feat: auto-merge safe Renovate PRs via CI (#277)

Configure Renovate to label patch/minor/pin/digest/lockFileMaintenance
updates with 'automerge'. Add a merge-renovate job to ci.yml that runs
after the check job passes on Renovate branches and merges PRs carrying
that label; major-version PRs are left for manual review.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -109,3 +109,51 @@ jobs:
       - name: Cleanup TLS credentials
         if: always()
         run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid
+
+  merge-renovate:
+    name: Auto-merge Renovate PR
+    needs: [check]
+    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'renovate/')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Merge if automerge label is set
+        env:
+          FORGEJO_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          python3 - << 'PYEOF'
+          import os, json, urllib.request, urllib.error, sys
+
+          token = os.environ["FORGEJO_TOKEN"]
+          url_base = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
+          repo = os.environ.get("GITHUB_REPOSITORY", "")
+          pr_number = os.environ["PR_NUMBER"]
+          api = f"{url_base}/api/v1/repos/{repo}"
+          headers = {"Authorization": f"token {token}", "Content-Type": "application/json"}
+
+          req = urllib.request.Request(f"{api}/issues/{pr_number}/labels", headers=headers)
+          with urllib.request.urlopen(req) as r:
+              labels = [l["name"] for l in json.loads(r.read())]
+
+          if "automerge" not in labels:
+              print(f"PR #{pr_number}: no 'automerge' label — major update, skipping")
+              sys.exit(0)
+
+          body = json.dumps({"Do": "merge"}).encode()
+          req = urllib.request.Request(
+              f"{api}/pulls/{pr_number}/merge",
+              data=body, headers=headers, method="POST"
+          )
+          try:
+              with urllib.request.urlopen(req) as r:
+                  print(f"PR #{pr_number} merged successfully")
+          except urllib.error.HTTPError as e:
+              err = e.read().decode()
+              if "already been merged" in err or "has been merged" in err:
+                  print(f"PR #{pr_number} already merged — OK")
+              else:
+                  print(f"Merge failed: {err}")
+                  sys.exit(1)
+          PYEOF

.forgejo/workflows/deploy.yml

@@ -22,6 +22,8 @@ jobs:
       - name: Detect Android and Linux changes
         id: diff
         shell: bash
+        env:
+          FORGEJO_TOKEN: ${{ github.token }}
         run: |
           # On workflow_dispatch always build everything
           if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
@@ -30,6 +32,38 @@ jobs:
             exit 0
           fi
 
+          HEAD_SHA=$(git rev-parse HEAD)
+
+          # Skip if this exact commit was already successfully deployed (prevents
+          # hourly schedule from redeploying the same commit on every tick).
+          LAST_DEPLOYED_SHA=$(python3 - << 'PYEOF'
+          import json, os, sys, urllib.request
+          token = os.environ.get("FORGEJO_TOKEN", "")
+          server = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
+          repo = os.environ.get("GITHUB_REPOSITORY", "")
+          url = f"{server}/api/v1/repos/{repo}/actions/runs?workflow_id=deploy.yml&status=success&limit=5"
+          req = urllib.request.Request(url, headers={"Authorization": f"token {token}"})
+          try:
+              with urllib.request.urlopen(req) as r:
+                  data = json.loads(r.read())
+              runs = [
+                  r for r in data.get("workflow_runs", [])
+                  if r.get("workflow_id") == "deploy.yml" and r.get("status") == "success"
+              ]
+              print(runs[0].get("commit_sha") or "")
+          except Exception as e:
+              print(f"API check failed: {e}", file=sys.stderr)
+              print("")
+          PYEOF
+          )
+
+          if [ -n "$LAST_DEPLOYED_SHA" ] && [ "$HEAD_SHA" = "$LAST_DEPLOYED_SHA" ]; then
+            echo "HEAD $HEAD_SHA already successfully deployed — skipping"
+            echo "android=false" >> "$GITHUB_OUTPUT"
+            echo "linux=false"   >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           # Diff the HEAD commit against its parent; fall back to listing HEAD's files
           # when the parent is unavailable (initial commit, shallow clone).
           CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null \
@@ -49,44 +83,6 @@ jobs:
             && echo "linux=true"   >> "$GITHUB_OUTPUT" \
             || echo "linux=false"  >> "$GITHUB_OUTPUT"
 
