feat: move Reply All into dialog, add Mark as Spam (#260)

- Remove standalone Reply All button from the app bar.
- Add Mark as Spam button before Delete; moves email to the junk
  mailbox (role "junk") and shows a snackbar if no junk folder exists.
- Reply button now collects all addresses from From/To/Cc, filters out
  the account's own address, deduplicates, and:
    • If ≤1 candidate: navigates directly to compose (no dialog).
    • If ≥2 candidates: shows a "Reply All" dialog where each address
      can be placed in To, Cc, or skipped. Addresses from incoming Cc
      default to Cc; From/To addresses default to To.
- Update widget tests: verify Reply All button is absent, dialog
  appears for multi-recipient emails, Mark as Spam button present,
  and snackbar shown when no junk folder is configured.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/renovate.yml

@@ -0,0 +1,33 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    name: Renovate
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Dagger Remote Engine (via stunnel)
+        env:
+          DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}
+          DAGGER_CA_CERT: ${{ secrets.DAGGER_CA_CERT }}
+          DAGGER_CLIENT_CERT: ${{ secrets.DAGGER_CLIENT_CERT }}
+          DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
+        run: scripts/setup_dagger_remote.sh
+
+      - name: Run Renovate
+        env:
+          DAGGER_NO_NAG: "1"
+          RENOVATE_FORGEJO_TOKEN: ${{ secrets.RENOVATE_FORGEJO_TOKEN }}
+        run: task renovate
+
+      - name: Cleanup TLS credentials
+        if: always()
+        run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid

Taskfile.yml

@@ -336,6 +336,14 @@ tasks:
       - |
         dagger query '{ engine { localCache { prune(maxUsedSpace: "75gb", targetSpace: "50gb") } } }'
 
+  renovate:
+    desc: Run Renovate bot against the repository via Dagger
+    preconditions:
+      - sh: test -n "$RENOVATE_FORGEJO_TOKEN"
+        msg: "RENOVATE_FORGEJO_TOKEN is not set"
+    cmds:
+      - dagger call --progress=plain -q -m ci --source=. renovate --renovate-token env:RENOVATE_FORGEJO_TOKEN
+
   integration-android:
     desc: UI integration tests on a connected Android emulator (Stalwart on host, emulator reaches it via 10.0.2.2)
     deps: [_preflight, _android-sdk-check, _android-avd-setup]

ci/main.go

@@ -842,6 +842,18 @@ func (m *Ci) PublishAndroid(
 	return m.UploadToPlayStore(ctx, signed, playStoreConfig)
 }
 
+// Renovate runs Renovate bot against the repository on Forgejo/Codeberg.
+func (m *Ci) Renovate(ctx context.Context, renovateToken *dagger.Secret) (string, error) {
+	return dag.Container().
+		From("renovate/renovate:39").
+		WithSecretVariable("RENOVATE_TOKEN", renovateToken).
+		WithEnvVariable("RENOVATE_PLATFORM", "forgejo").
+		WithEnvVariable("RENOVATE_ENDPOINT", "https://codeberg.org").
+		WithEnvVariable("RENOVATE_REPOSITORIES", "guettli/sharedinbox").
+		WithExec([]string{"renovate"}).
+		Stdout(ctx)
+}
+
 // Graph returns a Mermaid diagram of the CI pipeline structure.
 // Paste the output into any Mermaid renderer (codeberg, github, mermaid.live)
 // or save it as a .md file to get a rendered diagram.

lib/ui/screens/email_detail_screen.dart

@@ -70,16 +70,9 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
             onPressed: header == null
                 ? null
                 : () {
-                    unawaited(_reply(context, header, body, replyAll: false));
-                  },
-          ),
-          IconButton(
-            icon: const Icon(Icons.reply_all),
-            tooltip: 'Reply all',
-            onPressed: header == null
-                ? null
-                : () {
-                    unawaited(_reply(context, header, body, replyAll: true));
+                    unawaited(
+                      _replyWithRecipientDialog(context, header, body),
+                    );
                   },
           ),
           IconButton(
@@ -121,6 +114,15 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
             tooltip: 'Snooze',
             onPressed: header == null ? null : () => _snooze(context, header),
           ),
+          IconButton(
+            icon: const Icon(Icons.report_outlined),
+            tooltip: 'Mark as spam',
+            onPressed: header == null
+                ? null
+                : () {
+                    unawaited(_markAsSpam(context, header));
+                  },
+          ),
           IconButton(
             icon: const Icon(Icons.delete),
             tooltip: 'Delete',
@@ -303,17 +305,78 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
     return '\n\n— On $date, $from wrote:\n$quoted';
   }
 
