Changelog

Unreleased

• Add Read, Snooze/Return to inbox, Reply, Archive and Pin beside Trash on each mail row. Use a raised 3D toolbar that follows built-in and custom themes, mode and accent. Keep row actions tied to their own email, with visible touch controls and the existing provider safeguards.

• Add customizable floating notifications in Settings: separate new-mail and action switches, position, duration, preview and reset. Confirm Snooze with its return time, Return to inbox, Archive and Trash; preserve confirmed outcomes when inbox refresh fails. Errors and uncertain-send warnings remain until dismissed.

• Keep the release-validator test loader as a file URL so Node can import it on Windows.

• Build automatic patch releases from the triggering commit and create their tags only after every platform build passes. Keep version stamping in the runner instead of pushing a version commit to main.

• Accept Windows checkout line endings in automatic-release workflow tests.

• Keep theme dialogs inside the app's navigation and shortcut guards so Back/Forward cannot discard unsaved edits and Commands cannot open a second modal. Restore navigation and commands when the theme dialog closes.

• Publish GitHub-safe Emc2- installer filenames and Windows/Linux updater manifests with release checksums. Match Linux AppImage x86_64 filenames and verify packaged metadata, size and SHA512 before upload. The application remains Emc² with the update icon and existing signing policy.

• Stamp reusable release builds from the checked-out tag so published installers keep the stable version; reject tags that disagree with the package version.

• Stack the mail features on the Linux fallback, keeping its protection warning separate from the update icon and retaining draft and account-privacy guards.

• On Linux without system credential encryption, start fresh profiles with a local 0600 mail key and show a persistent weaker-protection warning instead of failing. Profiles protected by the system keyring still stop, now with a clear keyring/reset message instead of a raw decrypt error. macOS and Windows still stop when encryption is unavailable. See ADR 0027.

• Rebase the mail features onto the merged sidebar redesign, keeping the corner toggle, update icon, privacy and draft guards. Reconcile decision links with main.

• Keep disabled row Trash buttons hidden until hover or keyboard focus so they cannot overlap mail timestamps during sync. Preserve always-visible actions on touch devices.

• Add custom themes in Settings, Appearance with light and dark palettes, background/accent generation, advanced color controls and live preview. Create, edit, duplicate, export and import Emc² JSON themes; confirm deletion and restore the previous appearance on Cancel. Save the theme library and selection together on this device, retaining the editor if storage fails.

• Extend window transparency through the mail list, reader, sender panel and Settings, with a stronger neutral tint in light mode. Keep foreground text sharp and Off opaque.

• Put Drafts directly below New message in the sidebar and Settings beside Sync as a gear icon.

• Keep the theme picker above the accent swatches by limiting the fixed stacked-row height to mail rows.

• Autosave compose and reply text to encrypted local drafts, with visible save status and recovery from the Drafts button. Closing compose keeps the draft; discarding is a separate confirmed action. Reconcile lost save responses without overwriting newer revisions. Save a durable uncertainty marker before sending, require confirmation before resending an uncertain draft and treat accepted-send cleanup failures as warnings. Draft writes remain available during sync and stop during updater quiescence. Disconnect explicitly warns before permanently deleting the account's local drafts, including uncertain sends.

• Rebase the sidebar redesign onto current main, preserving macOS key migration and test timeouts. Reconcile contributor guidance, component links and ADR numbering.

• Add a macOS migration path that wraps the existing mail key under Emc² and preserves the original protected key, identity metadata and encrypted mail for rollback. Later starts prefer a validated current record; migration errors stop before opening mail. Native Keychain labels and reinstall behavior still require separate verification.

• Limit macOS filesystem test fixtures to supported hosts while retaining portable protocol checks and Windows startup coverage.

• Put the sidebar toggle first in the top-left corner, before drawn window controls, at the same spot whether the sidebar is open or closed. Tint the selected row with the accent while the list has focus instead of filling it, keeping the row's own text colors.

• Let Windows and Linux choose between the drawn macOS-style window controls and the system's own caption buttons, switched from Settings, Appearance by reopening the window in place. Use native context menus for mail rows on the desktop. Make the email toolbar icon-only in Mail-style groups and add Move to Trash to it. Mark unread mail with an accent dot, divide rows with hairlines and fill the selected row with the accent while the list has focus. Tint sidebar icons with the accent and let its sections fold. Arrange Settings in System Settings-style groups.