-  test-android-firebase:
-    name: Android Instrumented Tests (Firebase Test Lab)
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    needs: [check-changes]
-    if: needs.check-changes.outputs.android == 'true'
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Check runner tools
-        run: |
-          command -v dagger  >/dev/null 2>&1 || { echo "ERROR: dagger is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          command -v task    >/dev/null 2>&1 || { echo "ERROR: task is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
-          dpkg -s stunnel4 netcat-openbsd >/dev/null 2>&1 || { echo "ERROR: stunnel4/netcat-openbsd are not installed in the runner image. Add them to .forgejo/Dockerfile."; exit 1; }
-
-      - name: Setup Dagger Remote Engine (via stunnel)
-        env:
-          DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}
-          DAGGER_CA_CERT: ${{ secrets.DAGGER_CA_CERT }}
-          DAGGER_CLIENT_CERT: ${{ secrets.DAGGER_CLIENT_CERT }}
-          DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
-        run: scripts/setup_dagger_remote.sh
-
-      - name: Run Android Tests on Firebase Test Lab
-        if: ${{ secrets.FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY != '' }}
-        env:
-          FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY: ${{ secrets.FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY }}
-          FIREBASE_PROJECT_ID: ${{ vars.FIREBASE_PROJECT_ID }}
-          DAGGER_NO_NAG: "1"
-        run: task test-android-firebase
-
-      - name: Cleanup TLS credentials
-        if: always()
-        run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid
-
   deploy-playstore:
     name: Build & Deploy to Play Store
     runs-on: ubuntu-latest
@@ -253,10 +249,9 @@ jobs:
   label-deploy-health:
     name: Update Deploy Health Label
     runs-on: ubuntu-latest
-    needs: [test-android-firebase, deploy-playstore, deploy-apk, build-linux]
+    needs: [deploy-playstore, deploy-apk, build-linux]
     if: |
       always() && vars.DEPLOY_HEALTH_ISSUE != '' && (
-        needs.test-android-firebase.result == 'success' || needs.test-android-firebase.result == 'failure' ||
         needs.deploy-playstore.result == 'success' || needs.deploy-playstore.result == 'failure' ||
         needs.deploy-apk.result == 'success' || needs.deploy-apk.result == 'failure' ||
         needs.build-linux.result == 'success' || needs.build-linux.result == 'failure'
@@ -269,7 +264,7 @@ jobs:
           FORGEJO_TOKEN: ${{ github.token }}
           FORGEJO_URL: ${{ github.server_url }}
           DEPLOY_HEALTH_ISSUE: ${{ vars.DEPLOY_HEALTH_ISSUE }}
-          ALL_SUCCEEDED: ${{ (needs.test-android-firebase.result == 'success' || needs.test-android-firebase.result == 'skipped') && (needs.deploy-playstore.result == 'success' || needs.deploy-playstore.result == 'skipped') && (needs.deploy-apk.result == 'success' || needs.deploy-apk.result == 'skipped') && (needs.build-linux.result == 'success' || needs.build-linux.result == 'skipped') }}
+          ALL_SUCCEEDED: ${{ (needs.deploy-playstore.result == 'success' || needs.deploy-playstore.result == 'skipped') && (needs.deploy-apk.result == 'success' || needs.deploy-apk.result == 'skipped') && (needs.build-linux.result == 'success' || needs.build-linux.result == 'skipped') }}
         run: |
           python3 - << 'PYEOF'
           import os, json, urllib.request, urllib.error

