security: verify PID belongs to claude before SIGKILL (#160 )

Add _is_claude_process() that reads /proc/{pid}/comm to confirm the process is "claude" or "node" before sending SIGKILL, preventing the kill from hitting an unrelated process if the original claude pid was recycled by the kernel between cron ticks. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-24 12:48:54 +02:00
30 changed files with 187 additions and 1023 deletions
@@ -156,7 +156,6 @@ jobs:
        if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
          SSH_USER: ${{ secrets.SSH_USER }}
          SSH_HOST: ${{ secrets.SSH_HOST }}
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
@@ -198,7 +197,6 @@ jobs:
        if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
          SSH_USER: ${{ secrets.SSH_USER }}
          SSH_HOST: ${{ secrets.SSH_HOST }}
          DAGGER_NO_NAG: "1"
@@ -240,7 +238,6 @@ jobs:
        if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
          SSH_USER: ${{ secrets.SSH_USER }}
          SSH_HOST: ${{ secrets.SSH_HOST }}
          DAGGER_NO_NAG: "1"
@@ -1,18 +0,0 @@
-name: Monitor Agent Loop
-
-on:
-  schedule:
-    - cron: '0 */2 * * *'  # every 2 hours
-  workflow_dispatch:
-
-jobs:
-  monitor:
-    name: Check Agent Loop Health
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Check agent loop heartbeat
-        run: python3 scripts/agent_loop.py monitor
@@ -202,8 +202,6 @@ jobs:
          mkdir -p ~/.ssh
          printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
-          printf '%s\n' "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
-          chmod 644 ~/.ssh/known_hosts

      - name: Build Linux release
        run: |
@@ -217,20 +215,20 @@ jobs:
          REMOTE_DIR="public_html/builds/$DATE_PATH"
          TARBALL="sharedinbox-linux-amd64-$HASH.tar.gz"
          tar -czf /tmp/$TARBALL -C build/linux/x64/release bundle
-          ssh "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
-          scp /tmp/$TARBALL "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$TARBALL"
+          ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
+          scp -o StrictHostKeyChecking=no /tmp/$TARBALL "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$TARBALL"
          DOWNLOAD_URL="https://sharedinbox.de/builds/$DATE_PATH/$TARBALL"
-          EXISTING=$(ssh "$SSH_USER@$SSH_HOST" \
+          EXISTING=$(ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" \
            "cat public_html/latest.json 2>/dev/null || echo '{}'")
          WINDOWS_URL=$(echo "$EXISTING" | \
            python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('windows',''))" \
            2>/dev/null || true)
          if [ -n "$WINDOWS_URL" ]; then
            echo "{\"version\":\"$HASH\",\"linux\":\"$DOWNLOAD_URL\",\"windows\":\"$WINDOWS_URL\"}" | \
-              ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+              ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
          else
            echo "{\"version\":\"$HASH\",\"linux\":\"$DOWNLOAD_URL\"}" | \
-              ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+              ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
          fi

      - name: Generate build history pages
@@ -246,5 +244,6 @@ jobs:
          rsync -avz --delete \
            --exclude='*.apk' \
            --exclude='*.tar.gz' \
+            -e "ssh -o StrictHostKeyChecking=no" \
            website/public/ \
            "$SSH_USER@$SSH_HOST:public_html/"
@@ -215,10 +215,8 @@ tasks:
    preconditions:
      - sh: test -n "$SSH_PRIVATE_KEY"
        msg: "SSH_PRIVATE_KEY is not set"
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
-      - HASH=$(git rev-parse --short HEAD) && dagger call --progress=plain -q -m ci --source=. deploy-linux --ssh-key env:SSH_PRIVATE_KEY --known-hosts env:SSH_KNOWN_HOSTS --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST" --commit-hash "$HASH"
+      - HASH=$(git rev-parse --short HEAD) && dagger call --progress=plain -q -m ci --source=. deploy-linux --ssh-key env:SSH_PRIVATE_KEY --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST" --commit-hash "$HASH"

  build-android-bundle:
    desc: Build AAB via Dagger (cached, versionCode=1 placeholder) and export locally
@@ -253,24 +251,17 @@ tasks:
    preconditions:
      - sh: test -n "$SSH_PRIVATE_KEY"
        msg: "SSH_PRIVATE_KEY is not set"
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
      - sh: test -n "$ANDROID_KEYSTORE_BASE64"
        msg: "ANDROID_KEYSTORE_BASE64 is not set"
      - sh: test -n "$ANDROID_KEYSTORE_PASSWORD"
        msg: "ANDROID_KEYSTORE_PASSWORD is not set"
    cmds:
-      - HASH=$(git rev-parse --short HEAD) && dagger call --progress=plain -q -m ci --source=. deploy-apk --ssh-key env:SSH_PRIVATE_KEY --known-hosts env:SSH_KNOWN_HOSTS --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST" --commit-hash "$HASH" --keystore-base64 env:ANDROID_KEYSTORE_BASE64 --keystore-password env:ANDROID_KEYSTORE_PASSWORD --build-number "$(git log -1 --format=%ct HEAD)"
+      - HASH=$(git rev-parse --short HEAD) && dagger call --progress=plain -q -m ci --source=. deploy-apk --ssh-key env:SSH_PRIVATE_KEY --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST" --commit-hash "$HASH" --keystore-base64 env:ANDROID_KEYSTORE_BASE64 --keystore-password env:ANDROID_KEYSTORE_PASSWORD --build-number "$(git log -1 --format=%ct HEAD)"

  publish-website:
    desc: Build and publish website via Dagger
-    preconditions:
-      - sh: test -n "$SSH_PRIVATE_KEY"
-        msg: "SSH_PRIVATE_KEY is not set"
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
-      - dagger call --progress=plain -q -m ci --source=. publish-website --ssh-key env:SSH_PRIVATE_KEY --known-hosts env:SSH_KNOWN_HOSTS --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST"
+      - dagger call --progress=plain -q -m ci --source=. publish-website --ssh-key file:$HOME/.ssh/id_ed25519 --ssh-user "$SSH_USER" --ssh-host "$SSH_HOST"

  check-dagger:
    desc: Run full check suite via Dagger (with OTEL timing report if python3 is available)
@@ -382,29 +373,25 @@ tasks:
        msg: "SSH_USER is not set"
      - sh: test -n "$SSH_HOST"
        msg: "SSH_HOST is not set"
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
      - |
-        mkdir -p ~/.ssh
-        printf '%s\n' "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        HASH=$(git rev-parse --short HEAD)
        DATE_PATH=$(date -u +%Y/%m/%d)
        REMOTE_DIR="public_html/builds/$DATE_PATH"
        TARBALL="sharedinbox-linux-amd64-$HASH.tar.gz"
        tar -czf /tmp/$TARBALL -C build/linux/x64/release bundle
-        ssh "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
-        scp /tmp/$TARBALL "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$TARBALL"
+        ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
+        scp -o StrictHostKeyChecking=no /tmp/$TARBALL "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$TARBALL"
        DOWNLOAD_URL="https://sharedinbox.de/builds/$DATE_PATH/$TARBALL"
        # Merge with any existing latest.json so we don't overwrite the windows key
-        EXISTING=$(ssh "$SSH_USER@$SSH_HOST" "cat public_html/latest.json 2>/dev/null || echo '{}'")
+        EXISTING=$(ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat public_html/latest.json 2>/dev/null || echo '{}'")
        WINDOWS_URL=$(echo "$EXISTING" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('windows',''))" 2>/dev/null || true)
        if [ -n "$WINDOWS_URL" ]; then
          echo "{\"version\":\"$HASH\",\"linux\":\"$DOWNLOAD_URL\",\"windows\":\"$WINDOWS_URL\"}" | \
-            ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+            ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
        else
          echo "{\"version\":\"$HASH\",\"linux\":\"$DOWNLOAD_URL\"}" | \
-            ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+            ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
        fi
        echo "Uploaded $TARBALL and updated latest.json"

@@ -429,28 +416,24 @@ tasks:
        msg: "SSH_USER is not set"
      - sh: test -n "$SSH_HOST"
        msg: "SSH_HOST is not set"
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
      - |
-        mkdir -p ~/.ssh
-        printf '%s\n' "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        HASH=$(git rev-parse --short HEAD)
        DATE_PATH=$(date -u +%Y/%m/%d)
        REMOTE_DIR="public_html/builds/$DATE_PATH"
        ZIPFILE="sharedinbox-windows-x64-$HASH.zip"
        cd build/windows/x64/runner && zip -r /tmp/$ZIPFILE Release/ && cd -
-        ssh "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
-        scp /tmp/$ZIPFILE "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$ZIPFILE"
+        ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
+        scp -o StrictHostKeyChecking=no /tmp/$ZIPFILE "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$ZIPFILE"
        DOWNLOAD_URL="https://sharedinbox.de/builds/$DATE_PATH/$ZIPFILE"
-        EXISTING=$(ssh "$SSH_USER@$SSH_HOST" "cat public_html/latest.json 2>/dev/null || echo '{}'")
+        EXISTING=$(ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat public_html/latest.json 2>/dev/null || echo '{}'")
        LINUX_URL=$(echo "$EXISTING" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('linux',''))" 2>/dev/null || true)
        if [ -n "$LINUX_URL" ]; then
          echo "{\"version\":\"$HASH\",\"linux\":\"$LINUX_URL\",\"windows\":\"$DOWNLOAD_URL\"}" | \
-            ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+            ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
        else
          echo "{\"version\":\"$HASH\",\"windows\":\"$DOWNLOAD_URL\"}" | \
-            ssh "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
+            ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "cat > public_html/latest.json"
        fi
        echo "Uploaded $ZIPFILE and updated latest.json"

@@ -600,18 +583,14 @@ tasks:
        msg: "SSH_USER is not set"
      - sh: test -n "$SSH_HOST"
        msg: "SSH_HOST is not set"
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
      - |
-        mkdir -p ~/.ssh
-        printf '%s\n' "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        HASH=$(git rev-parse --short HEAD)
        DATE_PATH=$(date -u +%Y/%m/%d)
        REMOTE_DIR="public_html/builds/$DATE_PATH"
        APK_NAME="sharedinbox-mua-$HASH.apk"
-        ssh "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
-        scp \
+        ssh -o StrictHostKeyChecking=no "$SSH_USER@$SSH_HOST" "mkdir -p $REMOTE_DIR"
+        scp -o StrictHostKeyChecking=no \
          build/app/outputs/flutter-apk/app-release.apk \
          "$SSH_USER@$SSH_HOST:$REMOTE_DIR/$APK_NAME"
        echo "Uploaded $APK_NAME to $REMOTE_DIR"
@@ -640,16 +619,12 @@ tasks:
  website-deploy:
    desc: Deploy the website via rsync to public_html
    deps: [website-build]
-    preconditions:
-      - sh: test -n "$SSH_KNOWN_HOSTS"
-        msg: "SSH_KNOWN_HOSTS is not set"
    cmds:
      - |
-        mkdir -p ~/.ssh
-        printf '%s\n' "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
        rsync -avz --delete \
          --exclude='*.apk' \
          --exclude='*.tar.gz' \
+          -e "ssh -o StrictHostKeyChecking=no" \
          website/public/ \
          ${SSH_USER}@${SSH_HOST}:public_html/