• Add structured cached-mail search, a searchable command palette, plain-text templates and per-account signatures, local message pins, and queued in-app arrival/send/error toasts. Store templates and signatures in the encrypted mail store. Preserve uncertain-send and Sent-copy warnings until dismissal.

• Let Up and Down select emails in the list without page scrolling, opening mail or marking it read. Keep editor and open-reader arrow behavior.

• Port the full feat/sidebar-design interface: full-height sidebar and Settings navigation, per-pane headers, six Inbox categories, light/dark/system modes, themes, accents, native materials, side-by-side or full-width reading, compact action/filter controls and native mail menus. Keep the updater as an icon with dismissible details and retain the account-label, Back/Forward, density and windowing corrections.

• Check Gmail API mailbox revisions every 15 seconds with backoff, preserving IMAP events, the shared sync queue, updater drain and five-minute recovery sync. Reuse unchanged renderer snapshots and avoid hidden-window redraws.

• Preserve bounded newsletter layout, centering and quoted-reply formatting without loading scripts, sender stylesheets or images before consent. Keep Windows caption changes behind the native draft guard and validate new IPC against the current main frame and application origin.

• Disable overscroll bouncing on the showcase website.

• Let Back leave the reader and immediate Forward reopen the latest email without adding mail-to-mail history. Preserve mouse, shortcut and draft guards; ignore stale reader identities.

• Keep saved custom account labels visible during privacy mode while hiding addresses inside them. Restore Ctrl plus/minus density changes from focused closed filters.

• Bound mounted inbox rows to the viewport with overscan, keeping all cached mail reachable, selected/focused rows retained, reader-return positioning and wrapped touch controls. Avoid scanning message bodies when search is empty.

• Document database and cross-platform E2E encryption options, migration safeguards and recipient compatibility limits. No encryption implementation changes.

• Allow local account names in Settings through a validated name-only PATCH. Preserve names across sync and reconnect, store them with encrypted accounts and redact addresses in privacy mode.

• Trigger synthetic Gmail timeout tests after the loopback request arrives, preserving real connection-close and no-retry checks. Add a negative control for lost transport cancellation.

• Hide scrollbar indicators without disabling scrolling. Allow Show images while personal text is hidden, with per-opening consent and masked text, captions and image descriptions. Image URLs containing detected private information remain blocked. Keep captions and inline images in order when private text spans sender markup or image boundaries. Redact image descriptions before truncating them; use a generic description when privacy-mode gallery metadata may already be cut mid-token.

• Check cached updater files before reading them, limit hashing to the expected size, and stop hashing on cancellation or timeout. Ignore cached metadata paths and recheck cache contents before reuse.

• Preserve the installed AppImage and any existing destination when update replacement or launch fails. Enforce download size limits before writing excess bytes, including responses without a Content-Length header, and abort cancelled requests before headers arrive.

• Add an app-update notice with download progress and a single download, install and restart action for compatible Windows NSIS and Linux AppImage releases. Verify release and file identity, drain mail work and honor draft cancellation before installer handoff. Show unavailable states for unsupported builds and release metadata; automatic macOS installation remains disabled under local ad-hoc signing.

• Watch IMAP inbox events to refresh arrivals and read flags through the existing account sync queue. Keep Gmail API polling, bounded reconnect recovery and one notification per successful run; suppress notifications until the first complete import succeeds.

• Keep reader keyboard navigation in the chosen sort order when read-on-open removes the current message from Unread results.

• Add a visible account setup button and a compact picker for multiple accounts. Combine unread, relevance, account, label and search filters; sort by newest, oldest or relevance and restore controls with Back/Forward. Keep account addresses hidden in privacy mode.

• Use a 16-pixel template image for the macOS tray and a 22-pixel tray image on Linux. Keep the Windows tray image unchanged.

• Add visible Read, Reply, Done, Snooze and Move to Trash controls for selected and opened mail. Show pending reads and apply confirmed read state before an inbox refresh completes. Report failed actions without removing mail.

• Move mail to the provider's Trash only after confirmation. Require safe IMAP MOVE support and a unique server-declared Trash folder, counting mixed-case duplicates; preserve Done as archive and never permanently delete mail.

