perf: cache Linux engine artifacts via flutter precache --linux (#129 )

Add flutter precache --linux --no-android --no-ios to toolchain() so the Linux engine binaries are baked into the execution-cache snapshot rather than downloaded on demand during each flutter build linux run.
fix: filter out schedule/deploy workflow runs in CI checks
2026-05-24 14:17:06 +02:00 · 2026-05-24 14:08:13 +02:00 · 2026-05-24 13:00:04 +02:00 · 2026-05-24 12:56:27 +02:00 · 2026-05-24 12:55:08 +02:00 · 2026-05-24 08:50:06 +02:00
24 changed files with 228 additions and 495 deletions
@@ -156,6 +156,7 @@ jobs:
        if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
          SSH_USER: ${{ secrets.SSH_USER }}
          SSH_HOST: ${{ secrets.SSH_HOST }}
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
@@ -197,6 +198,7 @@ jobs:
        if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
          SSH_USER: ${{ secrets.SSH_USER }}
          SSH_HOST: ${{ secrets.SSH_HOST }}
          DAGGER_NO_NAG: "1"
@@ -238,6 +240,7 @@ jobs:
        if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
          SSH_USER: ${{ secrets.SSH_USER }}
          SSH_HOST: ${{ secrets.SSH_HOST }}
          DAGGER_NO_NAG: "1"
@@ -202,6 +202,8 @@ jobs:
          mkdir -p ~/.ssh
          printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
+          printf '%s\n' "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
+          chmod 644 ~/.ssh/known_hosts

      - name: Build Linux release
        run: |
@@ -215,20 +217,20 @@ jobs:
          REMOTE_DIR="public_html/builds/$DATE_PATH"
          TARBALL="sharedinbox-linux-amd64-$HASH.tar.gz"
          tar -czf /tmp/$TARBALL -C build/linux/x64/release bundle
-          ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
-          scp -o StrictHostKeyChecking=no /tmp/$TARBALL "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$TARBALL"
+          ssh "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
+          scp /tmp/$TARBALL "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$TARBALL"
          DOWNLOAD_URL="https://sharedinbox.de/builds/$DATE_PATH/$TARBALL"
-          EXISTING=$(ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" \
+          EXISTING=$(ssh "$SSH_USER@$SSH_HOST" \
            "cat public_html/latest.json 2>/dev/null || echo '{}'")
          WINDOWS_URL=$(echo "$EXISTING" | \
            python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('windows',''))" \
            2>/dev/null || true)
          if [ -n "$WINDOWS_URL" ]; then
            echo "{\"version\":\"$HASH\",\"linux\":\"$DOWNLOAD_URL\",\"windows\":\"$WINDOWS_URL\"}" | \
-              ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+              ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
          else
            echo "{\"version\":\"$HASH\",\"linux\":\"$DOWNLOAD_URL\"}" | \
-              ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+              ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
          fi

      - name: Generate build history pages
@@ -244,6 +246,5 @@ jobs:
          rsync -avz --delete \
            --exclude='*.apk' \
            --exclude='*.tar.gz' \
-            -e "ssh -o StrictHostKeyChecking=no" \
            website/public/ \
            "$SSH_USER@$SSH_HOST:public_html/"
@@ -215,8 +215,10 @@ tasks:
    preconditions:
      - sh: test -n "$SSH_PRIVATE_KEY"
        msg: "SSH_PRIVATE_KEY is not set"
+      - sh: test -n "$SSH_KNOWN_HOSTS"
+        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
-      - HASH=$(git rev-parse --short HEAD) && dagger call --progress=plain -q -m ci --source=. deploy-linux --ssh-key env:SSH_PRIVATE_KEY --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST" --commit-hash "$HASH"
+      - HASH=$(git rev-parse --short HEAD) && dagger call --progress=plain -q -m ci --source=. deploy-linux --ssh-key env:SSH_PRIVATE_KEY --known-hosts env:SSH_KNOWN_HOSTS --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST" --commit-hash "$HASH"

  build-android-bundle:
    desc: Build AAB via Dagger (cached, versionCode=1 placeholder) and export locally
@@ -251,17 +253,24 @@ tasks:
    preconditions:
      - sh: test -n "$SSH_PRIVATE_KEY"
        msg: "SSH_PRIVATE_KEY is not set"
+      - sh: test -n "$SSH_KNOWN_HOSTS"
+        msg: "SSH_KNOWN_HOSTS is not set"
      - sh: test -n "$ANDROID_KEYSTORE_BASE64"
        msg: "ANDROID_KEYSTORE_BASE64 is not set"
      - sh: test -n "$ANDROID_KEYSTORE_PASSWORD"
        msg: "ANDROID_KEYSTORE_PASSWORD is not set"
    cmds:
-      - HASH=$(git rev-parse --short HEAD) && dagger call --progress=plain -q -m ci --source=. deploy-apk --ssh-key env:SSH_PRIVATE_KEY --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST" --commit-hash "$HASH" --keystore-base64 env:ANDROID_KEYSTORE_BASE64 --keystore-password env:ANDROID_KEYSTORE_PASSWORD --build-number "$(git log -1 --format=%ct HEAD)"
+      - HASH=$(git rev-parse --short HEAD) && dagger call --progress=plain -q -m ci --source=. deploy-apk --ssh-key env:SSH_PRIVATE_KEY --known-hosts env:SSH_KNOWN_HOSTS --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST" --commit-hash "$HASH" --keystore-base64 env:ANDROID_KEYSTORE_BASE64 --keystore-password env:ANDROID_KEYSTORE_PASSWORD --build-number "$(git log -1 --format=%ct HEAD)"

  publish-website:
    desc: Build and publish website via Dagger
+    preconditions:
+      - sh: test -n "$SSH_PRIVATE_KEY"
+        msg: "SSH_PRIVATE_KEY is not set"
+      - sh: test -n "$SSH_KNOWN_HOSTS"
+        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
-      - dagger call --progress=plain -q -m ci --source=. publish-website --ssh-key file:$HOME/.ssh/id_ed25519 --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST"
+      - dagger call --progress=plain -q -m ci --source=. publish-website --ssh-key env:SSH_PRIVATE_KEY --known-hosts env:SSH_KNOWN_HOSTS --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST"

  check-dagger:
    desc: Run full check suite via Dagger (with OTEL timing report if python3 is available)
@@ -373,25 +382,29 @@ tasks:
        msg: "SSH_USER is not set"
      - sh: test -n "$SSH_HOST"
        msg: "SSH_HOST is not set"
+      - sh: test -n "$SSH_KNOWN_HOSTS"
+        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
      - |
+        mkdir -p ~/.ssh
+        printf '%s\n' "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        HASH=$(git rev-parse --short HEAD)
        DATE_PATH=$(date -u +%Y/%m/%d)
        REMOTE_DIR="public_html/builds/$DATE_PATH"
        TARBALL="sharedinbox-linux-amd64-$HASH.tar.gz"
        tar -czf /tmp/$TARBALL -C build/linux/x64/release bundle
-        ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
-        scp -o StrictHostKeyChecking=no /tmp/$TARBALL "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$TARBALL"
+        ssh "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
+        scp /tmp/$TARBALL "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$TARBALL"
        DOWNLOAD_URL="https://sharedinbox.de/builds/$DATE_PATH/$TARBALL"
        # Merge with any existing latest.json so we don't overwrite the windows key
-        EXISTING=$(ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat public_html/latest.json 2>/dev/null || echo '{}'")
+        EXISTING=$(ssh "$SSH_USER@$SSH_HOST" "cat public_html/latest.json 2>/dev/null || echo '{}'")
        WINDOWS_URL=$(echo "$EXISTING" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('windows',''))" 2>/dev/null || true)
        if [ -n "$WINDOWS_URL" ]; then
          echo "{\"version\":\"$HASH\",\"linux\":\"$DOWNLOAD_URL\",\"windows\":\"$WINDOWS_URL\"}" | \
-            ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+            ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
        else
          echo "{\"version\":\"$HASH\",\"linux\":\"$DOWNLOAD_URL\"}" | \
-            ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+            ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
        fi
        echo "Uploaded $TARBALL and updated latest.json"