@@ -318,13 +318,12 @@ func (m *Ci) Hugo() *dagger.Container {
 }

 // Deploy container for rsync/ssh
-func (m *Ci) Deployer(sshKey *dagger.Secret, knownHosts *dagger.Secret) *dagger.Container {
+func (m *Ci) Deployer(sshKey *dagger.Secret) *dagger.Container {
 	return dag.Container().
 		From("alpine:3.21").
 		WithExec([]string{"apk", "--no-cache", "add", "rsync", "openssh-client", "python3", "tar"}).
 		WithMountedSecret("/root/.ssh/id_ed25519", sshKey, dagger.ContainerWithMountedSecretOpts{Mode: 0600}).
-		WithMountedSecret("/root/.ssh/known_hosts", knownHosts, dagger.ContainerWithMountedSecretOpts{Mode: 0644}).
-		WithEnvVariable("RSYNC_RSH", "ssh -i /root/.ssh/id_ed25519")
+		WithEnvVariable("RSYNC_RSH", "ssh -o StrictHostKeyChecking=no -i /root/.ssh/id_ed25519")
 }

 // Stalwart mail server service for backend and integration tests.
@@ -515,7 +514,6 @@ func (m *Ci) Check(ctx context.Context) (string, error) {
 func (m *Ci) GenerateBuildHistory(
 	ctx context.Context,
 	sshKey *dagger.Secret,
-	knownHosts *dagger.Secret,
 	sshUser string,
 	sshHost string,
 ) *dagger.Directory {
@@ -527,7 +525,7 @@ func (m *Ci) GenerateBuildHistory(
 		From("python:3.12-alpine").
 		WithExec([]string{"apk", "add", "--no-cache", "openssh-client"}).
 		WithMountedSecret("/root/.ssh/id_ed25519", sshKey, dagger.ContainerWithMountedSecretOpts{Mode: 0600}).
-		WithMountedSecret("/root/.ssh/known_hosts", knownHosts, dagger.ContainerWithMountedSecretOpts{Mode: 0644}).
+		WithExec([]string{"chmod", "700", "/root/.ssh"}).
 		WithEnvVariable("SSH_USER", sshUser).
 		WithEnvVariable("SSH_HOST", sshHost).
 		WithDirectory("/src", scriptSource).
@@ -540,11 +538,10 @@ func (m *Ci) GenerateBuildHistory(
 func (m *Ci) BuildWebsite(
 	ctx context.Context,
 	sshKey *dagger.Secret,
-	knownHosts *dagger.Secret,
 	sshUser string,
 	sshHost string,
 ) *dagger.Directory {
-	buildHistory := m.GenerateBuildHistory(ctx, sshKey, knownHosts, sshUser, sshHost)
+	buildHistory := m.GenerateBuildHistory(ctx, sshKey, sshUser, sshHost)

 	websiteSource := m.Source.Filter(dagger.DirectoryFilterOpts{
 		Include: []string{"website/"},
@@ -561,13 +558,12 @@ func (m *Ci) BuildWebsite(
 func (m *Ci) PublishWebsite(
 	ctx context.Context,
 	sshKey *dagger.Secret,
-	knownHosts *dagger.Secret,
 	sshUser string,
 	sshHost string,
 ) (string, error) {
-	public := m.BuildWebsite(ctx, sshKey, knownHosts, sshUser, sshHost)
+	public := m.BuildWebsite(ctx, sshKey, sshUser, sshHost)

-	return m.Deployer(sshKey, knownHosts).
+	return m.Deployer(sshKey).
 		WithDirectory("/public", public).
 		WithExec([]string{"rsync", "-avz", "--delete",
 			"--exclude=*.apk", "--exclude=*.tar.gz",
@@ -593,7 +589,6 @@ func (m *Ci) BuildLinuxRelease() *dagger.Directory {
 func (m *Ci) DeployLinux(
 	ctx context.Context,
 	sshKey *dagger.Secret,
-	knownHosts *dagger.Secret,
 	sshUser string,
 	sshHost string,
 	commitHash string,
@@ -604,11 +599,11 @@ func (m *Ci) DeployLinux(
 	remoteDir := fmt.Sprintf("public_html/builds/%s", datePath)
 	tarball := fmt.Sprintf("sharedinbox-linux-amd64-%s.tar.gz", commitHash)

-	return m.Deployer(sshKey, knownHosts).
+	return m.Deployer(sshKey).
 		WithDirectory("/bundle", bundle).
 		WithExec([]string{"/bin/sh", "-c", fmt.Sprintf("tar -czf /tmp/%s -C /bundle .", tarball)}).
-		WithExec([]string{"ssh", "-i", "/root/.ssh/id_ed25519", fmt.Sprintf("%s@%s", sshUser, sshHost), fmt.Sprintf("mkdir -p %s", remoteDir)}).
-		WithExec([]string{"/bin/sh", "-c", fmt.Sprintf("scp -i /root/.ssh/id_ed25519 /tmp/%s %s@%s:%s/%s", tarball, sshUser, sshHost, remoteDir, tarball)}).
+		WithExec([]string{"ssh", "-o", "StrictHostKeyChecking=no", "-i", "/root/.ssh/id_ed25519", fmt.Sprintf("%s@%s", sshUser, sshHost), fmt.Sprintf("mkdir -p %s", remoteDir)}).
+		WithExec([]string{"/bin/sh", "-c", fmt.Sprintf("scp -o StrictHostKeyChecking=no -i /root/.ssh/id_ed25519 /tmp/%s %s@%s:%s/%s", tarball, sshUser, sshHost, remoteDir, tarball)}).
 		Stdout(ctx)
 }

@@ -631,7 +626,6 @@ func (m *Ci) BuildAndroidApk(keystoreBase64 *dagger.Secret, keystorePassword *da
 func (m *Ci) DeployApk(
 	ctx context.Context,
 	sshKey *dagger.Secret,
-	knownHosts *dagger.Secret,
 	sshUser string,
 	sshHost string,
 	commitHash string,
@@ -645,10 +639,10 @@ func (m *Ci) DeployApk(
 	remoteDir := fmt.Sprintf("public_html/builds/%s", datePath)
 	apkName := fmt.Sprintf("sharedinbox-mua-%s.apk", commitHash)

-	return m.Deployer(sshKey, knownHosts).
+	return m.Deployer(sshKey).
 		WithFile("/tmp/app.apk", apk).
-		WithExec([]string{"ssh", "-i", "/root/.ssh/id_ed25519", fmt.Sprintf("%s@%s", sshUser, sshHost), fmt.Sprintf("mkdir -p %s", remoteDir)}).
-		WithExec([]string{"/bin/sh", "-c", fmt.Sprintf("scp -i /root/.ssh/id_ed25519 /tmp/app.apk %s@%s:%s/%s", sshUser, sshHost, remoteDir, apkName)}).
+		WithExec([]string{"ssh", "-o", "StrictHostKeyChecking=no", "-i", "/root/.ssh/id_ed25519", fmt.Sprintf("%s@%s", sshUser, sshHost), fmt.Sprintf("mkdir -p %s", remoteDir)}).
+		WithExec([]string{"/bin/sh", "-c", fmt.Sprintf("scp -o StrictHostKeyChecking=no -i /root/.ssh/id_ed25519 /tmp/app.apk %s@%s:%s/%s", sshUser, sshHost, remoteDir, apkName)}).
 		Stdout(ctx)
 }

@@ -19,8 +19,6 @@ class SyncLogEntry {
    required this.id,
    required this.result,
    this.errorMessage,
-    this.stackTrace,
-    this.isPermanent = false,
    required this.protocol,
    required this.emailsFetched,
    required this.emailsSkipped,
@@ -36,8 +34,6 @@ class SyncLogEntry {
  final int id;
  final String result; // 'ok' or 'error'
  final String? errorMessage;
-  final String? stackTrace;
-  final bool isPermanent;
  final String protocol; // 'imap' or 'jmap'
  final int emailsFetched;
  final int emailsSkipped;
@@ -58,8 +54,6 @@ abstract class SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool isPermanent = false,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -87,8 +81,6 @@ class NoOpSyncLogRepository implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool isPermanent = false,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -260,8 +260,6 @@ class _AccountSync implements _SyncLoop {
            accountId: account.id,
            success: false,
            errorMessage: e.toString(),
-            stackTrace: st.toString(),
-            isPermanent: isPermanent,
            protocol: 'imap',
            emailsFetched: 0,
            emailsSkipped: 0,
@@ -515,8 +513,6 @@ class _JmapAccountSync implements _SyncLoop {
            accountId: account.id,
            success: false,
            errorMessage: e.toString(),
-            stackTrace: st.toString(),
-            isPermanent: isPermanent,
            protocol: 'jmap',
            emailsFetched: 0,
            emailsSkipped: 0,
@@ -192,9 +192,6 @@ class SyncLogs extends Table {
  DateTimeColumn get finishedAt => dateTime()();
  // Added in schema v13: raw protocol log when account.verbose == true.
  TextColumn get protocolLog => text().nullable()();
-  // Added in schema v33: stack trace and permanent flag for error entries.
-  TextColumn get errorStackTrace => text().nullable()();
-  BoolColumn get isPermanent => boolean().withDefault(const Constant(false))();
 }

 /// Per-mailbox breakdown for a single sync cycle.
@@ -332,7 +329,7 @@ class AppDatabase extends _$AppDatabase {
  AppDatabase([QueryExecutor? executor]) : super(executor ?? _openConnection());

  @override
-  int get schemaVersion => 33;
+  int get schemaVersion => 32;

