RustBox/CHANGELOG.md

# RustBox changelog

### 0.0.3
- Fixed reader toolbar dropdowns for Message details and Move/copy by moving popovers out of the horizontally clipped toolbar layer.
- Added Fastmail-, Apple Mail-, Yahoo Mail- and HEY-inspired styles plus Nord, and an optional per-account unlock for UI scaling on predefined styles.
- Added separate mail-size controls: `max_attachment_size_mb = 10` per uploaded file and `max_message_size_mb = 50` for the complete final RFC822/MIME message. The final MIME bytes are checked before SMTP submission, including base64, multipart and OpenPGP overhead; the composer shows an estimated running total.
- Moved the Diagnostics → IMAP reconnect action below capability details so it no longer collides with the status label.
- Added the RustBox repository link to Settings → About.
- Defaulted omitted mail endpoints to localhost:993 (IMAP) and localhost:587 (SMTP); TLS verification is skipped automatically only for loopback endpoints unless `tls_verify` is explicitly configured.
- Swapped the compact composer footer groups so the HTML/Text/Markdown selector is on the left and Cancel/Send on the right.
- Grouped message details and move/copy actions into compact reader-toolbar menus.
- Improved Polish translations for composer, message toolbar and per-message context menu.
- Moved composer format selection to the opposite side of Send/Cancel in the compact composer footer.

- Added server-wide `default_interface_skin` (`rustbox`, `gmail`, `proton`, `zoho`, `outlook`, etc.) for login and accounts using **Global default**.

- Fixed mobile modal/settings overflow, transparent dialog strips, calendar toolbar wrapping and narrow-layout sizing.
- Fixed visual Sieve rule checkbox alignment and stacked its rule controls safely on small screens.
- Added tap/keyboard expansion for full recipient addresses in the message reader.
- Added persistent IMAP quota progress above the sidebar IMAP/version footer.
- Added administrator-configurable `default_theme = "system" | "dark" | "light"` for the pre-login/login UI.
- Added Gmail-, Proton-, Zoho- and Outlook-inspired interface profiles plus a Minimal profile.
- Expanded Polish translations across settings, dialogs, calendar, contacts, filters and common accessibility/title attributes.
- Bumped the application/source release to `0.0.3`.

### 0.0.2

- Split the monolithic browser application JavaScript into functional modules under `src/web/js/`; `build.rs` now assembles the JavaScript manifest into the embedded fingerprinted bundle alongside the existing CSS build.
- Removed the duplicate `ui/` snapshot; `src/web/` is the only browser UI source and Cargo assembles embedded CSS/JS bundles in `OUT_DIR`.
- Removed the top-level Compact/Balanced/Comfortable/Reading appearance preset cards.
- Expanded **Interface style** with RustBox (custom), Roundcube Classic, Roundcube Larry, Roundcube Elastic, Clean, Graphite and High contrast.
- Fixed styles no longer overwrite the user's RustBox custom colors/layout values; switching back to RustBox restores the saved manual configuration.
- Fixed interface styles lock palette/geometry controls while leaving Theme, language, date/time formatting and accessibility/user visibility toggles available.
- Added dedicated light/dark palettes for Larry, Clean, Graphite and High contrast while retaining the existing Classic/Elastic compatibility skins.
- Updated UI/build contract tests for the modular JavaScript build and expanded interface-style validation.
- Fixed the 0.0.2 release build regression by centralizing `AppConfig::default()` and updating stale `AccountSession` test fixtures for the new session metadata fields.
- Updated UI contract tests and visual fixtures after removal of the legacy `ui/` directory.
- Fixed release-test regressions in OpenPGP fingerprint validation, protected system-folder recognition, nested `base_path` UI routing, and missing SMTP endpoint handling.

### 0.0.1

- Reworked Roundcube appearance compatibility: dedicated Classic and Elastic interface skins now use upstream-aligned light palettes, dedicated dark variants, exact Classic red/gray selection accents, Elastic cyan/dark tokens, and palette locking so generic RustBox colors cannot bleed into the selected skin.
- Replaced the mobile folder-drawer close affordance with a left-facing SVG back arrow in a dedicated mobile drawer header.
- Added persisted `interface_skin` display preferences and two schema migrations for skin selection and saved-response format.
- Added Roundcube-style saved/canned responses with text/HTML formats, settings CRUD UI and composer insertion; HTML is sanitized before insertion.
- Added static theme-contract tests and browser-rendered visual fixtures for Classic/Elastic light/dark and mobile drawer validation.