@@ -416,24 +429,28 @@ tasks:
        msg: "SSH_USER is not set"
      - sh: test -n "$SSH_HOST"
        msg: "SSH_HOST is not set"
+      - sh: test -n "$SSH_KNOWN_HOSTS"
+        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
      - |
+        mkdir -p ~/.ssh
+        printf '%s\n' "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        HASH=$(git rev-parse --short HEAD)
        DATE_PATH=$(date -u +%Y/%m/%d)
        REMOTE_DIR="public_html/builds/$DATE_PATH"
        ZIPFILE="sharedinbox-windows-x64-$HASH.zip"
        cd build/windows/x64/runner && zip -r /tmp/$ZIPFILE Release/ && cd -
-        ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
-        scp -o StrictHostKeyChecking=no /tmp/$ZIPFILE "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$ZIPFILE"
+        ssh "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
+        scp /tmp/$ZIPFILE "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$ZIPFILE"
        DOWNLOAD_URL="https://sharedinbox.de/builds/$DATE_PATH/$ZIPFILE"
-        EXISTING=$(ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat public_html/latest.json 2>/dev/null || echo '{}'")
+        EXISTING=$(ssh "$SSH_USER@$SSH_HOST" "cat public_html/latest.json 2>/dev/null || echo '{}'")
        LINUX_URL=$(echo "$EXISTING" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('linux',''))" 2>/dev/null || true)
        if [ -n "$LINUX_URL" ]; then
          echo "{\"version\":\"$HASH\",\"linux\":\"$LINUX_URL\",\"windows\":\"$DOWNLOAD_URL\"}" | \
-            ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+            ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
        else
          echo "{\"version\":\"$HASH\",\"windows\":\"$DOWNLOAD_URL\"}" | \
-            ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+            ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
        fi
        echo "Uploaded $ZIPFILE and updated latest.json"

@@ -583,14 +600,18 @@ tasks:
        msg: "SSH_USER is not set"
      - sh: test -n "$SSH_HOST"
        msg: "SSH_HOST is not set"
+      - sh: test -n "$SSH_KNOWN_HOSTS"
+        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
      - |
+        mkdir -p ~/.ssh
+        printf '%s\n' "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        HASH=$(git rev-parse --short HEAD)
        DATE_PATH=$(date -u +%Y/%m/%d)
        REMOTE_DIR="public_html/builds/$DATE_PATH"
        APK_NAME="sharedinbox-mua-$HASH.apk"
-        ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
-        scp -o StrictHostKeyChecking=no \
+        ssh "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
+        scp \
          build/app/outputs/flutter-apk/app-release.apk \
          "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$APK_NAME"
        echo "Uploaded $APK_NAME to $REMOTE_DIR"
@@ -619,12 +640,16 @@ tasks:
  website-deploy:
    desc: Deploy the website via rsync to public_html
    deps: [website-build]
+    preconditions:
+      - sh: test -n "$SSH_KNOWN_HOSTS"
+        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
      - |
+        mkdir -p ~/.ssh
+        printf '%s\n' "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        rsync -avz --delete \
          --exclude='*.apk' \
          --exclude='*.tar.gz' \
-          -e "ssh -o StrictHostKeyChecking=no" \
          website/public/ \
          ${SSH_USER}@${SSH_HOST}:public_html/

@@ -195,7 +195,8 @@ func (m *Ci) toolchain() *dagger.Container {
 		WithUser("ci").
 		WithExec([]string{"/bin/sh", "-c",
 			`tmp=$(mktemp); trap 'rm -f "$tmp"' EXIT; ` +
-				`yes | sdkmanager "ndk;28.2.13676358" "cmake;3.22.1" "build-tools;35.0.0" "platforms;android-34" >"$tmp" 2>&1 || { cat "$tmp"; exit 1; }`})
+				`yes | sdkmanager "ndk;28.2.13676358" "cmake;3.22.1" "build-tools;35.0.0" "platforms;android-34" >"$tmp" 2>&1 || { cat "$tmp"; exit 1; }`}).
+		WithExec([]string{"flutter", "precache", "--linux", "--no-android", "--no-ios"})
 }

 // Base is the Flutter toolchain container with mutable cache mounts attached.
@@ -318,12 +319,13 @@ func (m *Ci) Hugo() *dagger.Container {
 }

 // Deploy container for rsync/ssh
-func (m *Ci) Deployer(sshKey *dagger.Secret) *dagger.Container {
+func (m *Ci) Deployer(sshKey *dagger.Secret, knownHosts *dagger.Secret) *dagger.Container {
 	return dag.Container().
 		From("alpine:3.21").
 		WithExec([]string{"apk", "--no-cache", "add", "rsync", "openssh-client", "python3", "tar"}).
 		WithMountedSecret("/root/.ssh/id_ed25519", sshKey, dagger.ContainerWithMountedSecretOpts{Mode: 0600}).
-		WithEnvVariable("RSYNC_RSH", "ssh -o StrictHostKeyChecking=no -i /root/.ssh/id_ed25519")
+		WithMountedSecret("/root/.ssh/known_hosts", knownHosts, dagger.ContainerWithMountedSecretOpts{Mode: 0644}).
+		WithEnvVariable("RSYNC_RSH", "ssh -i /root/.ssh/id_ed25519")
 }

 // Stalwart mail server service for backend and integration tests.
@@ -514,6 +516,7 @@ func (m *Ci) Check(ctx context.Context) (string, error) {
 func (m *Ci) GenerateBuildHistory(
 	ctx context.Context,
 	sshKey *dagger.Secret,
+	knownHosts *dagger.Secret,
 	sshUser string,
 	sshHost string,
 ) *dagger.Directory {
@@ -525,7 +528,7 @@ func (m *Ci) GenerateBuildHistory(
 		From("python:3.12-alpine").
 		WithExec([]string{"apk", "add", "--no-cache", "openssh-client"}).
 		WithMountedSecret("/root/.ssh/id_ed25519", sshKey, dagger.ContainerWithMountedSecretOpts{Mode: 0600}).
-		WithExec([]string{"chmod", "700", "/root/.ssh"}).
+		WithMountedSecret("/root/.ssh/known_hosts", knownHosts, dagger.ContainerWithMountedSecretOpts{Mode: 0644}).
 		WithEnvVariable("SSH_USER", sshUser).
 		WithEnvVariable("SSH_HOST", sshHost).
 		WithDirectory("/src", scriptSource).
@@ -538,10 +541,11 @@ func (m *Ci) GenerateBuildHistory(
 func (m *Ci) BuildWebsite(
 	ctx context.Context,
 	sshKey *dagger.Secret,
+	knownHosts *dagger.Secret,
 	sshUser string,
 	sshHost string,
 ) *dagger.Directory {
-	buildHistory := m.GenerateBuildHistory(ctx, sshKey, sshUser, sshHost)
+	buildHistory := m.GenerateBuildHistory(ctx, sshKey, knownHosts, sshUser, sshHost)

 	websiteSource := m.Source.Filter(dagger.DirectoryFilterOpts{
 		Include: []string{"website/"},
@@ -558,12 +562,13 @@ func (m *Ci) BuildWebsite(
 func (m *Ci) PublishWebsite(
 	ctx context.Context,
 	sshKey *dagger.Secret,
+	knownHosts *dagger.Secret,
 	sshUser string,
 	sshHost string,
 ) (string, error) {
-	public := m.BuildWebsite(ctx, sshKey, sshUser, sshHost)
+	public := m.BuildWebsite(ctx, sshKey, knownHosts, sshUser, sshHost)

-	return m.Deployer(sshKey).
+	return m.Deployer(sshKey, knownHosts).
 		WithDirectory("/public", public).
 		WithExec([]string{"rsync", "-avz", "--delete",
 			"--exclude=*.apk", "--exclude=*.tar.gz",
@@ -589,6 +594,7 @@ func (m *Ci) BuildLinuxRelease() *dagger.Directory {
 func (m *Ci) DeployLinux(
 	ctx context.Context,
 	sshKey *dagger.Secret,
+	knownHosts *dagger.Secret,
 	sshUser string,
 	sshHost string,
 	commitHash string,
@@ -599,11 +605,11 @@ func (m *Ci) DeployLinux(
 	remoteDir := fmt.Sprintf("public_html/builds/%s", datePath)
 	tarball := fmt.Sprintf("sharedinbox-linux-amd64-%s.tar.gz", commitHash)