  Future<void> _createEmailFts() async {
    await customStatement('''
@@ -573,10 +570,6 @@ class AppDatabase extends _$AppDatabase {
          if (from < 32) {
            await m.createTable(localSieveApplied);
          }
-          if (from >= 7 && from < 33) {
-            await m.addColumn(syncLogs, syncLogs.errorStackTrace);
-            await m.addColumn(syncLogs, syncLogs.isPermanent);
-          }
        },
      );
 }
@@ -13,8 +13,6 @@ class SyncLogRepositoryImpl implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool isPermanent = false,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -32,8 +30,6 @@ class SyncLogRepositoryImpl implements SyncLogRepository {
              accountId: accountId,
              result: success ? 'ok' : 'error',
              errorMessage: Value(errorMessage),
-              errorStackTrace: Value(stackTrace),
-              isPermanent: Value(isPermanent),
              protocol: Value(protocol),
              itemsSynced: Value(emailsFetched),
              emailsSkipped: Value(emailsSkipped),
@@ -79,8 +75,6 @@ class SyncLogRepositoryImpl implements SyncLogRepository {
            id: r.id,
            result: r.result,
            errorMessage: r.errorMessage,
-            stackTrace: r.errorStackTrace,
-            isPermanent: r.isPermanent,
            protocol: r.protocol,
            emailsFetched: r.itemsSynced,
            emailsSkipped: r.emailsSkipped,
@@ -1,6 +1,6 @@
 import 'dart:async';
+import 'dart:io';

-import 'package:device_info_plus/device_info_plus.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_markdown_plus/flutter_markdown_plus.dart';
@@ -8,7 +8,6 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:package_info_plus/package_info_plus.dart';
 import 'package:sharedinbox/core/models/account.dart';
 import 'package:sharedinbox/di.dart';
-import 'package:sharedinbox/ui/utils/about_markdown.dart';
 import 'package:url_launcher/url_launcher.dart';

 class AboutScreen extends ConsumerStatefulWidget {
@@ -20,15 +19,57 @@ class AboutScreen extends ConsumerStatefulWidget {

 class _AboutScreenState extends ConsumerState<AboutScreen> {
  final Future<PackageInfo> _packageInfoFuture = PackageInfo.fromPlatform();
-  final Future<AndroidDeviceInfo?> _androidInfoFuture = getAndroidDeviceInfo();
  late final Stream<List<Account>> _accountsStream;

+  static const _gitHash = String.fromEnvironment('GIT_HASH');
+
  @override
  void initState() {
    super.initState();
    _accountsStream = ref.read(accountRepositoryProvider).observeAccounts();
  }

+  String _buildMarkdown(
+    BuildContext context,
+    PackageInfo? pkg,
+    int imapCount,
+    int jmapCount,
+  ) {
+    final size = MediaQuery.of(context).size;
+    final pixelRatio = MediaQuery.of(context).devicePixelRatio;
+    final physW = (size.width * pixelRatio).toInt();
+    final physH = (size.height * pixelRatio).toInt();
+    final version =
+        pkg != null ? '${pkg.version}+${pkg.buildNumber}' : 'unknown';
+    final versionDisplay = _gitHash.isNotEmpty
+        ? '[$version](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash)'
+        : version;
+    final osName = _capitalize(Platform.operatingSystem);
+    final isDark = MediaQuery.of(context).platformBrightness == Brightness.dark;
+
+    final gitCommitLine = _gitHash.isNotEmpty
+        ? '| Git Commit | [$_gitHash](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash) |\n'
+        : '';
+    return '## [sharedinbox.de](https://sharedinbox.de)\n\n'
+        '| Property | Value |\n'
+        '|----------|-------|\n'
+        '| App Version | $versionDisplay |\n'
+        '$gitCommitLine'
+        '| Platform | ${Platform.operatingSystem} |\n'
+        '| $osName Version | ${Platform.operatingSystemVersion} |\n'
+        '| Resolution | ${physW}x$physH px'
+        ' (logical: ${size.width.toInt()}x${size.height.toInt()} pt,'
+        ' ratio: ${pixelRatio.toStringAsFixed(1)}x) |\n'
+        '| Dart Version | ${Platform.version.split(' ').first} |\n'
+        '| Processors | ${Platform.numberOfProcessors} |\n'
+        '| Dark Mode | ${isDark ? 'yes' : 'no'} |\n'
+        '| IMAP Accounts | $imapCount |\n'
+        '| JMAP Accounts | $jmapCount |\n';
+  }
+
+  static String _capitalize(String s) =>
+      s.isEmpty ? s : '${s[0].toUpperCase()}${s.substring(1)}';
+
  Future<void> _copyToClipboard(
    BuildContext context,
    int imapCount,
@@ -38,17 +79,10 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
    try {
      pkg = await _packageInfoFuture;
    } catch (_) {}
-    final androidInfo = await _androidInfoFuture;
    if (!context.mounted) return;
    await Clipboard.setData(
      ClipboardData(
-        text: buildAboutMarkdown(
-          context: context,
-          pkg: pkg,
-          imapCount: imapCount,
-          jmapCount: jmapCount,
-          androidInfo: androidInfo,
-        ),
+        text: _buildMarkdown(context, pkg, imapCount, jmapCount),
      ),
    );
    if (context.mounted) {
@@ -70,16 +104,9 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
    try {
      pkg = await _packageInfoFuture;
    } catch (_) {}
-    final androidInfo = await _androidInfoFuture;
    if (!context.mounted) return;
    final body = Uri.encodeComponent(
-      buildAboutMarkdown(
-        context: context,
-        pkg: pkg,
-        imapCount: imapCount,
-        jmapCount: jmapCount,
-        androidInfo: androidInfo,
-      ),
+      _buildMarkdown(context, pkg, imapCount, jmapCount),
    );
    final url = Uri.parse(
      'https://codeberg.org/guettli/sharedinbox/issues/new?body=$body',
@@ -129,29 +156,23 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
                    if (snapshot.connectionState == ConnectionState.waiting) {
                      return const Center(child: CircularProgressIndicator());
                    }
-                    return FutureBuilder<AndroidDeviceInfo?>(
-                      future: _androidInfoFuture,
-                      builder: (context, androidSnapshot) {
-                        return Markdown(
-                          data: buildAboutMarkdown(
-                            context: context,
-                            pkg: snapshot.data,
-                            imapCount: imapCount,
-                            jmapCount: jmapCount,
-                            androidInfo: androidSnapshot.data,
-                          ),
-                          selectable: true,
-                          onTapLink: (text, href, title) {
-                            if (href != null) {
-                              unawaited(
-                                launchUrl(
-                                  Uri.parse(href),
-                                  mode: LaunchMode.externalApplication,
-                                ),
-                              );
-                            }
-                          },
-                        );
+                    return Markdown(
+                      data: _buildMarkdown(
+                        context,
+                        snapshot.data,
+                        imapCount,
+                        jmapCount,
+                      ),
+                      selectable: true,
+                      onTapLink: (text, href, title) {
+                        if (href != null) {
+                          unawaited(
+                            launchUrl(
+                              Uri.parse(href),
+                              mode: LaunchMode.externalApplication,
+                            ),
+                          );
+                        }
                      },
                    );
                  },
@@ -37,9 +37,6 @@ class _AccountReceiveScreenState extends ConsumerState<AccountReceiveScreen> {
  bool _scannerActive = false;

  MobileScannerController? _scannerController;
-  // True when the scanner plugin fails to initialise at runtime (e.g.
-  // MissingPluginException on some Android builds).
-  bool _scannerFailed = false;

  @override
  void initState() {
@@ -79,35 +76,8 @@ class _AccountReceiveScreenState extends ConsumerState<AccountReceiveScreen> {
    setState(() {
      _step = _Step.scanning;
      _scannerActive = true;
+      _scannerController = MobileScannerController();
    });
-    if (_cameraScanSupported()) {
-      unawaited(_initScanner());
-    }
-  }
-
-  // Pre-flight: start + stop the scanner to verify the plugin is available.
-  // Falls back to text entry on any exception (including MissingPluginException).
-  Future<void> _initScanner() async {
-    MobileScannerController? ctrl;
-    bool available = false;
-    try {
-      ctrl = MobileScannerController();
-      await ctrl.start();
-      await ctrl.stop();
-      available = true;
-    } catch (_) {
-      // Plugin not available on this device; text fallback will be shown.
-    } finally {
-      try {
-        await ctrl?.dispose();
-      } catch (_) {}
-    }
-    if (!mounted) return;
-    if (available) {
-      setState(() => _scannerController = MobileScannerController());
-    } else {
-      setState(() => _scannerFailed = true);
-    }
  }

  Future<void> _onScanned(String rawValue) async {
@@ -296,14 +266,11 @@ class _AccountReceiveScreenState extends ConsumerState<AccountReceiveScreen> {
  }

  Widget _buildScannerView(BuildContext context) {
-    // Fall back to text input when the platform has no camera support or when
-    // the scanner plugin fails to initialise at runtime (MissingPluginException).
-    if (!_cameraScanSupported() || _scannerFailed) {
+    // On platforms where the camera scanner is not available (Linux desktop),
+    // fall back to a text-input field.
+    if (!_cameraScanSupported()) {
      return _buildTextFallbackView(context);
    }
-    if (_scannerController == null) {
-      return const Center(child: CircularProgressIndicator());
-    }

    return Stack(
      children: [
@@ -45,40 +45,12 @@ class _AccountSendScreenState extends ConsumerState<AccountSendScreen> {
  bool _scannerActive = true;

  MobileScannerController? _scannerController;
-  // True when the scanner plugin fails to initialise at runtime (e.g.
-  // MissingPluginException on some Android builds).
-  bool _scannerFailed = false;

  @override
  void initState() {
    super.initState();
    if (_cameraScanSupported()) {
-      unawaited(_initScanner());
-    }
-  }
-
-  // Pre-flight: start + stop the scanner to verify the plugin is available.
-  // Falls back to text entry on any exception (including MissingPluginException).
-  Future<void> _initScanner() async {
-    MobileScannerController? ctrl;
-    bool available = false;
-    try {
-      ctrl = MobileScannerController();
-      await ctrl.start();
-      await ctrl.stop();
-      available = true;
-    } catch (_) {
-      // Plugin not available on this device; text fallback will be shown.
-    } finally {
-      try {
-        await ctrl?.dispose();
-      } catch (_) {}
-    }
-    if (!mounted) return;
-    if (available) {
-      setState(() => _scannerController = MobileScannerController());
-    } else {
-      setState(() => _scannerFailed = true);
+      _scannerController = MobileScannerController();
    }
  }

@@ -206,12 +178,9 @@ class _AccountSendScreenState extends ConsumerState<AccountSendScreen> {
  }