-  Future<void> _reply(
+  Future<void> _replyWithRecipientDialog(
+    BuildContext context,
+    Email header,
+    EmailBody? body,
+  ) async {
+    final account =
+        await ref.read(accountRepositoryProvider).getAccount(header.accountId);
+    final ownEmail = account?.email.toLowerCase() ?? '';
+
+    final seen = <String>{};
+    final candidates = <_Candidate>[];
+
+    void addIfNew(EmailAddress addr, _Placement defaultPlacement) {
+      final key = addr.email.toLowerCase();
+      if (key == ownEmail || seen.contains(key)) return;
+      seen.add(key);
+      candidates.add(_Candidate(addr, defaultPlacement));
+    }
+
+    for (final addr in header.from) {
+      addIfNew(addr, _Placement.to);
+    }
+    for (final addr in header.to) {
+      addIfNew(addr, _Placement.to);
+    }
+    for (final addr in header.cc) {
+      addIfNew(addr, _Placement.cc);
+    }
+
+    if (!context.mounted) return;
+
+    if (candidates.length <= 1) {
+      final to = candidates
+          .where((c) => c.placement == _Placement.to)
+          .map((c) => c.address.email)
+          .join(', ');
+      final cc = candidates
+          .where((c) => c.placement == _Placement.cc)
+          .map((c) => c.address.email)
+          .join(', ');
+      await _composeReply(context, header, body, to: to, cc: cc);
+      return;
+    }
+
+    final confirmed = await showDialog<List<_Candidate>>(
+      context: context,
+      builder: (ctx) => _ReplyAllDialog(candidates: candidates),
+    );
+
+    if (confirmed == null || !context.mounted) return;
+
+    final to = confirmed
+        .where((c) => c.placement == _Placement.to)
+        .map((c) => c.address.email)
+        .join(', ');
+    final cc = confirmed
+        .where((c) => c.placement == _Placement.cc)
+        .map((c) => c.address.email)
+        .join(', ');
+    await _composeReply(context, header, body, to: to, cc: cc);
+  }
+
+  Future<void> _composeReply(
     BuildContext context,
     Email header,
     EmailBody? body, {
-    required bool replyAll,
+    required String to,
+    required String cc,
   }) async {
-    final to = header.from.isNotEmpty ? header.from.first.email : '';
     final subject = (header.subject?.startsWith('Re:') ?? false)
         ? header.subject!
         : 'Re: ${header.subject ?? ''}';
-    final cc = replyAll ? header.to.map((a) => a.email).join(', ') : '';
     final quoted = await _quotedBody(header, body);
     if (!context.mounted) return;
     unawaited(
@@ -330,6 +393,38 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
     );
   }
 
+  Future<void> _markAsSpam(BuildContext context, Email header) async {
+    final mailboxRepo = ref.read(mailboxRepositoryProvider);
+    final junk = await mailboxRepo.findMailboxByRole(header.accountId, 'junk');
+
+    if (junk == null) {
+      if (!context.mounted) return;
+      ScaffoldMessenger.of(context).showSnackBar(
+        const SnackBar(content: Text('No Junk folder found')),
+      );
+      return;
+    }
+
+    await ref
+        .read(emailRepositoryProvider)
+        .moveEmail(widget.emailId, junk.path);
+
+    unawaited(
+      ref.read(undoServiceProvider.notifier).pushAction(
+            UndoAction(
+              id: DateTime.now().toIso8601String(),
+              accountId: header.accountId,
+              type: UndoType.move,
+              emailIds: [widget.emailId],
+              sourceMailboxPath: header.mailboxPath,
+              destinationMailboxPath: junk.path,
+            ),
+          ),
+    );
+
+    if (context.mounted) context.pop();
+  }
+
   Future<void> _forward(
     BuildContext context,
     Email header,
@@ -670,6 +765,94 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
   }
 }
 