-	return m.Deployer(sshKey).
+	return m.Deployer(sshKey, knownHosts).
 		WithDirectory("/bundle", bundle).
 		WithExec([]string{"/bin/sh", "-c", fmt.Sprintf("tar -czf /tmp/%s -C /bundle .", tarball)}).
-		WithExec([]string{"ssh", "-o", "StrictHostKeyChecking=no", "-i", "/root/.ssh/id_ed25519", fmt.Sprintf("%s@%s", sshUser, sshHost), fmt.Sprintf("mkdir -p %s", remoteDir)}).
-		WithExec([]string{"/bin/sh", "-c", fmt.Sprintf("scp -o StrictHostKeyChecking=no -i /root/.ssh/id_ed25519 /tmp/%s %s@%s:%s/%s", tarball, sshUser, sshHost, remoteDir, tarball)}).
+		WithExec([]string{"ssh", "-i", "/root/.ssh/id_ed25519", fmt.Sprintf("%s@%s", sshUser, sshHost), fmt.Sprintf("mkdir -p %s", remoteDir)}).
+		WithExec([]string{"/bin/sh", "-c", fmt.Sprintf("scp -i /root/.ssh/id_ed25519 /tmp/%s %s@%s:%s/%s", tarball, sshUser, sshHost, remoteDir, tarball)}).
 		Stdout(ctx)
 }

@@ -626,6 +632,7 @@ func (m *Ci) BuildAndroidApk(keystoreBase64 *dagger.Secret, keystorePassword *da
 func (m *Ci) DeployApk(
 	ctx context.Context,
 	sshKey *dagger.Secret,
+	knownHosts *dagger.Secret,
 	sshUser string,
 	sshHost string,
 	commitHash string,
@@ -639,10 +646,10 @@ func (m *Ci) DeployApk(
 	remoteDir := fmt.Sprintf("public_html/builds/%s", datePath)
 	apkName := fmt.Sprintf("sharedinbox-mua-%s.apk", commitHash)

-	return m.Deployer(sshKey).
+	return m.Deployer(sshKey, knownHosts).
 		WithFile("/tmp/app.apk", apk).
-		WithExec([]string{"ssh", "-o", "StrictHostKeyChecking=no", "-i", "/root/.ssh/id_ed25519", fmt.Sprintf("%s@%s", sshUser, sshHost), fmt.Sprintf("mkdir -p %s", remoteDir)}).
-		WithExec([]string{"/bin/sh", "-c", fmt.Sprintf("scp -o StrictHostKeyChecking=no -i /root/.ssh/id_ed25519 /tmp/app.apk %s@%s:%s/%s", sshUser, sshHost, remoteDir, apkName)}).
+		WithExec([]string{"ssh", "-i", "/root/.ssh/id_ed25519", fmt.Sprintf("%s@%s", sshUser, sshHost), fmt.Sprintf("mkdir -p %s", remoteDir)}).
+		WithExec([]string{"/bin/sh", "-c", fmt.Sprintf("scp -i /root/.ssh/id_ed25519 /tmp/app.apk %s@%s:%s/%s", sshUser, sshHost, remoteDir, apkName)}).
 		Stdout(ctx)
 }

@@ -804,7 +811,7 @@ func (m *Ci) Graph() string {
 ` + "```" + `mermaid
 flowchart TD
    subgraph dagger ["Dagger · Check pipeline"]
-        toolchain["toolchain\nflutter:3.41.6 + NDK + apt"]
+        toolchain["toolchain\nflutter:3.41.6 + NDK + apt + precache"]
        pubGet["pubGetLayer\nflutter pub get"]
        codegen["codegenBase\nbuild_runner build\n(shared cache)"]
        stalwart(["Stalwart service\nIMAP · JMAP · SMTP · Sieve"])
@@ -19,8 +19,6 @@ class SyncLogEntry {
    required this.id,
    required this.result,
    this.errorMessage,
-    this.stackTrace,
-    this.isPermanent,
    required this.protocol,
    required this.emailsFetched,
    required this.emailsSkipped,
@@ -36,8 +34,6 @@ class SyncLogEntry {
  final int id;
  final String result; // 'ok' or 'error'
  final String? errorMessage;
-  final String? stackTrace;
-  final bool? isPermanent;
  final String protocol; // 'imap' or 'jmap'
  final int emailsFetched;
  final int emailsSkipped;
@@ -58,8 +54,6 @@ abstract class SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool? isPermanent,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -87,8 +81,6 @@ class NoOpSyncLogRepository implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool? isPermanent,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -260,8 +260,6 @@ class _AccountSync implements _SyncLoop {
            accountId: account.id,
            success: false,
            errorMessage: e.toString(),
-            stackTrace: st.toString(),
-            isPermanent: isPermanent,
            protocol: 'imap',
            emailsFetched: 0,
            emailsSkipped: 0,
@@ -515,8 +513,6 @@ class _JmapAccountSync implements _SyncLoop {
            accountId: account.id,
            success: false,
            errorMessage: e.toString(),
-            stackTrace: st.toString(),
-            isPermanent: isPermanent,
            protocol: 'jmap',
            emailsFetched: 0,
            emailsSkipped: 0,
@@ -192,10 +192,6 @@ class SyncLogs extends Table {
  DateTimeColumn get finishedAt => dateTime()();
  // Added in schema v13: raw protocol log when account.verbose == true.
  TextColumn get protocolLog => text().nullable()();
-  // Added in schema v33: stack trace captured when an error occurs.
-  TextColumn get stackTrace => text().nullable()();
-  // Added in schema v33: whether the sync loop stopped permanently after this error.
-  BoolColumn get isPermanent => boolean().nullable()();
 }

 /// Per-mailbox breakdown for a single sync cycle.
@@ -333,7 +329,7 @@ class AppDatabase extends _$AppDatabase {
  AppDatabase([QueryExecutor? executor]) : super(executor ?? _openConnection());

  @override
-  int get schemaVersion => 33;
+  int get schemaVersion => 32;

  Future<void> _createEmailFts() async {
    await customStatement('''
@@ -574,10 +570,6 @@ class AppDatabase extends _$AppDatabase {
          if (from < 32) {
            await m.createTable(localSieveApplied);
          }
-          if (from >= 7 && from < 33) {
-            await m.addColumn(syncLogs, syncLogs.stackTrace);
-            await m.addColumn(syncLogs, syncLogs.isPermanent);
-          }
        },
      );
 }
@@ -13,8 +13,6 @@ class SyncLogRepositoryImpl implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool? isPermanent,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -32,8 +30,6 @@ class SyncLogRepositoryImpl implements SyncLogRepository {
              accountId: accountId,
              result: success ? 'ok' : 'error',
              errorMessage: Value(errorMessage),
-              stackTrace: Value(stackTrace),
-              isPermanent: Value(isPermanent),
              protocol: Value(protocol),
              itemsSynced: Value(emailsFetched),
              emailsSkipped: Value(emailsSkipped),
@@ -79,8 +75,6 @@ class SyncLogRepositoryImpl implements SyncLogRepository {
            id: r.id,
            result: r.result,
            errorMessage: r.errorMessage,
-            stackTrace: r.stackTrace,
-            isPermanent: r.isPermanent,
            protocol: r.protocol,
            emailsFetched: r.itemsSynced,
            emailsSkipped: r.emailsSkipped,
@@ -1,4 +1,5 @@
 import 'dart:async';
+import 'dart:io';