  Widget _buildScanStep(BuildContext context) {
-    if (!_cameraScanSupported() || _scannerFailed) {
+    if (!_cameraScanSupported()) {
      return _buildTextFallbackView(context);
    }
-    if (_scannerController == null) {
-      return const Center(child: CircularProgressIndicator());
-    }

    return Stack(
      children: [
@@ -10,12 +10,12 @@ class CrashScreen extends StatelessWidget {
    super.key,
    required this.exception,
    required this.stackTrace,
-    this.gitHash = const String.fromEnvironment('GIT_HASH'),
  });

  final Object exception;
  final StackTrace? stackTrace;
-  final String gitHash;
+
+  static const _gitHash = String.fromEnvironment('GIT_HASH');

  Future<String> _buildReport() async {
    String version = 'unknown';
@@ -25,13 +25,10 @@ class CrashScreen extends StatelessWidget {
    } catch (_) {}
    final platform =
        '${Platform.operatingSystem} ${Platform.operatingSystemVersion}';
-    final versionDisplay = gitHash.isNotEmpty
-        ? '[$version](https://codeberg.org/guettli/sharedinbox/commit/$gitHash)'
-        : version;
-    final gitLine = gitHash.isNotEmpty
-        ? 'Git Commit: [$gitHash](https://codeberg.org/guettli/sharedinbox/commit/$gitHash)\n'
+    final gitLine = _gitHash.isNotEmpty
+        ? 'Git Commit: [$_gitHash](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash)\n'
        : '';
-    return 'App Version: $versionDisplay\n'
+    return 'App Version: $version\n'
        '$gitLine'
        'Platform: $platform\n\n'
        'Error:\n```\n$exception\n```\n\n'
@@ -59,56 +56,12 @@ class CrashScreen extends StatelessWidget {
                  style: Theme.of(ctx).textTheme.titleMedium,
                  textAlign: TextAlign.center,
                ),
-                if (gitHash.isNotEmpty) ...[
+                if (_gitHash.isNotEmpty) ...[
                  const SizedBox(height: 8),
-                  FutureBuilder<PackageInfo>(
-                    future: PackageInfo.fromPlatform(),
-                    builder: (_, snapshot) {
-                      if (!snapshot.hasData) return const SizedBox.shrink();
-                      final version =
-                          '${snapshot.data!.version}+${snapshot.data!.buildNumber}';
-                      return GestureDetector(
-                        onTap: () async {
-                          final url = Uri.parse(
-                            'https://codeberg.org/guettli/sharedinbox/commit/$gitHash',
-                          );
-                          await launchUrl(
-                            url,
-                            mode: LaunchMode.externalApplication,
-                          );
-                        },
-                        child: Text(
-                          'App Version: $version',
-                          style: const TextStyle(
-                            fontSize: 12,
-                            color: Colors.blue,
-                            decoration: TextDecoration.underline,
-                          ),
-                          textAlign: TextAlign.center,
-                        ),
-                      );
-                    },
-                  ),
-                  const SizedBox(height: 4),
-                  GestureDetector(
-                    onTap: () async {
-                      final url = Uri.parse(
-                        'https://codeberg.org/guettli/sharedinbox/commit/$gitHash',
-                      );
-                      await launchUrl(
-                        url,
-                        mode: LaunchMode.externalApplication,
-                      );
-                    },
-                    child: Text(
-                      'Git Commit: $gitHash',
-                      style: const TextStyle(
-                        fontSize: 12,
-                        color: Colors.blue,
-                        decoration: TextDecoration.underline,
-                      ),
-                      textAlign: TextAlign.center,
-                    ),
+                  const Text(
+                    'Git Commit: $_gitHash',
+                    style: TextStyle(fontSize: 12, color: Colors.grey),
+                    textAlign: TextAlign.center,
                  ),
                ],
                const SizedBox(height: 24),
@@ -153,6 +106,32 @@ class CrashScreen extends StatelessWidget {
                    ),
                  ),
                ],
+                if (_gitHash.isNotEmpty) ...[
+                  const SizedBox(height: 16),
+                  const Text(
+                    'Git Commit:',
+                    style: TextStyle(fontWeight: FontWeight.bold),
+                  ),
+                  const SizedBox(height: 4),
+                  GestureDetector(
+                    onTap: () async {
+                      final url = Uri.parse(
+                        'https://codeberg.org/guettli/sharedinbox/commit/$_gitHash',
+                      );
+                      await launchUrl(
+                        url,
+                        mode: LaunchMode.externalApplication,
+                      );
+                    },
+                    child: const Text(
+                      _gitHash,
+                      style: TextStyle(
+                        color: Colors.blue,
+                        decoration: TextDecoration.underline,
+                      ),
+                    ),
+                  ),
+                ],
                const SizedBox(height: 24),
                FilledButton.icon(
                  onPressed: () async {
@@ -38,7 +38,6 @@ class _EditAccountScreenState extends ConsumerState<EditAccountScreen> {
  var _sieveSsl = true;
  var _verbose = false;
  final _jmapUrlCtrl = TextEditingController();
-  bool _hasStoredPassword = false;

  // -- "Try connection" state ------------------------------------------------
  bool _tryTesting = false;
@@ -64,11 +63,6 @@ class _EditAccountScreenState extends ConsumerState<EditAccountScreen> {
      context.pop();
      return;
    }
-    try {
-      await repo.getPassword(account.id);
-      _hasStoredPassword = true;
-    } catch (_) {}
-    if (!mounted) return;
    _account = account;
    _displayNameCtrl.text = account.displayName;
    _usernameCtrl.text = account.username;
@@ -273,12 +267,10 @@ class _EditAccountScreenState extends ConsumerState<EditAccountScreen> {
            ),
            _field(
              _passwordCtrl,
-              _hasStoredPassword
-                  ? 'New password (leave blank to keep)'
-                  : 'Password',
+              'New password (leave blank to keep)',
              key: const Key('editPasswordField'),
              obscure: true,
-              required: !_hasStoredPassword,
+              required: false,
            ),
            if (account.type == AccountType.jmap) ...[
              const Divider(height: 32),
@@ -1,15 +1,11 @@
 import 'dart:async';

 import 'package:flutter/material.dart';
-import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:intl/intl.dart';
-import 'package:package_info_plus/package_info_plus.dart';

-import 'package:sharedinbox/core/models/account.dart';
 import 'package:sharedinbox/core/repositories/sync_log_repository.dart';
 import 'package:sharedinbox/di.dart';
-import 'package:sharedinbox/ui/utils/about_markdown.dart';

 final _timeFmt = DateFormat('MMM d, HH:mm:ss');

@@ -25,57 +21,6 @@ String _fmtBytes(int bytes) {
  return '${(bytes / (1024 * 1024)).toStringAsFixed(1)} MB';
 }

-String _buildSyncEntryMarkdown(SyncLogEntry entry) {
-  final buf = StringBuffer();
-  buf.writeln('## Sync Entry');
-  buf.writeln();
-  buf.writeln('| Property | Value |');
-  buf.writeln('|----------|-------|');
-  buf.writeln('| Started | ${_timeFmt.format(entry.startedAt)} |');
-  buf.writeln('| Finished | ${_timeFmt.format(entry.finishedAt)} |');
-  buf.writeln('| Duration | ${_fmtDuration(entry.duration)} |');
-  if (entry.protocol.isNotEmpty) {
-    buf.writeln('| Protocol | ${entry.protocol.toUpperCase()} |');
-  }
-  final statusLabel = entry.isOk
-      ? 'OK'
-      : entry.isPermanent
-          ? 'Error (permanent)'
-          : 'Error';
-  buf.writeln('| Status | $statusLabel |');
-  buf.writeln('| Emails fetched | ${entry.emailsFetched} |');
-  buf.writeln('| Emails up-to-date | ${entry.emailsSkipped} |');
-  buf.writeln('| Mailboxes synced | ${entry.mailboxesSynced} |');
-  buf.writeln('| Pending changes flushed | ${entry.pendingFlushed} |');
-  buf.writeln('| Data transferred | ${_fmtBytes(entry.bytesTransferred)} |');
-  if (entry.mailboxStats.isNotEmpty) {
-    buf.writeln();
-    buf.writeln('### Per mailbox');
-    buf.writeln();
-    buf.writeln('| Mailbox | Fetched | Up-to-date | Duration |');
-    buf.writeln('|---------|---------|------------|----------|');
-    for (final m in entry.mailboxStats) {
-      final dur = m.duration != null ? _fmtDuration(m.duration!) : '-';
-      buf.writeln('| ${m.mailboxPath} | ${m.fetched} | ${m.skipped} | $dur |');
-    }
-  }
-  if (entry.errorMessage != null) {
-    buf.writeln();
-    buf.writeln('**Error:**');
-    buf.writeln();
-    buf.writeln(entry.errorMessage);
-  }
-  if (entry.stackTrace != null) {
-    buf.writeln();
-    buf.writeln('**Stack trace:**');
-    buf.writeln();
-    buf.writeln('```');
-    buf.write(entry.stackTrace);
-    buf.writeln('```');
-  }
-  return buf.toString();
-}
-
 class SyncLogScreen extends ConsumerStatefulWidget {
  const SyncLogScreen({super.key, required this.accountId});

@@ -124,41 +69,6 @@ class _SyncLogScreenState extends ConsumerState<SyncLogScreen> {
    ref.read(syncManagerProvider).syncNow(widget.accountId);
  }

-  Future<void> _copyEntry(SyncLogEntry entry, BuildContext context) async {
-    final accounts =
-        await ref.read(accountRepositoryProvider).observeAccounts().first;
-    final imapCount = accounts.where((a) => a.type == AccountType.imap).length;
-    final jmapCount = accounts.where((a) => a.type == AccountType.jmap).length;
-
-    PackageInfo? pkg;
-    try {
-      pkg = await PackageInfo.fromPlatform();
-    } catch (_) {}
-
-    final androidInfo = await getAndroidDeviceInfo();
-
-    if (!context.mounted) return;
-
-    final syncMd = _buildSyncEntryMarkdown(entry);
-    final aboutMd = buildAboutMarkdown(
-      context: context,
-      pkg: pkg,
-      imapCount: imapCount,
-      jmapCount: jmapCount,
-      androidInfo: androidInfo,
-    );
-    await Clipboard.setData(ClipboardData(text: '$syncMd\n$aboutMd'));
-
-    if (context.mounted) {
-      ScaffoldMessenger.of(context).showSnackBar(
-        const SnackBar(
-          duration: Duration(seconds: 3),
-          content: Text('Copied to clipboard'),
-        ),
-      );
-    }
-  }
-
  @override
  Widget build(BuildContext context) {
    return Scaffold(
@@ -186,20 +96,16 @@ class _SyncLogScreenState extends ConsumerState<SyncLogScreen> {
          ? const Center(child: Text('No sync entries yet'))
          : ListView.builder(
              itemCount: _entries.length,
-              itemBuilder: (ctx, i) => _SyncLogTile(
-                entry: _entries[i],
-                onCopy: () => _copyEntry(_entries[i], ctx),
-              ),
+              itemBuilder: (ctx, i) => _SyncLogTile(entry: _entries[i]),
            ),
    );
  }
 }

 class _SyncLogTile extends StatelessWidget {
-  const _SyncLogTile({required this.entry, required this.onCopy});
+  const _SyncLogTile({required this.entry});

  final SyncLogEntry entry;
-  final VoidCallback onCopy;