• Document 13 public email-client feedback reports, their evidence limits and priorities for the mail UX stack.

• Close the desktop window to the tray instead of exiting, keep the mail service and a five-minute sync running while it is hidden, and show one native notification for the new unread mail a sync finds. Reopen from the tray, its menu or a second launch, and quit from the tray. Fields and selected text keep a native right-click menu.

• Preserve macOS Keychain identity for existing protected mail keys, with one bounded legacy retry and no replacement of unreadable keys. Keep explicit startup-check profiles isolated from saved accounts.

• Match formatted email text, backgrounds, borders and links to the app's dark theme while preserving sender layout, emphasis and image controls.

• Add a macOS source-installation route with Git, Node and Xcode Command Line Tools, requiring no Apple Developer account. Replace invalid inherited signatures through explicit local ad-hoc signing without certificate or provisioning-profile discovery. Keep notarization, DMG signing and existing public release assets unchanged.

• Hide a sender avatar initial when it is a known private name component, while keeping ordinary company initials visible.

• Hide known recipient names in Gmail label controls, including single-letter Unicode name components and encoded destinations. Close Interaction settings with Escape from a focused shortcut field.

• Integrate account setup, sync recovery, uncertain-send protection and reader navigation while preserving every original PR commit. Keep connection forms available during sync, context-menu Open working, and read-on-open active for history and Gmail IMAP All Mail.

• Verify the exact archived IMAP Message-ID before marking mail read; reject missing or mismatched search candidates.

• Mark mail read when moving through the open reader with j/k, and close the old reader when a number shortcut changes accounts.

• Keep the synthetic IMAP store until process exit so Windows does not try to delete an open SQLite file during test cleanup.

• Keep sender provider badges visible in compact rows and give Gmail/IMAP badges opaque rounded-square backgrounds instead of empty circular outlines.

• Add explicit Mark as read to the mail context menu, sharing queued provider updates and retryable errors with read-on-open.

• Adopt roomier macOS-style dark chrome across the toolbar, inbox, sender pane, Settings, menus and dialogs, with rounded controls, smooth programmatic scrolling and reduced-motion support; keep compact density available.

• Restore the mail context menu in the feature client: right-click or Shift+F10 on rows and opened messages for existing mail actions.

• Replace client action icons with consistent rounded outlines and use a vector Gmail mark in account filters, Settings and sender badges.

• Sync Gmail labels, filter cached mail by label, and edit existing custom labels on opened messages.

• Add Ctrl+Plus and Ctrl+Minus shortcuts for comfortable and compact inbox density.

• Mark opened unread mail read without dropping requests during other actions or sync; include archived Gmail mail and safely locate archived IMAP mail by Message-ID, with retryable errors.

• Open guided account setup directly from the inbox, with provider defaults, app-password help and errors that keep the form open for correction.

• Keep another provider's connection form open when Google sign-in finishes, including while its connection check is pending.

• Close the onboarding test database before removing its temporary directory so fixture cleanup works on Windows.

• Add Gmail and Google Workspace connections through TLS IMAP/SMTP with a Google app password, alongside configured Google sign-in. Keep the two connection methods separate and avoid duplicate Gmail Sent copies.

• Allow connecting additional mailboxes during sync and preserve renewed account credentials when an older sync finishes.

• Show fetched mail with local sorting while sync continues, then apply the configured AI sorting.

• Keep the opened message and reply target when background sorting moves mail to another category.

• Replace cached Gmail metadata reads with unread-ID lists, skip cached IMAP body downloads, and bound Gmail read and token-refresh waits.

• Add Retry connection in Settings using encrypted saved credentials. Duplicate requests share account work; a failed account can retry while another account syncs.

• Report fixed sync error categories and safe failure details. Contain IMAP transport errors, reject incomplete mailbox listings before archiving cached mail, and keep cleanup warnings separate from the sync outcome.

• Skip unchanged mail writes, commit changed batches in one transaction, and coalesce renderer refreshes. Keep fresh Gmail batches visible while later downloads run, including a final refresh queued during a failed read.

• Keep AI sorting limited to committed mail after a batch rollback and classify IMAP connection/greeting timeouts and closed connections as transient failures.

• Make the background AI-failure regression wait for sync completion without starting another sync that can clear the expected warning.