+enum _Placement { to, cc, skip }
+
+class _Candidate {
+  _Candidate(this.address, this.placement);
+  final EmailAddress address;
+  _Placement placement;
+}
+
+class _ReplyAllDialog extends StatefulWidget {
+  const _ReplyAllDialog({required this.candidates});
+  final List<_Candidate> candidates;
+
+  @override
+  State<_ReplyAllDialog> createState() => _ReplyAllDialogState();
+}
+
+class _ReplyAllDialogState extends State<_ReplyAllDialog> {
+  late final List<_Candidate> _candidates;
+
+  @override
+  void initState() {
+    super.initState();
+    _candidates = [
+      for (final c in widget.candidates) _Candidate(c.address, c.placement),
+    ];
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return AlertDialog(
+      title: const Text('Reply All'),
+      content: SizedBox(
+        width: double.maxFinite,
+        child: ListView(
+          shrinkWrap: true,
+          children: [
+            for (final c in _candidates)
+              Padding(
+                padding: const EdgeInsets.symmetric(vertical: 4),
+                child: Row(
+                  children: [
+                    Expanded(
+                      child: Text(
+                        c.address.toString(),
+                        overflow: TextOverflow.ellipsis,
+                      ),
+                    ),
+                    const SizedBox(width: 8),
+                    SegmentedButton<_Placement>(
+                      showSelectedIcon: false,
+                      segments: const [
+                        ButtonSegment(
+                          value: _Placement.to,
+                          label: Text('To'),
+                        ),
+                        ButtonSegment(
+                          value: _Placement.cc,
+                          label: Text('Cc'),
+                        ),
+                        ButtonSegment(
+                          value: _Placement.skip,
+                          label: Text('Skip'),
+                        ),
+                      ],
+                      selected: {c.placement},
+                      onSelectionChanged: (s) =>
+                          setState(() => c.placement = s.first),
+                    ),
+                  ],
+                ),
+              ),
+          ],
+        ),
+      ),
+      actions: [
+        TextButton(
+          onPressed: () => Navigator.pop(context),
+          child: const Text('Cancel'),
+        ),
+        TextButton(
+          onPressed: () => Navigator.pop(context, _candidates),
+          child: const Text('Reply'),
+        ),
+      ],
+    );
+  }
+}
+
 class _MimeRow {
   const _MimeRow(this.depth, this.label);
   final int depth;

scripts/agent_loop.py

@@ -42,6 +42,7 @@ import re
 import shlex
 import subprocess
 import sys
+import time
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -278,6 +279,41 @@ def _merge_pr(pr_number: int) -> None:
     _fgj("pr", "merge", str(pr_number), "--repo", REPO, "--merge-method", "squash")
 
 
+def _handle_pr_still_open_after_merge(pr_number: int, branch: str, issue_num: int | None) -> str:
+    """Handle a PR that is still open after a successful _merge_pr() call.
+
+    Returns one of:
+      "rebase-spawned" — merge conflict detected; rebase agent started, state written
+      "merged"         — PR closed after a retry
+      "fallback"       — all options exhausted; caller should set State/Question
+    """
+    pr_data = _tea_get(f"repos/{REPO}/pulls/{pr_number}")
+    mergeable = (pr_data or {}).get("mergeable")
+
+    if mergeable is False:
+        prompt = (
+            f"Rebase branch `{branch}` onto main to resolve merge conflicts, then push. "
+            "Do not change any logic — only resolve conflicts and push."
+        )
+        session_name = f"rebase-pr-{pr_number}"
+        pid = _start_agent(prompt, session_name)
+        _write_state(pid, issue_num, "pending-ci", session_name=session_name)
+        print(f"PR #{pr_number} has merge conflicts — spawned rebase agent (pid={pid}).")
+        return "rebase-spawned"
+
+    for attempt in range(1, 3):
+        time.sleep(5)
+        try:
+            _merge_pr(pr_number)
+        except RuntimeError as e:
+            print(f"PR #{pr_number} merge retry {attempt} failed: {e}")
+        if not _find_pr_for_branch(branch):
+            print(f"PR #{pr_number} merged on retry {attempt}.")
+            return "merged"
+
+    return "fallback"
+
+
 # ── state file ────────────────────────────────────────────────────────────────
 
 
@@ -676,6 +712,13 @@ def _run_loop() -> int:
                 )
                 return 0
             if _find_pr_for_branch(branch):
+                merge_result = _handle_pr_still_open_after_merge(pr_number, branch, pending_issue)
+                if merge_result == "rebase-spawned":
+                    return 0
+                if merge_result == "merged":
+                    _close_issue(pending_issue)
+                    print(f"Merged PR #{pr_number} and closed {_issue_url(pending_issue)}.")
+                    return 0
                 print(f"PR #{pr_number} is still open after merge attempt — setting to State/Question.")
                 _set_labels(pending_issue, add=[LABEL_QUESTION], remove=[LABEL_IN_PROGRESS])
                 _comment_issue(
@@ -744,6 +787,16 @@ def _run_loop() -> int:
             # Verify the merge actually happened; fgj can exit 0 without merging
             # (e.g. branch-protection rules not satisfied).
             if _find_pr_for_branch(branch):
+                merge_result = _handle_pr_still_open_after_merge(pr_number, branch, issue_num)
+                if merge_result == "rebase-spawned":
+                    return 0
+                if merge_result == "merged":
+                    if issue_num:
+                        _close_issue(issue_num)
+                        print(f"Catch-up: merged PR #{pr_number} and closed issue #{issue_num} after retry.")
+                    else:
+                        print(f"Catch-up: merged PR #{pr_number} after retry.")
+                    return 0
                 print(
                     f"Catch-up: PR #{pr_number} is still open after merge attempt "
                     "— skipping to avoid infinite retry."