  @override
  Widget build(BuildContext context) {
@@ -209,12 +115,6 @@ class _SyncLogTile extends StatelessWidget {
    final theme = Theme.of(context);
    final errorColor = theme.colorScheme.error;

-    final subtitleText = entry.isOk
-        ? '${entry.emailsFetched} new · ${entry.emailsSkipped} up-to-date · took $durationLabel'
-        : entry.isPermanent
-            ? 'Error (permanent) · took $durationLabel'
-            : 'Error · took $durationLabel';
-
    return ExpansionTile(
      leading: Icon(
        entry.isOk ? Icons.check_circle : Icons.error_outline,
@@ -225,20 +125,11 @@ class _SyncLogTile extends StatelessWidget {
        style: entry.isOk ? null : TextStyle(color: errorColor),
      ),
      subtitle: Text(
-        subtitleText,
+        entry.isOk
+            ? '${entry.emailsFetched} new · ${entry.emailsSkipped} up-to-date · took $durationLabel'
+            : 'Error · took $durationLabel',
        style: TextStyle(fontSize: 12, color: entry.isOk ? null : errorColor),
      ),
-      trailing: Row(
-        mainAxisSize: MainAxisSize.min,
-        children: [
-          IconButton(
-            icon: const Icon(Icons.copy, size: 18),
-            tooltip: 'Copy as markdown',
-            onPressed: onCopy,
-          ),
-          const Icon(Icons.expand_more),
-        ],
-      ),
      children: [
        Padding(
          padding: const EdgeInsets.fromLTRB(72, 0, 16, 12),
@@ -280,31 +171,6 @@ class _SyncLogTile extends StatelessWidget {
                    style: TextStyle(color: errorColor, fontSize: 12),
                  ),
                ),
-              if (entry.stackTrace != null) ...[
-                const Padding(
-                  padding: EdgeInsets.only(top: 6, bottom: 2),
-                  child: Text(
-                    'Stack trace',
-                    style: TextStyle(fontSize: 12, color: Colors.grey),
-                  ),
-                ),
-                Container(
-                  width: double.infinity,
-                  padding: const EdgeInsets.all(8),
-                  decoration: BoxDecoration(
-                    color: Colors.black87,
-                    borderRadius: BorderRadius.circular(4),
-                  ),
-                  child: Text(
-                    entry.stackTrace!,
-                    style: TextStyle(
-                      fontSize: 10,
-                      fontFamily: 'monospace',
-                      color: Colors.red[300],
-                    ),
-                  ),
-                ),
-              ],
              if (entry.protocolLog != null) ...[
                const Padding(
                  padding: EdgeInsets.only(top: 6, bottom: 2),
@@ -1,68 +0,0 @@
-import 'dart:io';
-
-import 'package:device_info_plus/device_info_plus.dart';
-import 'package:flutter/material.dart';
-import 'package:package_info_plus/package_info_plus.dart';
-
-const _gitHash = String.fromEnvironment('GIT_HASH');
-
-/// Builds the About markdown table used in [AboutScreen] and sync log copies.
-///
-/// Pass [androidInfo] when running on Android; omit on other platforms.
-String buildAboutMarkdown({
-  required BuildContext context,
-  PackageInfo? pkg,
-  required int imapCount,
-  required int jmapCount,
-  AndroidDeviceInfo? androidInfo,
-}) {
-  final size = MediaQuery.of(context).size;
-  final pixelRatio = MediaQuery.of(context).devicePixelRatio;
-  final physW = (size.width * pixelRatio).toInt();
-  final physH = (size.height * pixelRatio).toInt();
-  final version = pkg != null ? '${pkg.version}+${pkg.buildNumber}' : 'unknown';
-  final versionDisplay = _gitHash.isNotEmpty
-      ? '[$version](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash)'
-      : version;
-  final osName = _capitalize(Platform.operatingSystem);
-  final isDark = MediaQuery.of(context).platformBrightness == Brightness.dark;
-
-  final gitCommitLine = _gitHash.isNotEmpty
-      ? '| Git Commit | [$_gitHash](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash) |\n'
-      : '';
-  final androidLines = androidInfo != null
-      ? '| Android Manufacturer | ${androidInfo.manufacturer} |\n'
-          '| Android Model | ${androidInfo.model} |\n'
-          '| Android Version | ${androidInfo.version.release} |\n'
-      : '';
-
-  return '## [sharedinbox.de](https://sharedinbox.de)\n\n'
-      '| Property | Value |\n'
-      '|----------|-------|\n'
-      '| App Version | $versionDisplay |\n'
-      '$gitCommitLine'
-      '| Platform | ${Platform.operatingSystem} |\n'
-      '| $osName Version | ${Platform.operatingSystemVersion} |\n'
-      '$androidLines'
-      '| Resolution | ${physW}x$physH px'
-      ' (logical: ${size.width.toInt()}x${size.height.toInt()} pt,'
-      ' ratio: ${pixelRatio.toStringAsFixed(1)}x) |\n'
-      '| Dart Version | ${Platform.version.split(' ').first} |\n'
-      '| Processors | ${Platform.numberOfProcessors} |\n'
-      '| Dark Mode | ${isDark ? 'yes' : 'no'} |\n'
-      '| IMAP Accounts | $imapCount |\n'
-      '| JMAP Accounts | $jmapCount |\n';
-}
-
-/// Fetches Android device info, or null on non-Android platforms.
-Future<AndroidDeviceInfo?> getAndroidDeviceInfo() async {
-  if (!Platform.isAndroid) return null;
-  try {
-    return await DeviceInfoPlugin().androidInfo;
-  } catch (_) {
-    return null;
-  }
-}
-
-String _capitalize(String s) =>
-    s.isEmpty ? s : '${s[0].toUpperCase()}${s.substring(1)}';
@@ -249,22 +249,6 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "0.7.12"
-  device_info_plus:
-    dependency: "direct main"
-    description:
-      name: device_info_plus
-      sha256: "6a642e1daa10190af89ba6cb6386c0df7d071a3592080bfe1e44faa63ae1df65"
-      url: "https://pub.dev"
-    source: hosted
-    version: "13.1.0"
-  device_info_plus_platform_interface:
-    dependency: transitive
-    description:
-      name: device_info_plus_platform_interface
-      sha256: "04b173a92e2d9161dfead145667037c8d834db725ce2e7b942bfe18fd2f45a46"
-      url: "https://pub.dev"
-    source: hosted
-    version: "8.1.0"
  drift:
    dependency: "direct main"
    description:
@@ -1300,14 +1284,6 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "6.3.0"
-  win32_registry:
-    dependency: transitive
-    description:
-      name: win32_registry
-      sha256: "73b1d78920a9d6e03f8b4e43e612b87bf3152a0e5c5e5150267762b7c4116904"
-      url: "https://pub.dev"
-    source: hosted
-    version: "3.0.3"
  workmanager:
    dependency: "direct main"
    description:
@@ -62,9 +62,6 @@ dependencies:
  package_info_plus: ^10.1.0
  share_plus: ^13.1.0

-  # Device hardware info for bug reports
-  device_info_plus: ^13.0.0
-
 dev_dependencies:
  flutter_test:
    sdk: flutter
@@ -8,15 +8,12 @@ Flow
   a. Age > 1 h  → kill it, set its issue to State/Question, exit 1
   b. Age ≤ 1 h  → print status, exit 0  (let it keep working)
 2. No agent running → extract pending_issue from state (if any), then check CI
-   a. pending_issue + open PR → check PR branch CI, merge/fix/wait as needed
-   b. Catch-up: orphaned issue-N-fix PRs with passing CI → merge them
-   c. Main CI running         → save pending-ci state, exit 0
-   d. Main CI failed          → start fix-CI agent (pushes fix to main), exit 0
-   e. Main CI ok + pending_issue → close the issue, exit 0  (dead code path —
-                                   section 2a always returns first)
-   f. Main CI ok (or no run yet) → find oldest Ready issue, start issue agent,
-                                   save state, exit 0
-   g. No Ready issues         → print "nothing to do", exit 0
+   a. CI is running         → save pending-ci state, exit 0
+   b. Latest CI failed      → start fix-CI agent (preserving pending_issue), exit 0
+   c. CI ok + pending_issue → close the issue (CI passed), exit 0
+   d. CI ok (or no run yet) → find oldest Ready issue, start issue agent,
+                              save state, exit 0
+   e. No Ready issues       → print "nothing to do", exit 0

 Issue agents must NOT close the issue themselves; the loop closes it after CI passes.

@@ -53,9 +50,7 @@ os.environ["PATH"] = (
 REPO = "guettli/sharedinbox"
 REPO_URL = f"https://codeberg.org/{REPO}"
 STATE_FILE = Path.home() / ".sharedinbox-agent-state.json"
-HEARTBEAT_FILE = Path.home() / ".sharedinbox-agent-heartbeat"
 MAX_AGENT_AGE_SECONDS = 3600  # 1 hour
-MAX_HEARTBEAT_AGE_SECONDS = 7200  # 2 hours
 CLAUDE_PROJECTS_DIR = Path.home() / ".claude" / "projects" / (
    "-" + str(Path.home())[1:].replace("/", "-")
 )
@@ -147,19 +142,10 @@ def _ready_issues() -> list[dict]:
    return ready


-def _latest_main_ci_run() -> dict | None:
-    """Return the latest CI run on the main branch (excludes PR and schedule runs).
-
-    Using the global latest run (limit=1) is wrong: a passing or failing run
-    on a PR branch could mask the true state of main.  We filter to push
-    events on the 'main' prettyref so section-3 logic only reacts to main.
-    """
-    data = _tea_get(f"repos/{REPO}/actions/runs?limit=20")
+def _latest_ci_run() -> dict | None:
+    data = _tea_get(f"repos/{REPO}/actions/runs?limit=1")
    runs = (data or {}).get("workflow_runs", [])
-    for run in runs:
-        if run.get("event") == "push" and run.get("prettyref") == "main":
-            return run
-    return None
+    return runs[0] if runs else None


 def _latest_ci_run_for_branch(branch: str) -> dict | None:
@@ -179,7 +165,7 @@ def _latest_ci_run_for_branch(branch: str) -> dict | None:
                    return run
            except (json.JSONDecodeError, AttributeError):
                pass
-        elif run.get("event") == "push":
+        else:
            if run.get("prettyref") == branch:
                return run
    return None
@@ -275,12 +261,6 @@ def _clear_state() -> None:
    STATE_FILE.unlink(missing_ok=True)


-def _update_heartbeat() -> None:
-    """Record that the agent loop ran right now."""
-    HEARTBEAT_FILE.write_text(datetime.now(timezone.utc).isoformat())
-    HEARTBEAT_FILE.chmod(0o600)
-
-
 def _find_session_uuid(session_name: str) -> str | None:
    """Return the Claude session UUID for *session_name*, or None if not found.