 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
@@ -7,7 +8,6 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:package_info_plus/package_info_plus.dart';
 import 'package:sharedinbox/core/models/account.dart';
 import 'package:sharedinbox/di.dart';
-import 'package:sharedinbox/ui/utils/about_markdown.dart';
 import 'package:url_launcher/url_launcher.dart';

 class AboutScreen extends ConsumerStatefulWidget {
@@ -19,16 +19,57 @@ class AboutScreen extends ConsumerStatefulWidget {

 class _AboutScreenState extends ConsumerState<AboutScreen> {
  final Future<PackageInfo> _packageInfoFuture = PackageInfo.fromPlatform();
-  late final Future<Map<String, String>> _deviceInfoFuture =
-      fetchAndroidDeviceInfo();
  late final Stream<List<Account>> _accountsStream;

+  static const _gitHash = String.fromEnvironment('GIT_HASH');
+
  @override
  void initState() {
    super.initState();
    _accountsStream = ref.read(accountRepositoryProvider).observeAccounts();
  }

+  String _buildMarkdown(
+    BuildContext context,
+    PackageInfo? pkg,
+    int imapCount,
+    int jmapCount,
+  ) {
+    final size = MediaQuery.of(context).size;
+    final pixelRatio = MediaQuery.of(context).devicePixelRatio;
+    final physW = (size.width * pixelRatio).toInt();
+    final physH = (size.height * pixelRatio).toInt();
+    final version =
+        pkg != null ? '${pkg.version}+${pkg.buildNumber}' : 'unknown';
+    final versionDisplay = _gitHash.isNotEmpty
+        ? '[$version](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash)'
+        : version;
+    final osName = _capitalize(Platform.operatingSystem);
+    final isDark = MediaQuery.of(context).platformBrightness == Brightness.dark;
+
+    final gitCommitLine = _gitHash.isNotEmpty
+        ? '| Git Commit | [$_gitHash](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash) |\n'
+        : '';
+    return '## [sharedinbox.de](https://sharedinbox.de)\n\n'
+        '| Property | Value |\n'
+        '|----------|-------|\n'
+        '| App Version | $versionDisplay |\n'
+        '$gitCommitLine'
+        '| Platform | ${Platform.operatingSystem} |\n'
+        '| $osName Version | ${Platform.operatingSystemVersion} |\n'
+        '| Resolution | ${physW}x$physH px'
+        ' (logical: ${size.width.toInt()}x${size.height.toInt()} pt,'
+        ' ratio: ${pixelRatio.toStringAsFixed(1)}x) |\n'
+        '| Dart Version | ${Platform.version.split(' ').first} |\n'
+        '| Processors | ${Platform.numberOfProcessors} |\n'
+        '| Dark Mode | ${isDark ? 'yes' : 'no'} |\n'
+        '| IMAP Accounts | $imapCount |\n'
+        '| JMAP Accounts | $jmapCount |\n';
+  }
+
+  static String _capitalize(String s) =>
+      s.isEmpty ? s : '${s[0].toUpperCase()}${s.substring(1)}';
+
  Future<void> _copyToClipboard(
    BuildContext context,
    int imapCount,
@@ -38,12 +79,10 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
    try {
      pkg = await _packageInfoFuture;
    } catch (_) {}
-    final deviceInfo = await _deviceInfoFuture;
    if (!context.mounted) return;
    await Clipboard.setData(
      ClipboardData(
-        text:
-            buildAboutMarkdown(context, pkg, imapCount, jmapCount, deviceInfo),
+        text: _buildMarkdown(context, pkg, imapCount, jmapCount),
      ),
    );
    if (context.mounted) {
@@ -65,10 +104,9 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
    try {
      pkg = await _packageInfoFuture;
    } catch (_) {}
-    final deviceInfo = await _deviceInfoFuture;
    if (!context.mounted) return;
    final body = Uri.encodeComponent(
-      buildAboutMarkdown(context, pkg, imapCount, jmapCount, deviceInfo),
+      _buildMarkdown(context, pkg, imapCount, jmapCount),
    );
    final url = Uri.parse(
      'https://codeberg.org/guettli/sharedinbox/issues/new?body=$body',
@@ -112,31 +150,18 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
          body: Column(
            children: [
              Expanded(
-                child: FutureBuilder<(PackageInfo?, Map<String, String>)>(
-                  future: Future.wait([
-                    _packageInfoFuture.then<PackageInfo?>((p) => p).catchError(
-                          (_) => null,
-                        ),
-                    _deviceInfoFuture,
-                  ]).then(
-                    (results) => (
-                      results[0] as PackageInfo?,
-                      results[1] as Map<String, String>,
-                    ),
-                  ),
+                child: FutureBuilder<PackageInfo>(
+                  future: _packageInfoFuture,
                  builder: (context, snapshot) {
                    if (snapshot.connectionState == ConnectionState.waiting) {
                      return const Center(child: CircularProgressIndicator());
                    }
-                    final pkg = snapshot.data?.$1;
-                    final deviceInfo = snapshot.data?.$2 ?? {};
                    return Markdown(
-                      data: buildAboutMarkdown(
+                      data: _buildMarkdown(
                        context,
-                        pkg,
+                        snapshot.data,
                        imapCount,
                        jmapCount,
-                        deviceInfo,
                      ),
                      selectable: true,
                      onTapLink: (text, href, title) {
@@ -1,6 +1,7 @@
 import 'dart:async';

 import 'package:flutter/material.dart';
+import 'package:flutter/services.dart' show rootBundle;
 import 'package:flutter_markdown_plus/flutter_markdown_plus.dart';
 import 'package:url_launcher/url_launcher.dart';

@@ -12,8 +13,7 @@ class ChangeLogScreen extends StatelessWidget {
    return Scaffold(
      appBar: AppBar(title: const Text('ChangeLog')),
      body: FutureBuilder<String>(
-        future:
-            DefaultAssetBundle.of(context).loadString('assets/changelog.txt'),
+        future: rootBundle.loadString('assets/changelog.txt'),
        builder: (context, snapshot) {
          if (snapshot.connectionState == ConnectionState.waiting) {
            return const Center(child: CircularProgressIndicator());
@@ -1,15 +1,11 @@
 import 'dart:async';

 import 'package:flutter/material.dart';
-import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:intl/intl.dart';
-import 'package:package_info_plus/package_info_plus.dart';

-import 'package:sharedinbox/core/models/account.dart';
 import 'package:sharedinbox/core/repositories/sync_log_repository.dart';
 import 'package:sharedinbox/di.dart';
-import 'package:sharedinbox/ui/utils/about_markdown.dart';

 final _timeFmt = DateFormat('MMM d, HH:mm:ss');

@@ -25,81 +21,6 @@ String _fmtBytes(int bytes) {
  return '${(bytes / (1024 * 1024)).toStringAsFixed(1)} MB';
 }