- Moved Sieve rule creation/editing into a dedicated wide modal with the existing live “what will happen” preview; Settings now shows the rule list and launches the editor instead of squeezing the full builder into the settings pane.
- Moved identity/signature editing into a separate viewport-safe modal and eliminated the horizontal overflow caused by the two-column Settings layout.
- Added a persistent full-screen composer toggle.
- Collapsed the OpenPGP composer controls into a compact summary row with expandable details, while keeping PGP options hidden when no OpenPGP keyring is configured.
- Kept the signature image/CID flow from the previous UI patch in the packaged sources and synchronized standalone `ui/` assets with embedded `src/web/`.
- Moved bulk message actions into a floating overlay so selection mode no longer consumes the message-list grid row or creates horizontal layout spill.
- Hardened narrow reader/message toolbars and composer layout against controls colliding at split-pane widths.
- Reworked composer address/options rows into distinct fields and allowed the formatting toolbar to wrap cleanly.
- Expanded identity signatures/footers with text + HTML editing and image import/paste; imported images are materialized as inline CID draft attachments when composing.
- Completed the OpenPGP roadmap lifecycle with private-key passphrase change. The existing rPGP implementation remains responsible for key parsing, signing, encryption, verification and decryption; GnuPG is used only to re-wrap an existing secret key when changing its passphrase. Passphrases are exchanged over stdin/status-fd and are never stored in the database or command line.
- Added `POST /pgp/keys/{fingerprint}/change-passphrase` and a keyring UI action, including an explicit warning before removing passphrase protection.
- Added optional `RUSTBOX_PGP_GPG_BINARY` override for deployments where the GnuPG binary is not named `gpg`.
- Expanded the visual Sieve builder with dynamically addable conditions and actions. Additional conditions can be chained with nested AND/OR and capability checks now include dynamically added actions.
- Replaced the stale roadmap gap list with a counted functional checklist: 45 functional items remain after this snapshot, with security/integration/acceptance gates tracked separately.
- Fork base: Oxi `7f1507c486b78cf33e54beb701dd460d3bd2bd5d`.
- Flattened the Rust application to the repository root: `Cargo.toml`, `src/`, `migrations/`, `tests/` and `examples/`.
- Removed the separate Oxi frontend source and all TypeScript/React/Next.js/Node/Bun build requirements.
- Added a RustBox-owned embedded HTML/CSS/vanilla-JavaScript interface with dark/light/system themes.
- Added `dev.sh`; ordinary `cargo run`, `cargo test` and `cargo build --release` now work from repository root.
- Added mail reader/list/compose/search UI and About/Credits with the consumed Oxi revision embedded from `UPSTREAM_BASE`.
- Added ManageSieve API/editor with STARTTLS, implicit TLS and explicit plaintext opt-in.
- Added native systemd packaging and Cargo-only CI/release build.
- Added Oxi tracking tools that map upstream `backend/...` changes into the flat RustBox tree without importing Oxi frontend sources.
- Added full-baseline sync review plus selective single-commit backend porting from Oxi.
- Build fix: corrected the embedded SVG raw-string delimiter, imported Figment's `Format` trait for `Toml::file`, and removed an unused `SieveCapabilities` re-export.
- Mail server endpoints are now configuration-owned; the login form only accepts email, password and remember-session preference.
- Fixed Inbox/folder/quota/draft operations to use the connection profile stored in the authenticated session instead of re-reading an optional global IMAP host.
- Added startup validation for `imap_host` to prevent successful Sieve/login state with a non-functional Inbox.
- Rebuilt the interface as a compact three-pane webmail layout with embedded SVG icons, HTML compose formatting, threads, folder actions, Sieve filters and appearance preferences.
- Moved browser sources to `src/web/`; Cargo `build.rs` bundles modular CSS and the executable embeds all UI assets.
- Removed gradients and Unicode pseudo-icons from the application interface.
- Added nested-folder indentation, Reply all, accurate IMAP connection state, and RustBox-branded HttpOnly session/browser cookies.
- Added persistent per-user appearance personalization stored in SQLite.
- Added EN/PL language assets embedded in the Rust binary.
- Added theme palette presets (sage/blue/slate/amber/violet/rose/custom) and custom accent color.
- Added font family/size, message row height, pane widths, border radius, contrast and reduced-motion controls.
- Added toggles for avatars, attachment indicators and flags.
- Added message and folder context menus for common webmail actions.
- Added raw-header viewer and clipboard copy.
- Added folder subscribe/unsubscribe UI and context actions for creating subfolders.
- Added identities/signatures settings UI and composer From identity selection.