@@ -450,44 +430,12 @@ def cmd_list() -> int:
    return 0


-# ── monitor subcommand ────────────────────────────────────────────────────────
-
-
-def cmd_monitor() -> int:
-    """Check that the agent loop has run within the last 2 hours.
-
-    Exits 0 if healthy, 1 if the heartbeat is missing or stale.
-    Intended to be called from a scheduled CI job or cron every 2 hours.
-    """
-    if not HEARTBEAT_FILE.exists():
-        print(
-            f"WARNING: Agent loop heartbeat file missing — "
-            f"the loop may not have run yet or the file was deleted ({HEARTBEAT_FILE})."
-        )
-        return 1
-    try:
-        last_run = datetime.fromisoformat(HEARTBEAT_FILE.read_text().strip())
-    except ValueError:
-        print(f"WARNING: Agent loop heartbeat file is corrupted: {HEARTBEAT_FILE}")
-        return 1
-    age = (datetime.now(timezone.utc) - last_run).total_seconds()
-    if age > MAX_HEARTBEAT_AGE_SECONDS:
-        print(
-            f"WARNING: Agent loop last ran {age / 3600:.1f}h ago "
-            f"(limit: {MAX_HEARTBEAT_AGE_SECONDS // 3600}h) — the loop may be stalled."
-        )
-        return 1
-    print(f"Agent loop is healthy. Last run: {age / 60:.0f} min ago.")
-    return 0
-
-
 # ── main flow ─────────────────────────────────────────────────────────────────


 def _run_loop() -> int:
    now = datetime.now(timezone.utc)
    print(f"---------------------- Starting {now.strftime('%Y-%m-%d %H:%MZ')}")
-    _update_heartbeat()

    state = _read_state()

@@ -572,9 +520,6 @@ def _run_loop() -> int:
                    "Fetch the CI logs using the task ci-logs command or the Codeberg API. "
                    "Identify the failure, fix it, commit, and push to the same branch. "
                    "Do NOT push to main, do NOT close the issue, do NOT merge the PR. "
-                    "Do NOT reference any issue numbers in commit messages "
-                    "(no 'closes #N', 'fixes #N', or similar) — auto-closing the wrong "
-                    "issue via a commit message would be a bug. "
                    "Verify locally with 'task check' before pushing. "
                    "When done, stop."
                )
@@ -613,25 +558,7 @@ def _run_loop() -> int:

            # CI passed on the PR branch — squash-merge and close.
            print(f"CI passed {_ci_run_url(pr_run['id'])} on branch {branch!r} — merging PR #{pr_number}.")
-            try:
-                _merge_pr(pr_number)
-            except RuntimeError as e:
-                print(f"Merge of PR #{pr_number} failed: {e} — setting to State/Question.")
-                _set_labels(pending_issue, add=[LABEL_QUESTION], remove=[LABEL_IN_PROGRESS])
-                _comment_issue(
-                    pending_issue,
-                    f"Automatic merge of PR #{pr_number} failed: {e}. Please merge manually.",
-                )
-                return 0
-            if _find_pr_for_branch(branch):
-                print(f"PR #{pr_number} is still open after merge attempt — setting to State/Question.")
-                _set_labels(pending_issue, add=[LABEL_QUESTION], remove=[LABEL_IN_PROGRESS])
-                _comment_issue(
-                    pending_issue,
-                    f"Automatic merge of PR #{pr_number} failed (PR is still open after the "
-                    "merge command). Please merge manually.",
-                )
-                return 0
+            _merge_pr(pr_number)
            _close_issue(pending_issue)
            print(f"Merged PR #{pr_number} and closed {_issue_url(pending_issue)}.")
            return 0
@@ -681,26 +608,7 @@ def _run_loop() -> int:

        if pr_run and pr_run.get("status") == "success":
            print(f"Catch-up: CI passed on PR #{pr_number} ({pr_url}) — merging.")
-            try:
-                _merge_pr(pr_number)
-            except RuntimeError as e:
-                print(f"Catch-up: merge of PR #{pr_number} failed: {e} — skipping.")
-                continue
-            # Verify the merge actually happened; fgj can exit 0 without merging
-            # (e.g. branch-protection rules not satisfied).
-            if _find_pr_for_branch(branch):
-                print(
-                    f"Catch-up: PR #{pr_number} is still open after merge attempt "
-                    "— skipping to avoid infinite retry."
-                )
-                if issue_num:
-                    _set_labels(issue_num, add=[LABEL_QUESTION], remove=[LABEL_IN_PROGRESS])
-                    _comment_issue(
-                        issue_num,
-                        f"Automatic merge of PR #{pr_number} failed (PR is still open "
-                        "after the merge command). Please merge manually.",
-                    )
-                continue
+            _merge_pr(pr_number)
            if issue_num:
                _close_issue(issue_num)
                print(f"Merged PR #{pr_number} and closed issue #{issue_num}.")
@@ -708,8 +616,8 @@ def _run_loop() -> int:
                print(f"Merged PR #{pr_number}.")
            return 0

-    # ── 3. Global CI check (main branch only) ────────────────────────────────
-    run = _latest_main_ci_run()
+    # ── 3. Global CI check (agent pushed to main, or no pending issue) ────────
+    run = _latest_ci_run()

    if run and run.get("status") == "running":
        print(f"CI run {_ci_run_url(run['id'])} is still running. Waiting.")
@@ -718,39 +626,17 @@ def _run_loop() -> int:
        return 0

    if run and run.get("status") in ("failure", "error"):
-        # Guard: if the same main CI run has been failing since the last ci-fix
-        # agent started, that agent pushed to a branch instead of main.  Before
-        # spawning another agent, check whether any CI run is currently in
-        # progress (the branch run) and wait if so.
-        if ci_run_id_at_start is not None and run["id"] == ci_run_id_at_start:
-            check = _tea_get(f"repos/{REPO}/actions/runs?limit=5")
-            in_flight = [
-                r for r in (check or {}).get("workflow_runs", [])
-                if r.get("status") == "running"
-            ]
-            if in_flight:
-                print(
-                    f"Main CI still shows the same failed run {run['id']}; "
-                    f"{_ci_run_url(in_flight[0]['id'])} is running "
-                    "(previous ci-fix pushed to a branch). Waiting."
-                )
-                return 0
        print(f"CI run {_ci_run_url(run['id'])} failed — starting fix agent.")
        prompt = (
-            "The Codeberg CI for guettli/sharedinbox just failed on the main branch. "
+            "The Codeberg CI for guettli/sharedinbox just failed. "
            f"The CI run ID is {run['id']}. "
            "Fetch the CI logs using the task ci-logs command or the Codeberg API. "
-            "Identify the failure, fix it, commit, and push directly to main. "
+            "Identify the failure, fix it, commit, and push. "
            "Verify locally with 'task check' before pushing. "
-            "Do NOT reference any issue numbers in commit messages "
-            "(no 'closes #N', 'fixes #N', or similar) — this is a CI fix, "
-            "not an issue fix, and auto-closing an issue via a commit message would be a bug. "
-            "Do NOT close any issues. "
            "When done, stop."
        )
        pid = _start_agent(prompt, "ci-fix")
-        _write_state(pid, pending_issue, "ci-fix", session_name="ci-fix",
-                     ci_run_id=run["id"] if run else None)
+        _write_state(pid, pending_issue, "ci-fix", session_name="ci-fix")
        return 0

    # CI is ok (or no run).
@@ -809,10 +695,7 @@ Instructions:
 - Implement the required change, following the existing code style.
 - Write or update tests as appropriate.
 - Run 'task check' locally and fix any failures before committing.
- Commit with a descriptive message and include (#{issue_number}) in the title,
-  e.g. "feat: description (#{issue_number})".
-  Do NOT use "Closes #N" or "Fixes #N" keywords — the loop closes the issue
-  after CI passes; using those keywords would close it prematurely or wrongly.
+- Commit with a descriptive message referencing the issue number (e.g. "feat: ... (#{issue_number})").
 - Create a branch named `issue-{issue_number}-fix`, push your changes there, and open a PR against main:
      git checkout -b issue-{issue_number}-fix
      git push -u origin issue-{issue_number}-fix
@@ -835,13 +718,10 @@ def main() -> int:
    parser = argparse.ArgumentParser(prog="agent_loop")
    sub = parser.add_subparsers(dest="cmd")
    sub.add_parser("list", help="List recent agent sessions")
-    sub.add_parser("monitor", help="Check that the loop ran within the last 2 hours")
    args = parser.parse_args()

    if args.cmd == "list":
        return cmd_list()
-    if args.cmd == "monitor":
-        return cmd_monitor()
    return _run_loop()


@@ -57,7 +57,6 @@ const _excluded = {
  'lib/ui/widgets/try_connection_button.dart',
  'lib/ui/widgets/undo_shell.dart',
  'lib/ui/screens/about_screen.dart',
-  'lib/ui/utils/about_markdown.dart',
  'lib/ui/widgets/email_tile.dart',
  'lib/core/sync/account_sync_manager.dart',
  'lib/core/sync/background_sync.dart',
@@ -33,6 +33,9 @@ def list_remote_files(ssh_user: str, ssh_host: str, pattern: str) -> list[str]:
    result = subprocess.run(
        [
            "ssh",
+            "-v",
+            "-o", "StrictHostKeyChecking=no",
+            "-i", "/root/.ssh/id_ed25519",
            f"{ssh_user}@{ssh_host}",
            f"find {REMOTE_BUILDS_DIR} -name '{pattern}' -type f | sort",
        ],
@@ -6,7 +6,6 @@ import json
 import os
 import tempfile
 import unittest
-from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from unittest.mock import MagicMock, patch