-/// Generates a markdown string for a single sync log entry.
-String buildSyncLogEntryMarkdown(SyncLogEntry entry) {
-  final timeFmt = DateFormat('MMM d, HH:mm:ss');
-  final proto =
-      entry.protocol.isEmpty ? '' : ' (${entry.protocol.toUpperCase()})';
-  final title = entry.isOk
-      ? 'Sync OK — ${timeFmt.format(entry.startedAt)}$proto'
-      : 'Sync Error — ${timeFmt.format(entry.startedAt)}$proto';
-
-  final resultLabel = entry.isOk
-      ? 'OK'
-      : entry.isPermanent == true
-          ? 'Error (permanent — sync stopped)'
-          : 'Error (will retry)';
-
-  final buf = StringBuffer();
-  buf.writeln('## $title');
-  buf.writeln();
-  buf.writeln('| Property | Value |');
-  buf.writeln('|----------|-------|');
-  buf.writeln('| Result | $resultLabel |');
-  if (entry.protocol.isNotEmpty) {
-    buf.writeln('| Protocol | ${entry.protocol.toUpperCase()} |');
-  }
-  buf.writeln('| Started | ${timeFmt.format(entry.startedAt)} |');
-  buf.writeln('| Finished | ${timeFmt.format(entry.finishedAt)} |');
-  buf.writeln('| Duration | ${_fmtDuration(entry.duration)} |');
-  buf.writeln('| Emails fetched | ${entry.emailsFetched} |');
-  buf.writeln('| Emails up-to-date | ${entry.emailsSkipped} |');
-  buf.writeln('| Mailboxes synced | ${entry.mailboxesSynced} |');
-  buf.writeln('| Pending changes flushed | ${entry.pendingFlushed} |');
-  buf.writeln('| Data transferred | ${_fmtBytes(entry.bytesTransferred)} |');
-
-  if (entry.mailboxStats.isNotEmpty) {
-    buf.writeln();
-    buf.writeln('### Per Mailbox');
-    buf.writeln();
-    buf.writeln('| Mailbox | Fetched | Up-to-date | Duration |');
-    buf.writeln('|---------|---------|------------|----------|');
-    for (final m in entry.mailboxStats) {
-      final dur = m.duration != null ? _fmtDuration(m.duration!) : '—';
-      buf.writeln('| ${m.mailboxPath} | ${m.fetched} | ${m.skipped} | $dur |');
-    }
-  }
-
-  if (entry.errorMessage != null) {
-    buf.writeln();
-    buf.writeln('### Error Message');
-    buf.writeln();
-    buf.writeln('```');
-    buf.writeln(entry.errorMessage);
-    buf.writeln('```');
-  }
-
-  if (entry.stackTrace != null) {
-    buf.writeln();
-    buf.writeln('### Stack Trace');
-    buf.writeln();
-    buf.writeln('```');
-    buf.writeln(entry.stackTrace);
-    buf.writeln('```');
-  }
-
-  if (entry.protocolLog != null) {
-    buf.writeln();
-    buf.writeln('### Protocol Log');
-    buf.writeln();
-    buf.writeln('```');
-    buf.writeln(entry.protocolLog);
-    buf.writeln('```');
-  }
-
-  return buf.toString().trimRight();
-}
-
 class SyncLogScreen extends ConsumerStatefulWidget {
  const SyncLogScreen({super.key, required this.accountId});

@@ -148,41 +69,6 @@ class _SyncLogScreenState extends ConsumerState<SyncLogScreen> {
    ref.read(syncManagerProvider).syncNow(widget.accountId);
  }

-  Future<void> _copyEntry(SyncLogEntry entry) async {
-    PackageInfo? pkg;
-    try {
-      pkg = await PackageInfo.fromPlatform();
-    } catch (_) {}
-    final deviceInfo = await fetchAndroidDeviceInfo();
-    if (!mounted) return;
-
-    final accounts =
-        await ref.read(accountRepositoryProvider).observeAccounts().first;
-    final imapCount = accounts.where((a) => a.type == AccountType.imap).length;
-    final jmapCount = accounts.where((a) => a.type == AccountType.jmap).length;
-
-    if (!mounted) return;
-    final entryMd = buildSyncLogEntryMarkdown(entry);
-    final aboutMd = buildAboutMarkdown(
-      context,
-      pkg,
-      imapCount,
-      jmapCount,
-      deviceInfo,
-    );
-    await Clipboard.setData(
-      ClipboardData(text: '$entryMd\n\n---\n\n$aboutMd'),
-    );
-    if (mounted) {
-      ScaffoldMessenger.of(context).showSnackBar(
-        const SnackBar(
-          duration: Duration(seconds: 3),
-          content: Text('Copied to clipboard'),
-        ),
-      );
-    }
-  }
-
  @override
  Widget build(BuildContext context) {
    return Scaffold(
@@ -210,20 +96,16 @@ class _SyncLogScreenState extends ConsumerState<SyncLogScreen> {
          ? const Center(child: Text('No sync entries yet'))
          : ListView.builder(
              itemCount: _entries.length,
-              itemBuilder: (ctx, i) => _SyncLogTile(
-                entry: _entries[i],
-                onCopy: () => unawaited(_copyEntry(_entries[i])),
-              ),
+              itemBuilder: (ctx, i) => _SyncLogTile(entry: _entries[i]),
            ),
    );
  }
 }

 class _SyncLogTile extends StatelessWidget {
-  const _SyncLogTile({required this.entry, required this.onCopy});
+  const _SyncLogTile({required this.entry});

  final SyncLogEntry entry;
-  final VoidCallback onCopy;

  @override
  Widget build(BuildContext context) {
@@ -245,20 +127,9 @@ class _SyncLogTile extends StatelessWidget {
      subtitle: Text(
        entry.isOk
            ? '${entry.emailsFetched} new · ${entry.emailsSkipped} up-to-date · took $durationLabel'
-            : 'Error${entry.isPermanent == true ? ' (permanent)' : ''} · took $durationLabel',
+            : 'Error · took $durationLabel',
        style: TextStyle(fontSize: 12, color: entry.isOk ? null : errorColor),
      ),
-      trailing: Row(
-        mainAxisSize: MainAxisSize.min,
-        children: [
-          IconButton(
-            icon: const Icon(Icons.copy, size: 18),
-            tooltip: 'Copy to clipboard',
-            onPressed: onCopy,
-          ),
-          const Icon(Icons.expand_more),
-        ],
-      ),
      children: [
        Padding(
          padding: const EdgeInsets.fromLTRB(72, 0, 16, 12),
@@ -300,18 +171,6 @@ class _SyncLogTile extends StatelessWidget {
                    style: TextStyle(color: errorColor, fontSize: 12),
                  ),
                ),
-              if (entry.stackTrace != null)
-                Padding(
-                  padding: const EdgeInsets.only(top: 4),
-                  child: Text(
-                    entry.stackTrace!,
-                    style: TextStyle(
-                      color: errorColor,
-                      fontSize: 10,
-                      fontFamily: 'monospace',
-                    ),
-                  ),
-                ),
              if (entry.protocolLog != null) ...[
                const Padding(
                  padding: EdgeInsets.only(top: 6, bottom: 2),
@@ -1,73 +0,0 @@
-import 'dart:io';
-
-import 'package:device_info_plus/device_info_plus.dart';
-import 'package:flutter/material.dart';
-import 'package:package_info_plus/package_info_plus.dart';
-
-const _gitHash = String.fromEnvironment('GIT_HASH');
-
-/// Returns Android device info (manufacturer, model, OS release).
-/// Returns an empty map on non-Android platforms or if the plugin fails.
-Future<Map<String, String>> fetchAndroidDeviceInfo() async {
-  if (!Platform.isAndroid) return {};
-  try {
-    final info = await DeviceInfoPlugin().androidInfo;
-    return {
-      'Manufacturer': info.manufacturer,
-      'Model': info.model,
-      'Android Version': info.version.release,
-    };
-  } catch (_) {
-    return {};
-  }
-}
-
-String _capitalize(String s) =>
-    s.isEmpty ? s : '${s[0].toUpperCase()}${s.substring(1)}';
-
-/// Builds the standard "about" markdown table for sharing / bug reports.
-///
-/// Pass [deviceInfo] from [fetchAndroidDeviceInfo].
-/// Pass [imapCount] and [jmapCount] when available; both default to 0.
-String buildAboutMarkdown(
-  BuildContext context,
-  PackageInfo? pkg,
-  int imapCount,
-  int jmapCount,
-  Map<String, String> deviceInfo,
-) {
-  final size = MediaQuery.of(context).size;
-  final pixelRatio = MediaQuery.of(context).devicePixelRatio;
-  final physW = (size.width * pixelRatio).toInt();
-  final physH = (size.height * pixelRatio).toInt();
-  final version = pkg != null ? '${pkg.version}+${pkg.buildNumber}' : 'unknown';
-  final versionDisplay = _gitHash.isNotEmpty
-      ? '[$version](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash)'
-      : version;
-  final osName = _capitalize(Platform.operatingSystem);
-  final isDark = MediaQuery.of(context).platformBrightness == Brightness.dark;
-
-  final gitCommitLine = _gitHash.isNotEmpty
-      ? '| Git Commit | [$_gitHash](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash) |\n'
-      : '';
-
-  final deviceLines =
-      deviceInfo.entries.map((e) => '| ${e.key} | ${e.value} |\n').join();
-
-  return '## [sharedinbox.de](https://sharedinbox.de)\n\n'
-      '| Property | Value |\n'
-      '|----------|-------|\n'
-      '| App Version | $versionDisplay |\n'
-      '$gitCommitLine'
-      '| Platform | ${Platform.operatingSystem} |\n'
-      '| $osName Version | ${Platform.operatingSystemVersion} |\n'
-      '$deviceLines'
-      '| Resolution | ${physW}x$physH px'
-      ' (logical: ${size.width.toInt()}x${size.height.toInt()} pt,'
-      ' ratio: ${pixelRatio.toStringAsFixed(1)}x) |\n'
-      '| Dart Version | ${Platform.version.split(' ').first} |\n'
-      '| Processors | ${Platform.numberOfProcessors} |\n'
-      '| Dark Mode | ${isDark ? 'yes' : 'no'} |\n'
-      '| IMAP Accounts | $imapCount |\n'
-      '| JMAP Accounts | $jmapCount |\n';
-}
@@ -249,22 +249,6 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "0.7.12"
-  device_info_plus:
-    dependency: "direct main"
-    description:
-      name: device_info_plus
-      sha256: "6a642e1daa10190af89ba6cb6386c0df7d071a3592080bfe1e44faa63ae1df65"
-      url: "https://pub.dev"
-    source: hosted
-    version: "13.1.0"
-  device_info_plus_platform_interface:
-    dependency: transitive
-    description:
-      name: device_info_plus_platform_interface
-      sha256: "04b173a92e2d9161dfead145667037c8d834db725ce2e7b942bfe18fd2f45a46"
-      url: "https://pub.dev"
-    source: hosted
-    version: "8.1.0"
  drift:
    dependency: "direct main"
    description:
@@ -1300,14 +1284,6 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "6.3.0"
-  win32_registry:
-    dependency: transitive
-    description:
-      name: win32_registry
-      sha256: "73b1d78920a9d6e03f8b4e43e612b87bf3152a0e5c5e5150267762b7c4116904"
-      url: "https://pub.dev"
-    source: hosted
-    version: "3.0.3"
  workmanager:
    dependency: "direct main"
    description:
@@ -61,7 +61,6 @@ dependencies:
  # App version metadata for crash reports
  package_info_plus: ^10.1.0
  share_plus: ^13.1.0
-  device_info_plus: ^13.1.0

