c60e3d6 made every route able to name its mailbox and left the UI unable to.
`?account=<id>` names one and `?account=all` spans them; nothing on screen
passed either, so the list showed whichever account sorted first enabled.
The selection is a QUERY PARAM, the same as the folder beside it and for the
same reason — it is addressable state, so a reload, a shared URL and a
cmd-click all land where they were meant to. The pills are real links built from
the live params, so the folder and any open email survive a mailbox switch.
`account` is in the react-query key. Without it, switching mailbox would serve
the previous one's page from cache under the new selection, which reads as the
filter not working rather than as a caching bug.
Absent means `all` in the UI and only in the UI. The routes keep treating absent
as "first enabled" — mail-scope.ts does that deliberately, because the mobile app
and the agent's email_db tool call them and know nothing about accounts. That
default is right for a caller that cannot choose and wrong for a person looking
at a screen: three accounts and you want all of it, not whichever sorts first.
Hidden with fewer than two accounts. A control that can say one thing is noise in
a toolbar that is already tight on a phone.
NOT visually verified: this machine has no email accounts configured, so the
picker cannot render here. tsgo clean, prettier clean, the 16 mail-scope tests
pass. It needs a look on a host with two accounts before it is trusted.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043
Clicking "Add Account" on a new install did nothing at all — no modal, no
error, nothing in the console.
EmailList early-returns an onboarding empty state when there is no mail, and
that branch carries the "Add Account" button. But <AccountsModal /> was only
mounted in the OTHER return — the one that renders when mail exists. The button
flipped the shared EMAIL_ACCOUNTS_OPEN global and nothing was listening.
A catch-22, and it closed the only door in: the sole other trigger is in the
toolbar, which is also in the mail-exists branch. So an install with no account
could never reach the dialog that adds one, and the failure was silent in both
directions — nothing threw, and the state flag really did flip.
Mount it in both branches. The empty state is exactly when it is needed most.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
IMAP and Gmail sync into a per-account SQLite store, with the mail read and
composed in the browser.
moved whole from src/servers/sidecar/email (14 files), src/servers/api/email,
officer_db/src/email, and the Screens/Dashboard/Email tree. what changed on the
way out:
- credentials are encrypted. the column was plaintext jsonb holding an IMAP app
password that the SMTP transport read straight out of the row; it is now
AES-256-GCM under this plugin's own 'email' secret-store purpose, sealed and
opened in queries.ts alone so nothing above it can hold ciphertext by
accident. no plaintext fallback on read - a value that does not verify is an
error.
- the router derives its prefix from mountPrefix() instead of the literal
'/api/email', which was only correct for a first-party publisher.
- the frontend became panels.ts + layout.ts. the two panel appTypes that were
null are now declared, because the platform screen used to override them by
panel id and a plugin has no such hook.
- account management became a modal. it was a section in the platform's
Settings, which a plugin cannot contribute to, and a panel does not work
either: PluginScreen renders the workspace locked, so a panel outside the
default layout is unreachable. it follows Compose, which had already solved
this.
- 17 palette classes replaced with semantic tokens.
not verified: this has never run. it was switched off in the platform on
2026-08-13 and its table was never created, so nothing has exercised sync,
sending or the UI since. the first install is the first test.
pastilhasandClaude Opus 5