@@ -201,8 +200,7 @@ class TestMain(unittest.TestCase):
            return 55

        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
+             patch("agent_loop._latest_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[self._make_issue(10)]), \
             patch("agent_loop._set_labels", side_effect=fake_set_labels), \
             patch("agent_loop._start_agent", side_effect=fake_start_agent), \
@@ -228,8 +226,7 @@ class TestMain(unittest.TestCase):
            captured["remove"] = remove

        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
+             patch("agent_loop._latest_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[self._make_issue(7)]), \
             patch("agent_loop._set_labels", side_effect=fake_set_labels), \
             patch("agent_loop._start_agent", return_value=99), \
@@ -242,8 +239,7 @@ class TestMain(unittest.TestCase):
    def test_no_ready_issues_does_nothing(self):
        """main() exits cleanly with 0 when there are no ready issues."""
        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
+             patch("agent_loop._latest_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[]), \
             patch("agent_loop._set_labels") as mock_labels, \
             patch("agent_loop._start_agent") as mock_start:
@@ -262,8 +258,7 @@ class TestMain(unittest.TestCase):
            return 77

        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
+             patch("agent_loop._latest_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[self._make_issue(42)]), \
             patch("agent_loop._set_labels"), \
             patch("agent_loop._start_agent", side_effect=fake_start_agent), \
@@ -297,9 +292,8 @@ class TestPendingCi(unittest.TestCase):

    def test_closes_issue_when_ci_passes_after_agent_finishes(self):
        """After issue agent finishes, loop merges the PR and closes the issue once CI is green."""
-        # First call: PR found open. Second call (post-merge verification): PR closed.
        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch", side_effect=[self._open_pr(), None]), \
+             patch("agent_loop._find_pr_for_branch", side_effect=self._find_pr_open), \
             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "success"}), \
             patch("agent_loop._merge_pr") as mock_merge, \
             patch("agent_loop._close_issue") as mock_close, \
@@ -314,7 +308,7 @@ class TestPendingCi(unittest.TestCase):
        """'CI passed' line includes the CI run URL when a run is available."""
        buf = io.StringIO()
        with patch("agent_loop._read_state", return_value=self._dead_state(10)), \
-             patch("agent_loop._find_pr_for_branch", side_effect=[self._open_pr(), None]), \
+             patch("agent_loop._find_pr_for_branch", side_effect=self._find_pr_open), \
             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 4145144, "status": "success"}), \
             patch("agent_loop._merge_pr"), \
             patch("agent_loop._close_issue"), \
@@ -424,7 +418,7 @@ class TestPendingCi(unittest.TestCase):
    def test_closes_issue_after_ci_fix_and_ci_passes(self):
        """After ci-fix agent finishes and CI passes on PR branch, the pending issue is closed."""
        with patch("agent_loop._read_state", return_value=self._dead_state(10, "ci-fix")), \
-             patch("agent_loop._find_pr_for_branch", side_effect=[self._open_pr(), None]), \
+             patch("agent_loop._find_pr_for_branch", side_effect=self._find_pr_open), \
             patch("agent_loop._latest_ci_run_for_branch", return_value={"id": 1, "status": "success"}), \
             patch("agent_loop._merge_pr") as mock_merge, \
             patch("agent_loop._close_issue") as mock_close, \
@@ -441,8 +435,7 @@ class TestPendingCi(unittest.TestCase):
            "pid": 999999999, "issue": None, "started_at": "2026-01-01T00:00:00+00:00",
            "type": "ci-fix",
        }), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value={"id": 1, "status": "success"}), \
+             patch("agent_loop._latest_ci_run", return_value={"id": 1, "status": "success"}), \
             patch("agent_loop._close_issue") as mock_close, \
             patch("agent_loop._ready_issues", return_value=[]), \
             patch("agent_loop._clear_state"):
@@ -458,8 +451,7 @@ class TestOutputFormat(unittest.TestCase):
    def test_output_starts_with_header(self):
        buf = io.StringIO()
        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
+             patch("agent_loop._latest_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[]), \
             contextlib.redirect_stdout(buf):
            agent_loop._run_loop()
@@ -470,8 +462,7 @@ class TestOutputFormat(unittest.TestCase):
    def test_no_agent_loop_prefix_in_output(self):
        buf = io.StringIO()
        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
+             patch("agent_loop._latest_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[]), \
             contextlib.redirect_stdout(buf):
            agent_loop._run_loop()
@@ -481,8 +472,7 @@ class TestOutputFormat(unittest.TestCase):
        run = {"id": 4145144, "status": "running"}
        buf = io.StringIO()
        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=run), \
+             patch("agent_loop._latest_ci_run", return_value=run), \
             contextlib.redirect_stdout(buf):
            agent_loop._run_loop()
        self.assertIn("https://codeberg.org/guettli/sharedinbox/actions/runs/4145144",
@@ -492,8 +482,7 @@ class TestOutputFormat(unittest.TestCase):
        issue = {"number": 128, "title": "Fix something", "body": "", "labels": []}
        buf = io.StringIO()
        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
+             patch("agent_loop._latest_ci_run", return_value=None), \
             patch("agent_loop._ready_issues", return_value=[issue]), \
             patch("agent_loop._set_labels"), \
             patch("agent_loop._start_agent", return_value=99), \
@@ -505,35 +494,6 @@ class TestOutputFormat(unittest.TestCase):
        self.assertIn("Fix something", output)


-class TestLatestMainCiRun(unittest.TestCase):
-    """_latest_main_ci_run() must return only push-to-main runs, ignoring schedule/deploy workflows."""
-
-    def test_skips_schedule_runs_returns_push_to_main(self):
-        runs = [
-            {"event": "schedule", "prettyref": "main", "status": "success", "id": 1},
-            {"event": "push", "prettyref": "main", "status": "success", "id": 2},
-        ]
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": runs}):
-            result = agent_loop._latest_main_ci_run()
-        self.assertIsNotNone(result)
-        self.assertEqual(result["id"], 2)
-
-    def test_returns_none_when_only_schedule_runs_exist(self):
-        runs = [
-            {"event": "schedule", "prettyref": "main", "status": "success", "id": 1},
-        ]
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": runs}):
-            result = agent_loop._latest_main_ci_run()
-        self.assertIsNone(result)
-
-    def test_returns_push_to_main_run(self):
-        runs = [{"event": "push", "prettyref": "main", "status": "running", "id": 42}]
-        with patch("agent_loop._tea_get", return_value={"workflow_runs": runs}):
-            result = agent_loop._latest_main_ci_run()
-        self.assertIsNotNone(result)
-        self.assertEqual(result["id"], 42)
-
-
 class TestLatestCiRunForBranch(unittest.TestCase):
    """Tests for _latest_ci_run_for_branch — Forgejo API field mapping."""

@@ -733,70 +693,5 @@ class TestRunLoopResumeCommand(unittest.TestCase):
        self.assertNotIn("Resume:", output)


-class TestHeartbeat(unittest.TestCase):
-    """Tests for _update_heartbeat() and cmd_monitor()."""
-
-    def setUp(self):
-        self._tmp = tempfile.NamedTemporaryFile(delete=False, suffix=".heartbeat")
-        self._tmp.close()
-        self._orig = agent_loop.HEARTBEAT_FILE
-        agent_loop.HEARTBEAT_FILE = Path(self._tmp.name)
-        Path(self._tmp.name).unlink()  # Start with no heartbeat file.
-
-    def tearDown(self):
-        agent_loop.HEARTBEAT_FILE = self._orig
-        Path(self._tmp.name).unlink(missing_ok=True)
-
-    def test_update_heartbeat_writes_timestamp(self):
-        agent_loop._update_heartbeat()
-        content = Path(self._tmp.name).read_text().strip()
-        dt = datetime.fromisoformat(content)
-        age = (datetime.now(timezone.utc) - dt).total_seconds()
-        self.assertLess(age, 5)
-
-    def test_update_heartbeat_creates_file(self):
-        self.assertFalse(Path(self._tmp.name).exists())
-        agent_loop._update_heartbeat()
-        self.assertTrue(Path(self._tmp.name).exists())
-
-    def test_monitor_healthy_when_recent(self):
-        agent_loop._update_heartbeat()
-        result = agent_loop.cmd_monitor()
-        self.assertEqual(result, 0)
-
-    def test_monitor_warns_when_heartbeat_missing(self):
-        buf = io.StringIO()
-        with contextlib.redirect_stdout(buf):
-            result = agent_loop.cmd_monitor()
-        self.assertEqual(result, 1)
-        self.assertIn("WARNING", buf.getvalue())
-
-    def test_monitor_warns_when_stale(self):
-        stale = (datetime.now(timezone.utc) - timedelta(hours=3)).isoformat()
-        Path(self._tmp.name).write_text(stale)
-        buf = io.StringIO()
-        with contextlib.redirect_stdout(buf):
-            result = agent_loop.cmd_monitor()
-        self.assertEqual(result, 1)
-        self.assertIn("WARNING", buf.getvalue())
-
-    def test_monitor_warns_when_corrupted(self):
-        Path(self._tmp.name).write_text("not-a-timestamp")
-        buf = io.StringIO()
-        with contextlib.redirect_stdout(buf):
-            result = agent_loop.cmd_monitor()
-        self.assertEqual(result, 1)
-        self.assertIn("WARNING", buf.getvalue())
-
-    def test_run_loop_updates_heartbeat(self):
-        self.assertFalse(Path(self._tmp.name).exists())
-        with patch("agent_loop._read_state", return_value=None), \
-             patch("agent_loop._open_issue_prs", return_value=[]), \
-             patch("agent_loop._latest_main_ci_run", return_value=None), \
-             patch("agent_loop._ready_issues", return_value=[]):
-            agent_loop._run_loop()
-        self.assertTrue(Path(self._tmp.name).exists())
-
-
 if __name__ == "__main__":
    unittest.main()
@@ -288,8 +288,6 @@ class _FakeLogs implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool isPermanent = false,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -181,8 +181,6 @@ class FakeSyncLogRepository implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool isPermanent = false,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -14,7 +14,7 @@ void main() {
  group('Migration', () {
    test('schemaVersion matches expected value', () async {
      final db = AppDatabase(NativeDatabase.memory());
-      expect(db.schemaVersion, 33);
+      expect(db.schemaVersion, 32);
      await db.close();
    });

@@ -194,11 +194,6 @@ void main() {
      // v32: local_sieve_applied table.
      await db.customSelect('SELECT count(*) FROM local_sieve_applied').get();