- Signatures from the selected identity are inserted into the composer.
- Replaced the internal roadmap with the user-approved 0.0.1 plan.
- Added per-account special IMAP folders for Sent/Drafts/Trash/Junk/Archive and wired them into send/delete/archive/junk flows.
- Added IMAP copy, mark-all-read, empty-folder, multi-select and bulk operations.
- Added drag-and-drop message-to-folder moves and previous/next reader navigation with keyboard shortcuts.
- Added advanced and saved search, read/flag operators, user labels/tags and mailbox quota display.
- Expanded composer to HTML/plain/Markdown modes, inline CID images, attachment reminder and a larger formatting toolbar.
- Expanded identities with Reply-To, automatic Bcc, Organization metadata and text/HTML signature behavior.
- Added contact groups and vCard import/export UI.
- Added a capability-aware visual Sieve rule builder plus vacation/autoresponder generation and server validation.
- Added ICS calendar import UI.
- Connected the browser to the existing IMAP IDLE/WebSocket event stream for realtime refresh and desktop notifications.
- Added notification Do Not Disturb hours and persisted per-folder notification preferences.
- Expanded personalization presets and added custom background, panel and text colors in addition to the accent color.
- Added persisted mailbox preferences for page size, date sort, delayed mark-read, threaded/flat reader mode, HTML/plain preference, quote limiting, snippet visibility and remote-image policy.
- Added remote-image prompting with sandboxed message rendering and no-referrer loading.
- Added IMAP capability diagnostics and a settings diagnostics panel for IMAP, ManageSieve and realtime WebSocket state.
- Added multi-account UI for adding, switching and removing accounts in the current browser session.
- Added user-selectable date and 12/24-hour time formats.
- Added server-side validation for message-list page size/sort and mailbox preference values.
- Added `.eml` import into any selected IMAP folder using APPEND, followed by cache invalidation and realtime folder refresh.
- Added `List-Unsubscribe` handling for safe HTTPS/mailto targets from message headers.
- Added in-app full RFC822 source viewer, Message-ID/sender copy actions and folder-properties inspection.
- Raised extractor body limits only on upload endpoints so the documented attachment/vCard/ICS/.eml limits are actually reachable.
- Expanded contacts with phone, job title, address, website and birthday fields.
- Added contact photo upload/remove/display for PNG/JPEG/WebP with byte-signature validation and a 2 MB limit.
- Extended vCard import/export with TEL, TITLE, ADR, URL and BDAY.
- Changed contact persistence from SQLite `INSERT OR REPLACE` to conflict-update semantics so editing a contact does not destroy group/photo relations through a row replacement.
- Fixed the calendar delete-handler syntax regression found during pre-release static review.
- Added Tantivy index diagnostics and an in-app rebuild from the per-user SQLite cache.
- Added IMAP request-pool reconnect/verification from Diagnostics.
- Added active-session inventory across browsers while the process is running, User-Agent display, individual revoke and revoke-all-others.
- Expanded calendar events with all-day, recurrence RRULE, attendees, organizer, status, reminder, meeting URL and color fields in the UI; added full local ICS export.
- Added direct ICS/vCard import actions for message attachments.
- Expanded contacts to multiple e-mail addresses, phone numbers and postal addresses.
- Added duplicate-contact detection and transactional merge preserving groups, alternate values and contact photos.
- Validated all 28 SQLite migrations from an empty database plus browser JS/JSON/TOML/shell assets.
- Added Month, Week, Day and Agenda calendar views with persistent view selection and event-color markers.
- Hardened contact/calendar/header/source dialogs against viewport overflow and UI scaling.
- Fixed UI scaling so it also changes icon sizing and field/button spacing, and added persistent draggable pane splitters.
- Added reusable action toasts to additional folder, search, calendar and ManageSieve operations.
- Added Spam / Not spam actions in the primary and bulk message toolbars.
- Added safe attachment Open/Download context actions and browser-side Download all as ZIP with UTF-8 filenames.
- Added To/Cc/Bcc autocomplete using contacts and known addresses, including keyboard navigation.
- Added message-list quick actions for read/unread and flag/unflag.
- Hardened message rendering against RustBox-owned icon sprite markup leaking from malformed MIME content.
- Kept the UI free of gradients, TypeScript, React/Next and Node/Bun runtime dependencies.
- Added collapsible hierarchical IMAP folder branches with per-account remembered expansion state and leaf-name rendering.
- Added a keyboard-shortcuts reference dialog and `!` shortcut for Spam / Not spam.
- Added direct sender actions from the reader header: compose, add contact, copy address, search and create filter.