 dev_dependencies:
  flutter_test:
@@ -146,16 +146,16 @@ def _ready_issues() -> list[dict]:


 def _latest_main_ci_run() -> dict | None:
-    """Return the latest CI run on the main branch (excludes PR runs).
+    """Return the latest CI run on the main branch (excludes PR and schedule runs).

    Using the global latest run (limit=1) is wrong: a passing or failing run
-    on a PR branch could mask the true state of main.  We filter to non-PR
+    on a PR branch could mask the true state of main.  We filter to push
    events on the 'main' prettyref so section-3 logic only reacts to main.
    """
    data = _tea_get(f"repos/{REPO}/actions/runs?limit=20")
    runs = (data or {}).get("workflow_runs", [])
    for run in runs:
-        if run.get("event") != "pull_request" and run.get("prettyref") == "main":
+        if run.get("event") == "push" and run.get("prettyref") == "main":
            return run
    return None

@@ -177,7 +177,7 @@ def _latest_ci_run_for_branch(branch: str) -> dict | None:
                    return run
            except (json.JSONDecodeError, AttributeError):
                pass
-        else:
+        elif run.get("event") == "push":
            if run.get("prettyref") == branch:
                return run
    return None
@@ -345,6 +345,15 @@ def _agent_alive(state: dict) -> bool:
        return True


+def _is_claude_process(pid: int) -> bool:
+    """Return True if pid's comm name indicates it is a claude/node process."""
+    try:
+        comm = Path(f"/proc/{pid}/comm").read_text().strip()
+        return comm in ("claude", "node")
+    except OSError:
+        return False
+
+
 def _agent_age_seconds(state: dict) -> float:
    """Seconds elapsed since the agent was launched, from the state file timestamp."""
    try:
@@ -379,11 +388,13 @@ def _git_summary() -> str:
 def _kill_agent(state: dict) -> None:
    """Forcefully stop the running agent."""
    pid = state.get("pid")
-    if pid:
+    if pid and _is_claude_process(pid):
        try:
            os.kill(pid, 9)
        except ProcessLookupError:
            pass
+    elif pid:
+        print(f"WARNING: pid {pid} is not a claude process — skipping kill to avoid hitting recycled PID")


 # ── subcommands ───────────────────────────────────────────────────────────────
@@ -57,7 +57,6 @@ const _excluded = {
  'lib/ui/widgets/try_connection_button.dart',
  'lib/ui/widgets/undo_shell.dart',
  'lib/ui/screens/about_screen.dart',
-  'lib/ui/utils/about_markdown.dart',
  'lib/ui/widgets/email_tile.dart',
  'lib/core/sync/account_sync_manager.dart',
  'lib/core/sync/background_sync.dart',
@@ -33,9 +33,6 @@ def list_remote_files(ssh_user: str, ssh_host: str, pattern: str) -> list[str]:
    result = subprocess.run(
        [
            "ssh",
-            "-v",
-            "-o", "StrictHostKeyChecking=no",
-            "-i", "/root/.ssh/id_ed25519",
            f"{ssh_user}@{ssh_host}",
            f"find {REMOTE_BUILDS_DIR} -name '{pattern}' -type f | sort",
        ],
@@ -88,21 +88,47 @@ class TestAgentAlive(unittest.TestCase):
        self.assertFalse(agent_loop._agent_alive({"pid": None}))


+class TestIsClaudeProcess(unittest.TestCase):
+    def test_returns_true_for_claude_comm(self):
+        with patch.object(agent_loop.Path, "read_text", return_value="claude\n"):
+            self.assertTrue(agent_loop._is_claude_process(1234))
+
+    def test_returns_true_for_node_comm(self):
+        with patch.object(agent_loop.Path, "read_text", return_value="node\n"):
+            self.assertTrue(agent_loop._is_claude_process(1234))
+
+    def test_returns_false_for_other_process(self):
+        with patch.object(agent_loop.Path, "read_text", return_value="bash\n"):
+            self.assertFalse(agent_loop._is_claude_process(1234))
+
+    def test_returns_false_when_proc_missing(self):
+        with patch.object(agent_loop.Path, "read_text", side_effect=OSError):
+            self.assertFalse(agent_loop._is_claude_process(1234))
+
+
 class TestKillAgent(unittest.TestCase):
    def test_kill_sends_sigkill(self):
-        with patch("agent_loop.os.kill") as mock_kill:
-            agent_loop._kill_agent({"pid": 1234})
-            mock_kill.assert_called_once_with(1234, 9)
+        with patch("agent_loop._is_claude_process", return_value=True):
+            with patch("agent_loop.os.kill") as mock_kill:
+                agent_loop._kill_agent({"pid": 1234})
+                mock_kill.assert_called_once_with(1234, 9)

    def test_kill_ignores_missing_process(self):
-        with patch("agent_loop.os.kill", side_effect=ProcessLookupError):
-            agent_loop._kill_agent({"pid": 1234})  # Should not raise.
+        with patch("agent_loop._is_claude_process", return_value=True):
+            with patch("agent_loop.os.kill", side_effect=ProcessLookupError):
+                agent_loop._kill_agent({"pid": 1234})  # Should not raise.

    def test_kill_noop_when_no_pid(self):
        with patch("agent_loop.os.kill") as mock_kill:
            agent_loop._kill_agent({})
            mock_kill.assert_not_called()

+    def test_kill_skips_recycled_pid(self):
+        with patch("agent_loop._is_claude_process", return_value=False):
+            with patch("agent_loop.os.kill") as mock_kill:
+                agent_loop._kill_agent({"pid": 1234})
+                mock_kill.assert_not_called()
+

 class TestStartAgent(unittest.TestCase):
    def _make_mock_proc(self, pid=42):
@@ -174,7 +200,8 @@ class TestMain(unittest.TestCase):
            return 55