-      // v33: error_stack_trace and is_permanent columns on sync_logs.
-      final syncLogColumns = await _tableColumns(db, 'sync_logs');
-      expect(syncLogColumns, contains('error_stack_trace'));
-      expect(syncLogColumns, contains('is_permanent'));
-
      await db.close();
      if (dbFile.existsSync()) dbFile.deleteSync();
    });
@@ -386,16 +381,11 @@ void main() {
          await _tableColumns(db, 'sync_log_mailboxes');
      expect(syncLogMailboxColumns, contains('duration_ms'));

-      // v33: error_stack_trace and is_permanent columns on sync_logs.
-      final syncLogColumns = await _tableColumns(db, 'sync_logs');
-      expect(syncLogColumns, contains('error_stack_trace'));
-      expect(syncLogColumns, contains('is_permanent'));
-
      await db.close();
      if (dbFile.existsSync()) dbFile.deleteSync();
    });

-    test('fresh install creates all tables at schemaVersion 33', () async {
+    test('fresh install creates all tables at schemaVersion 32', () async {
      final db = AppDatabase(NativeDatabase.memory());
      await db.select(db.accounts).get();

@@ -436,11 +426,6 @@ void main() {
          await _tableColumns(db, 'sync_log_mailboxes');
      expect(syncLogMailboxColumns, contains('duration_ms'));

-      // v33: error_stack_trace and is_permanent columns on sync_logs.
-      final syncLogColumns = await _tableColumns(db, 'sync_logs');
-      expect(syncLogColumns, contains('error_stack_trace'));
-      expect(syncLogColumns, contains('is_permanent'));
-
      await db.close();
    });
  });
@@ -170,8 +170,6 @@ class _FakeSyncLog implements SyncLogRepository {
    required String accountId,
    required bool success,
    String? errorMessage,
-    String? stackTrace,
-    bool isPermanent = false,
    required String protocol,
    required int emailsFetched,
    required int emailsSkipped,
@@ -126,34 +126,4 @@ void main() {
    expect(rows.first.result, 'error');
    expect(rows.first.errorMessage, 'Connection refused');
  });
-
-  test('stores and retrieves stackTrace and isPermanent on error entries',
-      () async {
-    final repo = SyncLogRepositoryImpl(db);
-    final start = DateTime(2024, 3, 1, 9);
-    final end = DateTime(2024, 3, 1, 9, 0, 1);
-    const fakeTrace = '#0 main (file:///app/lib/main.dart:10:5)';
-
-    await repo.log(
-      accountId: 'acc1',
-      success: false,
-      errorMessage: 'MissingPluginException',
-      stackTrace: fakeTrace,
-      isPermanent: true,
-      protocol: 'imap',
-      emailsFetched: 0,
-      emailsSkipped: 0,
-      mailboxesSynced: 0,
-      pendingFlushed: 0,
-      bytesTransferred: 0,
-      startedAt: start,
-      finishedAt: end,
-    );
-
-    final entries = await repo.observeSyncLogs('acc1').first;
-    final entry = entries.firstWhere((e) => e.startedAt == start);
-    expect(entry.stackTrace, fakeTrace);
-    expect(entry.isPermanent, true);
-    expect(entry.errorMessage, 'MissingPluginException');
-  });
 }
@@ -123,154 +123,6 @@ void main() {
    },
  );

-  testWidgets(
-    'CrashScreen shows git hash as clickable link above stacktrace',
-    (tester) async {
-      tester.view.physicalSize = const Size(800, 1200);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(() => tester.view.resetPhysicalSize());
-
-      final mock = MockUrlLauncher();
-      UrlLauncherPlatform.instance = mock;
-
-      const exception = 'TestException: git hash test';
-      final stackTrace = StackTrace.current;
-      const testHash = 'abc1234';
-
-      await tester.pumpWidget(
-        CrashScreen(
-          exception: exception,
-          stackTrace: stackTrace,
-          gitHash: testHash,
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      // Git hash link should be present
-      final gitLinkFinder = find.textContaining('Git Commit: abc1234');
-      expect(gitLinkFinder, findsOneWidget);
-
-      // Link must appear above the stack trace
-      final stackTraceFinder = find.text('Stack Trace:');
-      expect(
-        tester.getTopLeft(gitLinkFinder).dy,
-        lessThan(tester.getTopLeft(stackTraceFinder).dy),
-      );
-
-      // Tapping the link should open the Codeberg commit URL
-      await tester.tap(gitLinkFinder);
-      await tester.pumpAndSettle();
-
-      expect(
-        mock.launchedUrl,
-        equals('https://codeberg.org/guettli/sharedinbox/commit/abc1234'),
-      );
-    },
-  );
-
-  testWidgets(
-    'CrashScreen shows app version as clickable link when git hash is set',
-    (tester) async {
-      tester.view.physicalSize = const Size(800, 1200);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(() => tester.view.resetPhysicalSize());
-
-      final mock = MockUrlLauncher();
-      UrlLauncherPlatform.instance = mock;
-
-      const exception = 'TestException: version link test';
-      final stackTrace = StackTrace.current;
-      const testHash = 'abc1234';
-
-      await tester.pumpWidget(
-        CrashScreen(
-          exception: exception,
-          stackTrace: stackTrace,
-          gitHash: testHash,
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      // App version link should be present (mocked as 1.0.0+42)
-      final versionLinkFinder = find.textContaining('App Version: 1.0.0+42');
-      expect(versionLinkFinder, findsOneWidget);
-
-      // It must appear above the git hash link
-      final gitLinkFinder = find.textContaining('Git Commit: abc1234');
-      expect(
-        tester.getTopLeft(versionLinkFinder).dy,
-        lessThan(tester.getTopLeft(gitLinkFinder).dy),
-      );
-
-      // Tapping it should open the Codeberg commit URL
-      await tester.tap(versionLinkFinder);
-      await tester.pumpAndSettle();
-
-      expect(
-        mock.launchedUrl,
-        equals('https://codeberg.org/guettli/sharedinbox/commit/abc1234'),
-      );
-    },
-  );
-
-  testWidgets(
-    'CrashScreen copy-to-clipboard includes app version as markdown link when git hash is set',
-    (tester) async {
-      tester.view.physicalSize = const Size(800, 1200);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(() => tester.view.resetPhysicalSize());
-
-      String? clipboardText;
-      tester.binding.defaultBinaryMessenger.setMockMethodCallHandler(
-        SystemChannels.platform,
-        (MethodCall call) async {
-          if (call.method == 'Clipboard.setData') {
-            clipboardText =
-                (call.arguments as Map<dynamic, dynamic>)['text'] as String?;
-          }
-          return null;
-        },
-      );
-      addTearDown(
-        () => tester.binding.defaultBinaryMessenger
-            .setMockMethodCallHandler(SystemChannels.platform, null),
-      );
-
-      const exception = 'TestException: version link clipboard test';
-      final stackTrace = StackTrace.current;
-      const testHash = 'abc1234';
-
-      await tester.pumpWidget(
-        CrashScreen(
-          exception: exception,
-          stackTrace: stackTrace,
-          gitHash: testHash,
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      await tester.tap(find.text('Copy to Clipboard'));
-      await tester.pump();
-      await tester.pump();
-      await tester.pumpAndSettle();
-
-      expect(clipboardText, isNotNull);
-      // App Version must be a markdown link pointing to the commit
-      expect(
-        clipboardText,
-        contains(
-          'App Version: [1.0.0+42](https://codeberg.org/guettli/sharedinbox/commit/abc1234)',
-        ),
-      );
-      expect(
-        clipboardText,
-        contains(
-          'Git Commit: [abc1234](https://codeberg.org/guettli/sharedinbox/commit/abc1234)',
-        ),
-      );
-    },
-  );
-
  testWidgets(
    'CrashScreen used as root widget — buttons work without ScaffoldMessenger crash',
    (tester) async {
@@ -105,33 +105,6 @@ void main() {
      expect(find.text('Edit account'), findsNothing);
    });

-    testWidgets(
-        'try connection shows password required when no password stored', (
-      tester,
-    ) async {
-      tester.view.physicalSize = const Size(800, 1400);
-      tester.view.devicePixelRatio = 1.0;
-      addTearDown(tester.view.resetPhysicalSize);
-      addTearDown(tester.view.resetDevicePixelRatio);
-
-      await tester.pumpWidget(
-        buildApp(
-          initialLocation: '/accounts/acc-1/edit',
-          overrides: baseOverrides(
-            accounts: [kTestAccount],
-            hasStoredPassword: false,
-          ),
-        ),
-      );
-      await tester.pumpAndSettle();
-
-      await tester.tap(find.byKey(const Key('editTryConnectionButton')));
-      await tester.pumpAndSettle();
-
-      // App must not crash; password field shows a validation error.
-      expect(find.text('Required'), findsOneWidget);
-    });
-
    testWidgets('connection error shows error message', (tester) async {
      tester.view.physicalSize = const Size(800, 1400);
      tester.view.devicePixelRatio = 1.0;
@@ -44,12 +44,11 @@ import 'package:sharedinbox/ui/screens/thread_detail_screen.dart';
 // ---------------------------------------------------------------------------

 class FakeAccountRepository implements AccountRepository {
+  final List<Account> _accounts;
+
  FakeAccountRepository([List<Account>? accounts])
      : _accounts = List.of(accounts ?? []);

-  final List<Account> _accounts;
-  bool hasPassword = true;
-
  @override
  Stream<List<Account>> observeAccounts() => Stream.value(List.of(_accounts));

@@ -76,12 +75,7 @@ class FakeAccountRepository implements AccountRepository {
      _accounts.removeWhere((a) => a.id == id);

  @override
-  Future<String> getPassword(String accountId) async {
-    if (!hasPassword) {
-      throw StateError('No password stored for account $accountId');
-    }
-    return 'test-password';
-  }
+  Future<String> getPassword(String accountId) async => 'test-password';
 }

 class FakeShareKeyRepository implements ShareKeyRepository {
@@ -517,12 +511,10 @@ List<Override> baseOverrides({
  List<Mailbox>? mailboxes,
  DiscoveryResult? discovery,
  Exception? connectionError,
-  bool hasStoredPassword = true,
 }) =>
    [
-      accountRepositoryProvider.overrideWithValue(
-        FakeAccountRepository(accounts)..hasPassword = hasStoredPassword,
-      ),
+      accountRepositoryProvider
+          .overrideWithValue(FakeAccountRepository(accounts)),
      mailboxRepositoryProvider
          .overrideWithValue(FakeMailboxRepository(mailboxes)),
      emailRepositoryProvider.overrideWithValue(FakeEmailRepository()),