- Expanded message sorting to date, sender, subject and size in ascending/descending order, available directly from the message-list toolbar and persisted per account.
- Added the `Contacts only` remote-image policy, which verifies the current sender against the saved address book before allowing external images.
- Expanded the visual Sieve builder with a second condition, AND/OR combination and per-condition negation while retaining server-side CHECKSCRIPT validation.
- Added automatic identity selection on reply/forward using To/Cc and Delivered-To/Envelope-To headers before signature insertion.
- Added mailbox quota warning/danger states at 80%/95% usage.
- Added collapsible thread navigation with remembered expansion state.
- Added safe Undo for MOVE-backed message actions when the destination UID can be resolved unambiguously, including reverse-order bulk Undo.
- Added “Select all results” for search bulk actions by materializing the full cached match set on explicit request.
- Hardened thread matching so `References` uses complete Message-ID tokens instead of accepting substring collisions.
- Moved safe attachment previews into an in-app modal for images, PDFs and text attachments.
- Added composer upload progress and clipboard image paste as CID inline attachments.
- Added draft recovery from both server-side local drafts and an emergency browser snapshot; SMTP failures force a recoverable draft save.
- Changed autosave so it no longer appends a fresh IMAP Drafts message every 1.2 seconds; IMAP snapshots are reserved for deliberate close/failure points until remote draft UID replacement is implemented.
- Expanded keyboard shortcuts with `C` compose, `V` selection mode and `X` select/unselect current message.
- Replaced runtime browser `confirm()`/`prompt()` flows in the main RustBox UI with reusable application dialogs, including folder/label choices used by message context actions and quick-filter creation.
- Added an explicit message selection mode; row checkboxes are hidden/disabled outside that mode and bulk controls remain available while selecting.
- Fixed compact/comfortable density so it changes control, toolbar and dialog sizing independently from UI scale and the user-defined message-row height.
- Added visible toast auto-dismiss countdowns with pause-on-hover/focus behavior.
- Added Compact, Balanced, Comfortable and Reading interface presets that persist through the existing display-preferences API.
- Reworked message printing to use a sandboxed in-page print frame instead of a popup, while preserving sanitized HTML/plain-text message rendering and message metadata.
- Added persisted composer priority and MDN/read-receipt options; outgoing optional headers are shared by SMTP delivery, draft snapshots and the IMAP Sent copy, with mailbox validation before SMTP.
- Added RFC 8058 one-click unsubscribe through a backend HTTPS POST path with no redirects, DNS/IP public-address checks and direct-address TLS connection to reduce SSRF/DNS-rebinding risk.
- Fixed migration registration so the existing V028 contact migration and new V029 draft-send-options migration are both executed; the migration set is now V001–V029.
- Expanded the visual Sieve builder to three conditions with nested AND/OR grouping, two actions, capability-driven action disabling, managed visual-rule ordering, JSON backup/restore and active-script overwrite confirmation.
- Added optional scheduled vacation start/end dates using Sieve `currentdate` with `date` + `relational` requirements when the server advertises those extensions.
- Added a browser-wide default Spam/Junk destination with a per-account special-folder override; mail actions fall back to IMAP `\Junk`/Spam auto-detection when neither resolves.
- Added persistent mailbox-level “flagged on top” and per-folder inherit/on/off overrides. Flagged-first ordering is performed in SQLite before pagination.
- Added a subtle red lower-edge marker to flagged message rows without changing the existing star action.
- Replaced the quick-filter folder prompt/raw-editor handoff with a dedicated ManageSieve filter wizard that previews the rule, respects advertised extensions, validates with CHECKSCRIPT, saves directly to the selected script and can activate it.
- Kept an Advanced editor handoff that preloads the visual Sieve builder for users who want to refine the generated rule.
- Added SQLite migration V030 and a folder-preferences API for per-folder list behavior.
- Added aggregate unread counts to the browser title and supported application badges.
- Added `/api/ready` alongside liveness `/api/health`; readiness checks that the local RustBox data directory is accessible without coupling process readiness to account-specific IMAP/SMTP availability.
- Made generic application dialogs scroll as a fallback when their content exceeds the browser workspace, while retaining independent scroll regions for structured composer/settings/contact/calendar/source dialogs.
- Fixed inline-image compose preview: uploaded CID images render from the authenticated draft-attachment endpoint while editing, then serialize back to `cid:` references for draft persistence and SMTP/IMAP MIME generation.
- Removing an inline-image attachment now also removes its matching image node from the composer instead of leaving a broken placeholder.
- Replaced the About-page Runtime row with `Author: @linuxiarz.pl`.
