
+## Reading & Security
+
+- **Spy pixels blocked** — two layers: curated denylist with attribution
+  (`internal/imap/tracker_list.go`) + generic 1×1 heuristic; glamour never fetches remote
+  resources; results cached in `~/.cache/neomd/spy_pixels` (`+key` spy / `-key` clean).
+  Tests: `TestSpyPixelDetection`, `TestSpyPixelSpacersNotFlagged`.
+- **Browser view (`O`) injects CSP** — `script-src 'none'; frame-src 'none';
+  object-src 'none'`; remote images intentionally allowed there. Test:
+  `TestIntegration_BrowserSanitization`.
+- **Link opening whitelist** — only `http://`, `https://`, `mailto:` schemes. Test:
+  `TestURLSchemeValidation`.
+- **Attachment open safety** — executable extensions are saved but never auto-opened;
+  magic-byte mismatch detection (`http.DetectContentType`) blocks disguised files;
+  sender-supplied filenames are sanitized against path traversal (`..`, separators) in
+  every write path (downloads, `.ics`, `cid:` temp files).
+- **Timer-based mark-as-read** — opening an email marks `\Seen` only after
+  `mark_as_read_after_secs` (default 7 s); quick peeks stay unread; reply/forward marks
+  immediately.
+
+## IMAP & Runtime Resilience
+
+- **Retry policy** — `withConnRetry` (one retry) only for read-only ops (FETCH/SEARCH/
+  STATUS); mutating ops (MOVE/APPEND/STORE) use `withConn`, never retried (duplicate-mail
+  risk). NOOP health probe after 2+ min idle handles suspend/resume.
+- **`safeGo` everywhere** — background goroutines must use `safeGo()` (panic → 
+  `~/.cache/neomd/crash.log`), never bare `go func()`. Maps passed to goroutines are
+  snapshotted on the main goroutine first (spy-pixel cache race, CHANGELOG 2026-05-08).
+- **Nothing blocks the bubbletea Update loop** — notifications have a 2 s timeout, no DNS
+  lookups in the send path, background sync never tight-loops on error. Test:
+  `TestSend_TimeoutCannotBlockTUI`.
+- **`imap_disabled = true` accounts produce nil clients by design** — every helper that
+  resolves an IMAP client must skip nil entries (send, Sent-copy, `\Answered`, `:debug`,
+  headless). Tests: `internal/ui/imap_client_helpers_test.go`.
+
+## Notifications & Theming
+
+- **Desktop notifications are VIP-only and TUI-only** — fire solely for senders/domains in
+  `notify.txt` (independent of screener categories); the headless daemon never notifies;
+  first run records a UID baseline (state key uses the IMAP folder name, not the UI label)
+  so enabling never floods; `[notifications].folders` allowlist matches via `LabelFor()`.
+  Tests: `TestMaybeNotify_*`, `TestShouldNotify`.
+- **Default theme never drifts** — `kanagawa` must stay byte-for-byte identical to the
+  pre-theming palette; `[theme]` overrides merge on top of any built-in. Tests:
+  `TestKanagawaDefault`, theme override/fallback tests.
+
+## Config & Credentials
+
+- **Config validation on load** — host:port format, port 1–65535, required fields;
+  `$VAR`/`${VAR}` expansion in `user`/`password`. Tests: `TestValidate*`, `TestExpandEnv`.
+- **`password = "keyring"` sentinel** — resolved in `config.Load()` so IMAP, SMTP, and
+  `[[senders]]` aliases all see it; preserved with a warning if the keyring is unavailable.
+  Test: `TestUseKeyring`.
+- **Secrets never leak** — token files/dirs written with restrictive permissions; error
+  messages never include tokens/passwords. Tests: `TestTokenErrors_NoTokenLeak`,
+  `TestSaveToken_FilePermissions`.
+
+## Keybindings & Docs
+
+- **`internal/ui/keys.go` is the single source of truth** — drives the `?` overlay and the
+  generated `docs/keybindings.md` (`make docs`, runs in `make build`). Never hand-edit the
+  markdown tables.
+- **Avoid modifier keys for new bindings** — user's tmux prefix is `C-t`; `ctrl+a`/`ctrl+e`
+  collide with textinput line-start/end. Prefer plain letters, especially on pre-send.
+- **README.md syncs to the docs site** (`scripts/sync-readme-to-docs.sh` via `make docs`).

CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+# 2026-07-09
+
+- **Fix: `·` reply indicator lost after pre-send round-trips** — the 2026-07-06 reply-detection change made reply tracking a one-shot flag that was consumed (and cleared) on the first editor exit. Re-entering the editor from pre-send — `e` (re-edit), `s` (spell check), or `i` (AI handoff) — fired a second `editorDoneMsg` with the flag already false and rebuilt `pendingSend` from scratch, silently dropping `replyToUID`/`replyToFolder` **and** the `In-Reply-To`/`References` threading headers. Result: the original email was never marked `\Answered` (no `·` dot in the inbox, in neomd or any other client) and the reply didn't thread in the recipient's mail client. `pendingIsReply` is now session-scoped: it survives every editor round-trip and is cleared only when the compose session actually ends — send, discard confirm (`y`), editor abort/error/empty body, or launching a new compose/forward. Regression test `TestEditorDoneReplyTrackingSurvivesReEdit` simulates two consecutive editor exits and asserts `replyToUID` + `In-Reply-To` survive the second one
+- **`AGENTS.md` feature-invariant checklist** — new repo-root file listing the key user-visible behaviors that must not break (reply dot, threading headers, MIME shapes, screener priority order, pre-send round-trip guarantees, security checks, …), each with code anchors and the test that pins it. Written for AI-assisted development: scan it before changing related code, re-scan after, and add an entry when shipping a new feature. `CLAUDE.md` now points to it and requires a `CHANGELOG.md` entry at the end of every user-visible change
+
+# 2026-07-06
+
+- **Fix: replies to `AW:` / `SV:` / `VS:` / uppercase-`RE:` subjects now get `\Answered` tracking** — reply detection used to sniff the composed subject for a lowercase-normalized `re:` prefix at editor exit; replying to a German `AW:`, Swedish/Danish `SV:`, or Finnish `VS:` thread produced a subject that never matched, so the original was not marked `\Answered` and the threading headers were skipped. Replaced subject sniffing with an explicit `pendingIsReply` flag set when `r`/`ctrl+r` launches the reply editor (forwards and new mail never set it). Note: the flag was initially consumed on first editor exit, which broke reply tracking for pre-send round-trips — fixed 2026-07-09
+
+# 2026-07-02
+
+- **HTML signature images embedded automatically (CID)** — remote `<img src="https://...">` references in the outgoing HTML part (typically the logo in an HTML signature) are now downloaded at send time and embedded as `cid:` inline MIME parts, so Gmail and every other client that blocks external images still renders the signature image. New second rewrite pass `imgSrcHTTPRe` in `buildMessageWithBCC` (`internal/smtp/sender.go`) after the existing local-path pass; `fetchRemoteImage` uses a 10-second HTTP timeout so a slow CDN can't hang the send, MIME type comes from `Content-Type` with `http.DetectContentType` fallback, and any fetch failure leaves the original URL in place instead of failing the send
+- **Fix: `ctrl+b` CC/BCC edit from pre-send no longer drops a composed body** — toggling Cc/Bcc with `ctrl+b` on the pre-send screen switched to the compose form, and advancing through the fields would fall through to `stepSubject` and relaunch the editor from the compose fields — discarding the already-written body. New `fromPresend` flag on the compose model: To/Subject are pre-filled for context, advancing past Bcc now patches `cc`/`bcc` directly into `pendingSend` and returns straight to pre-send, and `esc` cancels back to pre-send unchanged
+
+# 2026-06-22
+
+- **`make syncthing-tunnel`** — starts Syncthing on the headless server (if not already running) and opens an SSH tunnel to its web UI at `http://localhost:8385`; companion `run-syncthing` target in `scripts/headless-server/Makefile` for starting Syncthing in the background on the server itself
+
+# 2026-06-15
+
+- **Docs: tagline refresh** — README and docs-site landing page reworded around "write in Neovim, render as Markdown, screen senders first, organize emails once"
+
 # 2026-06-13
 