scripts/test_agent_loop.py

@@ -785,6 +785,90 @@ class TestCatchupSkipsQuestionIssues(unittest.TestCase):
         mock_merge.assert_called_once_with(50)
 
 
+class TestMergeFailsOpen(unittest.TestCase):
+    """Tests for auto-resolution when a PR is still open after the merge command."""
+
+    def _dead_state(self, issue: int, kind: str = "issue") -> dict:
+        return {
+            "pid": 999999999,
+            "issue": issue,
+            "started_at": "2026-01-01T00:00:00+00:00",
+            "type": kind,
+        }
+
+    def _open_pr(self, branch: str = "issue-10-fix") -> dict:
+        return {"number": 5, "head": {"ref": branch}, "created_at": "2026-01-01T00:00:00+00:00"}
+
+    def test_merge_fails_open_with_conflicts_spawns_rebase_agent(self):
+        """mergeable=false → rebase agent spawned, state written as pending-ci."""
+        written_state = {}
+
+        def fake_write_state(pid, issue, kind, issue_title=None, session_name=None, ci_run_id=None):
+            written_state["pid"] = pid
+            written_state["issue"] = issue
+            written_state["kind"] = kind
+            written_state["session_name"] = session_name
+
+        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
+             patch("agent_loop._find_pr_for_branch", side_effect=[self._open_pr(), self._open_pr()]), \
+             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "success"}), \
+             patch("agent_loop._merge_pr"), \
+             patch("agent_loop._tea_get", return_value={"mergeable": False}), \
+             patch("agent_loop._start_agent", return_value=77) as mock_start, \
+             patch("agent_loop._write_state", side_effect=fake_write_state), \
+             patch("agent_loop._clear_state"):
+            result = agent_loop._run_loop()
+
+        self.assertEqual(result, 0)
+        mock_start.assert_called_once()
+        prompt = mock_start.call_args[0][0]
+        self.assertIn("Rebase branch", prompt)
+        self.assertIn("issue-10-fix", prompt)
+        self.assertEqual(written_state.get("kind"), "pending-ci")
+        self.assertEqual(written_state.get("issue"), 10)
+
+    def test_merge_fails_open_no_conflicts_retries_and_succeeds(self):
+        """mergeable=true, second attempt succeeds → issue closed."""
+        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
+             patch("agent_loop._find_pr_for_branch",
+                   side_effect=[self._open_pr(), self._open_pr(), None]), \
+             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "success"}), \
+             patch("agent_loop._merge_pr"), \
+             patch("agent_loop._tea_get", return_value={"mergeable": True}), \
+             patch("agent_loop.time.sleep"), \
+             patch("agent_loop._close_issue") as mock_close, \
+             patch("agent_loop._clear_state"):
+            result = agent_loop._run_loop()
+
+        self.assertEqual(result, 0)
+        mock_close.assert_called_once_with(10)
+
+    def test_merge_fails_open_no_conflicts_all_retries_exhausted(self):
+        """All retries exhausted with PR still open → falls through to State/Question."""
+        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
+             patch("agent_loop._find_pr_for_branch",
+                   side_effect=[self._open_pr(), self._open_pr(),
+                                 self._open_pr(), self._open_pr()]), \
+             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "success"}), \
+             patch("agent_loop._merge_pr"), \
+             patch("agent_loop._tea_get", return_value={"mergeable": True}), \
+             patch("agent_loop.time.sleep"), \
+             patch("agent_loop._set_labels") as mock_labels, \
+             patch("agent_loop._comment_issue") as mock_comment, \
+             patch("agent_loop._close_issue") as mock_close, \
+             patch("agent_loop._clear_state"):
+            result = agent_loop._run_loop()
+
+        self.assertEqual(result, 0)
+        mock_close.assert_not_called()
+        mock_labels.assert_called_once_with(
+            10,
+            add=[agent_loop.LABEL_QUESTION],
+            remove=[agent_loop.LABEL_IN_PROGRESS],
+        )
+        mock_comment.assert_called_once()
+
+
 class TestHeartbeat(unittest.TestCase):
     """Tests for _update_heartbeat() and cmd_monitor()."""
 