- Extended the quick-filter wizard with an optional capability-aware “also mark as read” action and an explicit notice that Sieve rules apply to new incoming mail rather than retroactively changing existing messages.
- Changed the About author label to `@linuxiarz.pl`.
- Fixed action-toast controls so Undo and the close button share one compact control group; clicks no longer propagate between the two actions.
- Preserved the active folder, loaded-page depth, message-list scroll position and active search context across normal refresh/reconnect flows within the browser session.
- Added an explicit offline/reconnecting state and bounded automatic retry for idempotent GET/HEAD requests only; mutating operations are never automatically replayed.
- Added authenticated SMTP connection diagnostics, IMAP custom-keyword capability detection and local synchronization-cache diagnostics with last folder/message sync timestamps.
- Added friendly active-session client names such as `Firefox · Linux` while keeping the full User-Agent available as hover detail.
- Added client-side highlighting of active search terms in sender, subject and snippet without injecting result text as HTML.
- Fixed the Settings modal grid so the header occupies only its natural height and the sidebar/content area fills the remaining workspace instead of being pushed toward the bottom for short panels such as About.
- Made Settings navigation/content independently scrollable and mobile tabs horizontally scrollable.
- Added inline-image selection/editing in the composer: display width, inline/left/center/right placement and in-app crop/cut with a live preview. Cropping creates a replacement CID attachment; GIF cropping stays disabled to preserve animation.
- Dragged image files now insert as inline CID images in HTML mode instead of silently becoming ordinary attachments.
- Added cleanup of CID attachments whose inline image was removed from the editor, including a final cleanup before send/close.
- Added a warning before switching away from HTML when rich formatting may be lost.
- Added persisted Composing settings for default format, draft autosave interval, default priority, default MDN/read-receipt request and attachment-reminder behavior.
- Added SQLite migration V031 for the new composing preferences.
- Added SQLite migrations V032–V036 for advanced appearance preferences, draft compose-format persistence, optional IMAP-keyword synchronization, composer behavior preferences and remote IMAP-draft tracking.
- Expanded Appearance with icon size, toolbar/sidebar density, reader/composer widths, selection color, unread styling, compact headers, border/scrollbar controls, monochrome mode and per-pane background overrides.
- Completed the safe Markdown compose pipeline: Markdown source remains the plain alternative while preview/delivery uses escaped generated HTML rather than raw Markdown HTML.
- Added persisted composer defaults for font, reply-above/below-quote, quote style, forward inline/as-attachment and browser spellcheck.
- Added administrator-configurable outgoing headers with header-name validation, structural/MIME-header denylisting and CR/LF-injection rejection.
- Added opt-in native IMAP keyword synchronization for RustBox labels. Stable RustBox keywords are written only where persistent custom keywords are supported and observed RustBox keywords are imported back into local labels; full remote-removal reconciliation remains partial.
- Reworked deliberate IMAP Drafts snapshots so RustBox resolves the newly appended draft UID from UIDNEXT plus an exact `X-RustBox-Draft-ID` search, stores UID/UIDVALIDITY and removes the prior snapshot only after an unambiguous safe match.
- Added strict draft-ID validation before attachment-path use, closing traversal through draft identifiers and making the draft marker safe for IMAP headers.
- Changed attachment uploads to stream multipart chunks into bounded `.part` files with atomic rename, stale-part cleanup and cleanup on interruption/error instead of buffering the entire upload in memory.
- Fixed the duplicated draft-route `Extension(config)` extractor and kept standalone `ui/` assets synchronized with embedded `src/web/` sources.
- Fixed the Axum 0.8 `E0277 Handler` failure in tag/bulk-tag routes by separating synchronous SQLite work from awaited IMAP work; no rusqlite connection/transaction is retained across network awaits.
- Applied the same DB/network phase separation to single-tag, untag and tag-delete handlers so the compile failure does not simply move to the next route.
- Added authoritative IMAP-label reconciliation for folders that explicitly support persistent custom keywords. Remote RustBox keyword additions and removals can now be reconciled into local labels from Mailbox settings.
- Fixed `Keep me signed in` so the server-side session timeout is extended together with the cookie instead of still expiring at the normal default timeout.
- Active-session diagnostics now expose effective expiry and whether the session uses the remembered timeout.
- Added graceful SIGTERM/Ctrl+C shutdown and explicit cancellation of dedicated IMAP IDLE tasks before process exit.
- Extended synchronization diagnostics with active IMAP IDLE task/subscriber counts to make reconnect storms and leaked subscriptions visible from the UI.