 - **Per-account signatures** (thanks [@notthatjesus](https://github.com/notthatjesus)) — each `[[accounts]]` entry can now carry its own `[accounts.signature_block]` table with `text` and `html` fields, overriding the global `[ui.signature_block]` for that account. Personal account → casual Markdown blurb (`text` only, goldmark renders it into the HTML part); business account → `text = """[html-signature]"""` placeholder + a styled `html` table signature; send-only aliases → no block, falls back to the global block (or legacy `[ui].signature` for `text`). Resolution lives in `Config.Signature(account)` (`internal/config/config.go`); every signature consumer in `model.go` — compose prelude in `launchEditorCmd`, draft re-open, AI handoff, pre-send HTML preview, SMTP send path — now passes the active account so the resolved signature follows whichever account `ctrl+f` lands on. **The block is all-or-nothing:** once you create `[accounts.signature_block]`, populate every field you care about — fields do not individually merge with the global block, so setting only `html` leaves the editor without an `[html-signature]` placeholder and the HTML never gets injected at send time. Unit test `TestSignature` pins the resolution order; docs at `docs/content/docs/configuration/_index.md` (Per-Account Signatures section with both shapes worked) and `docs/content/docs/sending.md` (cross-link). Cherry-picked from @notthatjesus's signatures-and-folders branch — the per-account folder override half of the original PR was intentionally left out, as neomd's GTD/HEY-Screener folder set is generic by design and per-account overrides would add complexity around virtual folders like Drafts and Spam

CLAUDE.md

@@ -98,6 +98,8 @@ Folder operations prefer RFC 6851 MOVE; `u` undo uses UIDPLUS destination UIDs c
 
 ## Project-Specific Conventions
 
+- **Check `AGENTS.md` before and after changes** — it lists the user-visible feature invariants that must not break (reply `·` dot, threading headers, MIME shapes, screener priority, pre-send round-trip guarantees, …) with code anchors and pinning tests. Scan the relevant section before touching related code, re-verify after, and add an entry when shipping a new feature.
+- **Always update `CHANGELOG.md` at the end of every user-visible change** — dated `# YYYY-MM-DD` heading (newest first), bold title, what/why/where, and the regression test name.
 - **Keep diffs minimal** — fix the specific thing asked; do not refactor adjacent code.
 - **Avoid modifier keys for new bindings** — user's tmux prefix is `C-t`, and `ctrl+a`/`ctrl+e` collide with bubbles textinput line-start/end. Prefer plain letters, especially on the pre-send screen.
 - **Inline markers must be visible plain text** — use `[attach] /path`, never HTML comments (hidden by treesitter in the neovim compose buffer).

internal/ui/compose.go

@@ -26,6 +26,7 @@ type composeModel struct {
 	subject      textinput.Model
 	step         composeStep
 	extraVisible bool // ctrl+b toggles Cc+Bcc together; off by default
+	fromPresend  bool // true when ctrl+b was pressed from the pre-send screen (CC-only edit)
 
 	// Address autocomplete
 	knownAddrs  []string // all addresses from screener lists (set once)
@@ -70,6 +71,7 @@ func (c *composeModel) reset() {
 	c.subject.Reset()
 	c.step = stepTo
 	c.extraVisible = false
+	c.fromPresend = false
 	c.to.Focus()
 	c.cc.Blur()
 	c.bcc.Blur()
@@ -254,6 +256,9 @@ func (c composeModel) advanceField() (composeModel, tea.Cmd, bool) {
 		c.bcc.Focus()
 		return c, nil, false
 	case stepBCC:
+		if c.fromPresend {
+			return c, nil, true // signal: done editing CC/BCC, return to pre-send
+		}
 		c.step = stepSubject
 		c.bcc.Blur()
 		c.subject.Focus()