        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._latest_ci_run", return_value=None), \
+             patch("agent_loop._open_issue_prs", return_value=[]), \
+             patch("agent_loop._latest_main_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[self._make_issue(10)]), \
             patch("agent_loop._set_labels", side_effect=fake_set_labels), \
             patch("agent_loop._start_agent", side_effect=fake_start_agent), \
@@ -200,7 +227,8 @@ class TestMain(unittest.TestCase):
            captured["remove"] = remove

        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._latest_ci_run", return_value=None), \
+             patch("agent_loop._open_issue_prs", return_value=[]), \
+             patch("agent_loop._latest_main_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[self._make_issue(7)]), \
             patch("agent_loop._set_labels", side_effect=fake_set_labels), \
             patch("agent_loop._start_agent", return_value=99), \
@@ -213,7 +241,8 @@ class TestMain(unittest.TestCase):
    def test_no_ready_issues_does_nothing(self):
        """main() exits cleanly with 0 when there are no ready issues."""
        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._latest_ci_run", return_value=None), \
+             patch("agent_loop._open_issue_prs", return_value=[]), \
+             patch("agent_loop._latest_main_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[]), \
             patch("agent_loop._set_labels") as mock_labels, \
             patch("agent_loop._start_agent") as mock_start:
@@ -232,7 +261,8 @@ class TestMain(unittest.TestCase):
            return 77

        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._latest_ci_run", return_value=None), \
+             patch("agent_loop._open_issue_prs", return_value=[]), \
+             patch("agent_loop._latest_main_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[self._make_issue(42)]), \
             patch("agent_loop._set_labels"), \
             patch("agent_loop._start_agent", side_effect=fake_start_agent), \
@@ -266,8 +296,9 @@ class TestPendingCi(unittest.TestCase):

    def test_closes_issue_when_ci_passes_after_agent_finishes(self):
        """After issue agent finishes, loop merges the PR and closes the issue once CI is green."""
+        # First call: PR found open. Second call (post-merge verification): PR closed.
        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch", side_effect=self._find_pr_open), \
+             patch("agent_loop._find_pr_for_branch", side_effect=[self._open_pr(), None]), \
             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "success"}), \
             patch("agent_loop._merge_pr") as mock_merge, \
             patch("agent_loop._close_issue") as mock_close, \
@@ -282,7 +313,7 @@ class TestPendingCi(unittest.TestCase):
        """'CI passed' line includes the CI run URL when a run is available."""
        buf = io.StringIO()
        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch", side_effect=self._find_pr_open), \
+             patch("agent_loop._find_pr_for_branch", side_effect=[self._open_pr(), None]), \
             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 4145144, "status": "success"}), \
             patch("agent_loop._merge_pr"), \
             patch("agent_loop._close_issue"), \
@@ -392,7 +423,7 @@ class TestPendingCi(unittest.TestCase):
    def test_closes_issue_after_ci_fix_and_ci_passes(self):
        """After ci-fix agent finishes and CI passes on PR branch, the pending issue is closed."""
        with patch("agent_loop._read_state", return_value=self._dead_state(10, "ci-fix")), \
-             patch("agent_loop._find_pr_for_branch", side_effect=self._find_pr_open), \
+             patch("agent_loop._find_pr_for_branch", side_effect=[self._open_pr(), None]), \
             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "success"}), \
             patch("agent_loop._merge_pr") as mock_merge, \
             patch("agent_loop._close_issue") as mock_close, \
@@ -409,7 +440,8 @@ class TestPendingCi(unittest.TestCase):
            "pid": 999999999, "issue": None, "started_at": "2026-01-01T00:00:00+00:00",
            "type": "ci-fix",
        }), \
-             patch("agent_loop._latest_ci_run", return_value={"id": 1, "status": "success"}), \
+             patch("agent_loop._open_issue_prs", return_value=[]), \
+             patch("agent_loop._latest_main_ci_run", return_value={"id": 1, "status": "success"}), \
             patch("agent_loop._close_issue") as mock_close, \
             patch("agent_loop._ready_issues", return_value=[]), \
             patch("agent_loop._clear_state"):
@@ -425,7 +457,8 @@ class TestOutputFormat(unittest.TestCase):
    def test_output_starts_with_header(self):
        buf = io.StringIO()
        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._latest_ci_run", return_value=None), \
+             patch("agent_loop._open_issue_prs", return_value=[]), \
+             patch("agent_loop._latest_main_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[]), \
             contextlib.redirect_stdout(buf):
            agent_loop._run_loop()
@@ -436,7 +469,8 @@ class TestOutputFormat(unittest.TestCase):
    def test_no_agent_loop_prefix_in_output(self):
        buf = io.StringIO()
        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._latest_ci_run", return_value=None), \
+             patch("agent_loop._open_issue_prs", return_value=[]), \
+             patch("agent_loop._latest_main_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[]), \
             contextlib.redirect_stdout(buf):
            agent_loop._run_loop()
@@ -446,7 +480,8 @@ class TestOutputFormat(unittest.TestCase):
        run = {"id": 4145144, "status": "running"}
        buf = io.StringIO()
        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._latest_ci_run", return_value=run), \
+             patch("agent_loop._open_issue_prs", return_value=[]), \
+             patch("agent_loop._latest_main_ci_run", return_value=run), \
             contextlib.redirect_stdout(buf):
            agent_loop._run_loop()
        self.assertIn("https://codeberg.org/guettli/sharedinbox/actions/runs/4145144",
@@ -456,7 +491,8 @@ class TestOutputFormat(unittest.TestCase):
        issue = {"number": 128, "title": "Fix something", "body": "", "labels": []}
        buf = io.StringIO()
        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._latest_ci_run", return_value=None), \
+             patch("agent_loop._open_issue_prs", return_value=[]), \
+             patch("agent_loop._latest_main_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[issue]), \
             patch("agent_loop._set_labels"), \
             patch("agent_loop._start_agent", return_value=99), \
@@ -468,6 +504,35 @@ class TestOutputFormat(unittest.TestCase):
        self.assertIn("Fix something", output)


+class TestLatestMainCiRun(unittest.TestCase):
+    """_latest_main_ci_run() must return only push-to-main runs, ignoring schedule/deploy workflows."""
+
+    def test_skips_schedule_runs_returns_push_to_main(self):
+        runs = [
+            {"event": "schedule", "prettyref": "main", "status": "success", "id": 1},
+            {"event": "push", "prettyref": "main", "status": "success", "id": 2},
+        ]
+        with patch("agent_loop._tea_get", return_value={"workflow_runs": runs}):
+            result = agent_loop._latest_main_ci_run()
+        self.assertIsNotNone(result)
+        self.assertEqual(result["id"], 2)
+
+    def test_returns_none_when_only_schedule_runs_exist(self):
+        runs = [
+            {"event": "schedule", "prettyref": "main", "status": "success", "id": 1},
+        ]
+        with patch("agent_loop._tea_get", return_value={"workflow_runs": runs}):
+            result = agent_loop._latest_main_ci_run()
+        self.assertIsNone(result)
+
+    def test_returns_push_to_main_run(self):
+        runs = [{"event": "push", "prettyref": "main", "status": "running", "id": 42}]
+        with patch("agent_loop._tea_get", return_value={"workflow_runs": runs}):
+            result = agent_loop._latest_main_ci_run()
+        self.assertIsNotNone(result)
+        self.assertEqual(result["id"], 42)
+
+
 class TestLatestCiRunForBranch(unittest.TestCase):
    """Tests for _latest_ci_run_for_branch — Forgejo API field mapping."""