• Recover formatted email for older cached mail through the authenticated content API without changing body text or current mailbox state. Render a bounded safe subset of sender formatting; Show images remains blocked until per-opening activation.

• Add editable keyboard shortcuts and a single-click or double-click opening choice in Settings, with double-click as the default.

• Hide connected recipient names, first names and surnames alongside addresses in previews, headers and email content. Remove hidden values from rendered text, tooltips and accessibility labels; suppress private link destinations and body images in privacy mode.

• Keep recipient names hidden in Snooze, preserve supported images when empty or rejected formatted content falls back, and retain 15px paragraph text without image-status styling.

• Add visible Back and Forward controls and side mouse buttons for visited inbox contexts and emails, with session-only history and draft/dialog guards.

• Keep hidden-address bars within their text lines so adjacent sender details do not overlap.

• Make email bodies easier to read with bounded paragraph spacing, 15px text and a wrapping sender header, without changing stored text.

• Add per-message Show images for supported remote HTTPS images, blocked by default. Older cached mail loads image metadata on demand; older archived IMAP mail fails safely instead of reusing an INBOX UID.

• Preserve cached image metadata when an overlapping read or archive operation completes, and do not restore messages removed during that wait.

• Add contributor coordination guidance and issue templates to reduce duplicate and overlapping work.

• Keep uncertain sends as "Send status unknown" with the draft and a possible-delivery warning. Require duplicate-risk confirmation before sending again, including keyboard submission, and retain uncertainty through draft edits.

• Keep the native application-close prompt neutral about whether a draft was sent.

• Preserve confirmed send success when saving the Sent copy, closing its connection or refreshing the inbox fails. Treat an IMAP logout result of false as a cleanup warning.

• Close the synthetic send-test database before deleting its temporary files so Windows cleanup can release the directory.

0.1.5

• Ship the background tray, native new-mail notifications, shortcut bar, context menus, brand logos and UI refresh with Windows, macOS and Linux installers.
• Release every merged main push automatically as a patch version with published installers; minor and major releases stay manual.

0.1.4

• Show total GitHub installer downloads across Windows, macOS and Linux on the showcase website, with a ten-minute cache and the last successful count retained during GitHub outages.
• Rename the application to Emc². Installers are published as Emc²-0.1.4-win-x64.exe, Emc²-0.1.4-mac-arm64.dmg, Emc²-0.1.4-mac-x64.dmg and Emc²-0.1.4-linux-x64.AppImage.
• Carry an existing installation across the rename in one automatic step: the first launch under the new name moves mail, settings.env and Local State from the old app-data folder into the new one and marks the migration so it runs once. The old folder is left in place.
• Rename the local MCP server to emc2, so existing claude mcp add --transport http registrations must use the new name.
• Keep the Windows application id and the installer identity unchanged, so an installed copy is upgraded rather than installed alongside the old one.

0.1.3

• Add cross-platform CI and version-tag releases for Windows x64, macOS Apple silicon and Intel, and Linux x64 installers. Retain CI artifacts for one day and attach installer checksums to releases.
• Give each CI run and rerun a distinct application version and installer filename. Replace rebuilt platform artifacts on reruns. Keep tagged releases at the matching release version.
• Make HTTP and HTTPS URLs in email bodies clickable and keyboard accessible.
• Keep surrounding curly quotes outside email link destinations.
• Open HTTP links through the existing desktop browser handoff. Keep local API routes and unsupported protocols blocked.
• Keep message HTML escaped. In address privacy mode, mask URLs containing email addresses and omit their link targets.
• Record the inbox and Settings review in repository knowledge.
• Document the synthetic browser checks and the untested native Windows handoff.
• Add project agent instructions and contributor guidelines with repository links, verification commands and mail privacy safeguards.
• Add unsigned macOS DMG and ZIP packaging with a macOS icon derived from the existing artwork. The Windows installer command is unchanged.
• Add native macOS menus and spacing for window controls. Keep the mail service running when a user cancels quitting with an unsent draft.
• Use platform-neutral encryption errors and document macOS app-data storage.
• Exclude local environment files, private keys, mail databases and session records from packages, and expand Git ignore rules.

0.1.2

• Existing Windows release with sender logos, address privacy controls and MCP settings.