test/widget/email_detail_screen_test.dart

@@ -179,6 +179,142 @@ void main() {
       expect(find.text('report.pdf'), findsOneWidget);
     });
 
+    testWidgets('Reply All button is not present in app bar', (tester) async {
+      await tester.pumpWidget(
+        buildApp(
+          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
+          overrides: _overrides(
+            body: const EmailBody(emailId: 'acc-1:42', attachments: []),
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      expect(
+        find.byWidgetPredicate(
+          (w) => w is Tooltip && w.message == 'Reply all',
+        ),
+        findsNothing,
+      );
+    });
+
+    testWidgets('Reply on single-recipient email navigates directly to compose',
+        (tester) async {
+      // testEmail has from=[bob], to=[alice]. After removing alice (own),
+      // only bob remains → no dialog, navigate straight to compose.
+      final email = testEmail();
+      await tester.pumpWidget(
+        buildApp(
+          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
+          overrides: [
+            ..._overrides(
+              body: const EmailBody(emailId: 'acc-1:42', attachments: []),
+              email: email,
+            ),
+            draftRepositoryProvider.overrideWithValue(FakeDraftRepository()),
+          ],
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(
+        find.byWidgetPredicate(
+          (w) => w is Tooltip && w.message == 'Reply',
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      // No dialog shown — straight navigation to compose.
+      expect(find.text('Reply All'), findsNothing);
+    });
+
+    testWidgets('Reply on multi-recipient email shows Reply All dialog',
+        (tester) async {
+      // Email with an extra Cc recipient so the dialog is triggered.
+      final email = Email(
+        id: 'acc-1:42',
+        accountId: 'acc-1',
+        mailboxPath: 'INBOX',
+        uid: 42,
+        subject: 'Hello world',
+        receivedAt: DateTime(2024, 6),
+        sentAt: DateTime(2024, 6),
+        from: const [EmailAddress(name: 'Bob', email: 'bob@example.com')],
+        to: const [EmailAddress(email: 'alice@example.com')],
+        cc: const [EmailAddress(name: 'Carol', email: 'carol@example.com')],
+        isSeen: false,
+        isFlagged: false,
+        hasAttachment: false,
+      );
+      await tester.pumpWidget(
+        buildApp(
+          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
+          overrides: _overrides(
+            body: const EmailBody(emailId: 'acc-1:42', attachments: []),
+            email: email,
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(
+        find.byWidgetPredicate(
+          (w) => w is Tooltip && w.message == 'Reply',
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      // Dialog must appear with title 'Reply All'.
+      expect(find.text('Reply All'), findsOneWidget);
+      // Both non-own addresses should be listed in the dialog.
+      expect(find.textContaining('bob@example.com'), findsAtLeastNWidgets(1));
+      expect(find.textContaining('carol@example.com'), findsAtLeastNWidgets(1));
+    });
+
+    testWidgets('Mark as spam button is present in app bar', (tester) async {
+      await tester.pumpWidget(
+        buildApp(
+          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
+          overrides: _overrides(
+            body: const EmailBody(emailId: 'acc-1:42', attachments: []),
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      expect(
+        find.byWidgetPredicate(
+          (w) => w is Tooltip && w.message == 'Mark as spam',
+        ),
+        findsOneWidget,
+      );
+    });
+
+    testWidgets(
+        'Mark as spam moves email to junk and shows snackbar when no junk folder',
+        (tester) async {
+      // FakeMailboxRepository has no mailboxes by default → findMailboxByRole
+      // returns null → snackbar shown.
+      await tester.pumpWidget(
+        buildApp(
+          initialLocation: '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
+          overrides: _overrides(
+            body: const EmailBody(emailId: 'acc-1:42', attachments: []),
+          ),
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(
+        find.byWidgetPredicate(
+          (w) => w is Tooltip && w.message == 'Mark as spam',
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      expect(find.text('No Junk folder found'), findsOneWidget);
+    });
+
     testWidgets('Show Raw Email dialog shows size of email', (tester) async {
       // 'A' * 2048 → fmtSize(2048) == '2.0 KB'
       final rawContent = 'A' * 2048;