@@ -288,8 +288,6 @@ class _FakeLogs implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool? isPermanent,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -181,8 +181,6 @@ class FakeSyncLogRepository implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool? isPermanent,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -14,7 +14,7 @@ void main() {
  group('Migration', () {
    test('schemaVersion matches expected value', () async {
      final db = AppDatabase(NativeDatabase.memory());
-      expect(db.schemaVersion, 33);
+      expect(db.schemaVersion, 32);
      await db.close();
    });

@@ -194,10 +194,6 @@ void main() {
      // v32: local_sieve_applied table.
      await db.customSelect('SELECT count(*) FROM local_sieve_applied').get();

-      // v33: stack_trace and is_permanent columns on sync_logs.
-      final syncLogColumns = await _tableColumns(db, 'sync_logs');
-      expect(syncLogColumns, containsAll(['stack_trace', 'is_permanent']));
-
      await db.close();
      if (dbFile.existsSync()) dbFile.deleteSync();
    });
@@ -385,15 +381,11 @@ void main() {
          await _tableColumns(db, 'sync_log_mailboxes');
      expect(syncLogMailboxColumns, contains('duration_ms'));

-      // v33: stack_trace and is_permanent columns on sync_logs.
-      final syncLogColumns = await _tableColumns(db, 'sync_logs');
-      expect(syncLogColumns, containsAll(['stack_trace', 'is_permanent']));
-
      await db.close();
      if (dbFile.existsSync()) dbFile.deleteSync();
    });

-    test('fresh install creates all tables at schemaVersion 33', () async {
+    test('fresh install creates all tables at schemaVersion 32', () async {
      final db = AppDatabase(NativeDatabase.memory());
      await db.select(db.accounts).get();

@@ -434,10 +426,6 @@ void main() {
          await _tableColumns(db, 'sync_log_mailboxes');
      expect(syncLogMailboxColumns, contains('duration_ms'));

-      // v33: stack_trace and is_permanent columns on sync_logs.
-      final syncLogColumns = await _tableColumns(db, 'sync_logs');
-      expect(syncLogColumns, containsAll(['stack_trace', 'is_permanent']));
-
      await db.close();
    });
  });
@@ -170,8 +170,6 @@ class _FakeSyncLog implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool? isPermanent,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -126,56 +126,4 @@ void main() {
    expect(rows.first.result, 'error');
    expect(rows.first.errorMessage, 'Connection refused');
  });
-
-  test('stores and retrieves stack trace and isPermanent', () async {
-    final repo = SyncLogRepositoryImpl(db);
-    final start = DateTime(2024, 3, 1, 10);
-    final end = DateTime(2024, 3, 1, 10, 0, 1);
-
-    await repo.log(
-      accountId: 'acc1',
-      success: false,
-      errorMessage: 'MissingPluginException',
-      stackTrace: '#0 MethodChannel._invokeMethod\n#1 main',
-      isPermanent: true,
-      protocol: 'imap',
-      emailsFetched: 0,
-      emailsSkipped: 0,
-      mailboxesSynced: 0,
-      pendingFlushed: 0,
-      bytesTransferred: 0,
-      startedAt: start,
-      finishedAt: end,
-    );
-
-    final entries = await repo.observeSyncLogs('acc1').first;
-    final latest = entries.firstWhere((e) => e.startedAt == start);
-    expect(latest.stackTrace, '#0 MethodChannel._invokeMethod\n#1 main');
-    expect(latest.isPermanent, isTrue);
-    expect(latest.errorMessage, 'MissingPluginException');
-  });
-
-  test('isPermanent is null for success entries', () async {
-    final repo = SyncLogRepositoryImpl(db);
-    final start = DateTime(2024, 4, 1, 10);
-    final end = DateTime(2024, 4, 1, 10, 0, 3);
-
-    await repo.log(
-      accountId: 'acc1',
-      success: true,
-      protocol: 'imap',
-      emailsFetched: 2,
-      emailsSkipped: 0,
-      mailboxesSynced: 1,
-      pendingFlushed: 0,
-      bytesTransferred: 0,
-      startedAt: start,
-      finishedAt: end,
-    );
-
-    final entries = await repo.observeSyncLogs('acc1').first;
-    final latest = entries.firstWhere((e) => e.startedAt == start);
-    expect(latest.isPermanent, isNull);
-    expect(latest.stackTrace, isNull);
-  });
 }
@@ -1,65 +0,0 @@
-import 'package:flutter/material.dart';
-import 'package:flutter/services.dart';
-import 'package:flutter_test/flutter_test.dart';
-import 'package:sharedinbox/ui/screens/changelog_screen.dart';
-
-class _FakeAssetBundle extends Fake implements AssetBundle {
-  final String content;
-  _FakeAssetBundle(this.content);
-
-  @override
-  Future<String> loadString(String key, {bool cache = true}) async {
-    if (key == 'assets/changelog.txt') return content;
-    throw FlutterError('Asset not found: $key');
-  }
-
-  @override
-  Future<ByteData> load(String key) async {
-    throw FlutterError('Asset not found: $key');
-  }
-}
-
-void main() {
-  testWidgets('ChangeLogScreen renders changelog content', (tester) async {
-    const fakeChangelog =
-        '* 2026-01-01: Initial release\n* 2026-01-02: Bug fix';
-
-    await tester.pumpWidget(
-      DefaultAssetBundle(
-        bundle: _FakeAssetBundle(fakeChangelog),
-        child: const MaterialApp(home: ChangeLogScreen()),
-      ),
-    );
-    await tester.pumpAndSettle();
-
-    expect(find.text('ChangeLog'), findsOneWidget);
-    expect(find.textContaining('2026-01-01'), findsOneWidget);
-    expect(find.textContaining('Initial release'), findsOneWidget);
-  });
-
-  testWidgets('ChangeLogScreen shows error when asset is missing', (
-    tester,
-  ) async {
-    await tester.pumpWidget(
-      DefaultAssetBundle(
-        bundle: _BadAssetBundle(),
-        child: const MaterialApp(home: ChangeLogScreen()),
-      ),
-    );
-    await tester.pumpAndSettle();
-
-    expect(find.textContaining('Error loading changelog:'), findsOneWidget);
-  });
-}
-
-class _BadAssetBundle extends Fake implements AssetBundle {
-  @override
-  Future<String> loadString(String key, {bool cache = true}) async {
-    throw FlutterError('Unable to load asset: "$key"');
-  }
-
-  @override
-  Future<ByteData> load(String key) async {
-    throw FlutterError('Unable to load asset: "$key"');
-  }
-}
Author	SHA1	Message	Date
Thomas SharedInbox	bae7afa11c	perf: cache Linux engine artifacts via flutter precache --linux (#129 ) Add flutter precache --linux --no-android --no-ios to toolchain() so the Linux engine binaries are baked into the execution-cache snapshot rather than downloaded on demand during each flutter build linux run.	2026-05-24 14:17:06 +02:00
Thomas SharedInboxandClaude Sonnet 4.6	77e581299d	fix: filter out schedule/deploy workflow runs in CI checks _latest_main_ci_run() was using event != pull_request which still matched deploy.yml schedule runs when their prettyref == "main", blocking the loop from picking up new issues. _latest_ci_run_for_branch() had the same issue: the else branch matched any non-pull_request event including schedule runs. Both functions now explicitly filter for event == "push" only. Tests updated: rename _latest_ci_run → _latest_main_ci_run, mock _open_issue_prs to prevent real API calls in unit tests, and update _find_pr_for_branch side_effect to reflect the upstream post-merge PR-still-open verification check. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-24 14:08:13 +02:00
Bot of Thomas Güttler	37eca207c6	fix: pin SSH host key via known_hosts instead of StrictHostKeyChecking=no (#161 ) (#181 )	2026-05-24 13:00:04 +02:00
Bot of Thomas Güttler	5925cee4f2	fix: show git hash as clickable link above stacktrace (#201 ) (#211 )	2026-05-24 12:56:27 +02:00
Bot of Thomas Güttler	a8603edfc3	fix: verify PID belongs to claude before SIGKILL (#160 ) (#163 )	2026-05-24 12:55:08 +02:00
Bot of Thomas Güttler	0293cb5845	fix: stop retrying on MissingPluginException from flutter_secure_storage (#200 ) (#209 )	2026-05-24 08:50:06 +02:00
Bot of Thomas Güttler	30bcc8a314	fix: skip CI jobs when unrelated files change (#144 ) (#207 )	2026-05-24 08:30:10 +02:00
Bot of Thomas Güttler	ac0e16adcb	feat: about page - sharedinbox.de heading link and git commit row (#199 ) (#206 )	2026-05-24 08:10:07 +02:00