.forgejo/workflows/firebase-tests.yml

@@ -0,0 +1,132 @@
+name: Firebase Tests
+
+on:
+  schedule:
+    - cron: '0 3 * * *'   # once per day at 3 AM
+  workflow_dispatch:
+
+jobs:
+  check-changes:
+    name: Detect Firebase-Relevant Changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      has_changes: ${{ steps.diff.outputs.has_changes }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect Firebase-relevant changes in last 24 hours
+        id: diff
+        shell: bash
+        run: |
+          # On workflow_dispatch always run
+          if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          SINCE=$(date -u -d '24 hours ago' '+%Y-%m-%dT%H:%M:%S')
+          CHANGED=$(git log --since="$SINCE" --name-only --format= -- \
+            'android/' 'integration_test/' 'lib/' 'pubspec.yaml' 'pubspec.lock' 'drift_schemas/' \
+            | sort -u | grep -v '^$')
+
+          if [ -n "$CHANGED" ]; then
+            echo "Firebase-relevant files changed since $SINCE:"
+            echo "$CHANGED"
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No Firebase-relevant changes in the last 24 hours — skipping tests"
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  test-android-firebase:
+    name: Android Instrumented Tests (Firebase Test Lab)
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    needs: [check-changes]
+    if: needs.check-changes.outputs.has_changes == 'true'
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Check runner tools
+        run: |
+          command -v dagger  >/dev/null 2>&1 || { echo "ERROR: dagger is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
+          command -v task    >/dev/null 2>&1 || { echo "ERROR: task is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
+          dpkg -s stunnel4 netcat-openbsd >/dev/null 2>&1 || { echo "ERROR: stunnel4/netcat-openbsd are not installed in the runner image. Add them to .forgejo/Dockerfile."; exit 1; }
+
+      - name: Setup Dagger Remote Engine (via stunnel)
+        env:
+          DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}
+          DAGGER_CA_CERT: ${{ secrets.DAGGER_CA_CERT }}
+          DAGGER_CLIENT_CERT: ${{ secrets.DAGGER_CLIENT_CERT }}
+          DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
+        run: scripts/setup_dagger_remote.sh
+
+      - name: Run Android Tests on Firebase Test Lab
+        if: ${{ secrets.FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY != '' }}
+        env:
+          FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY: ${{ secrets.FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY }}
+          FIREBASE_PROJECT_ID: ${{ vars.FIREBASE_PROJECT_ID }}
+          DAGGER_NO_NAG: "1"
+        run: task test-android-firebase
+
+      - name: Cleanup TLS credentials
+        if: always()
+        run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid
+
+      - name: Create issue on test failure
+        if: failure()
+        env:
+          FORGEJO_TOKEN: ${{ github.token }}
+          FORGEJO_URL: ${{ github.server_url }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          python3 - << 'PYEOF'
+          import os, json, urllib.request, urllib.error
+
+          token = os.environ["FORGEJO_TOKEN"]
+          url_base = os.environ["FORGEJO_URL"].rstrip("/")
+          run_url = os.environ["RUN_URL"]
+
+          headers = {"Authorization": f"token {token}", "Content-Type": "application/json"}
+          api = f"{url_base}/api/v1/repos/guettli/sharedinbox"
+
+          def api_get(path):
+              req = urllib.request.Request(f"{api}{path}", headers=headers)
+              with urllib.request.urlopen(req) as r:
+                  return json.loads(r.read())
+
+          def api_post(path, body):
+              data = json.dumps(body).encode()
+              req = urllib.request.Request(f"{api}{path}", data=data, headers=headers, method="POST")
+              with urllib.request.urlopen(req) as r:
+                  return json.loads(r.read())
+
+          repo_labels = api_get("/labels")
+          label_map = {l["name"]: l["id"] for l in repo_labels}
+
+          label_ids = [label_map["Ready"]] if "Ready" in label_map else []
+
+          title = "Firebase Tests failed — find root cause and fix"
+          body = (
+              "Firebase instrumented tests failed in the daily run.\n\n"
+              f"**Failed run:** {run_url}\n\n"
+              "## Steps to resolve\n\n"
+              "1. **Find the root cause**: Check the test run logs linked above and identify which test(s) failed and why.\n"
+              "2. **Fix if possible**: If the failure is caused by a code bug, create a fix. If it is a flaky or infrastructure issue, document the findings.\n"
+              "3. Close this issue once the root cause is resolved and the tests pass.\n"
+          )
+
+          issue = api_post("/issues", {
+              "title": title,
+              "body": body,
+              "labels": label_ids,
+          })
+          print(f"Created issue #{issue['number']}: {issue['html_url']}")
+          PYEOF

.forgejo/workflows/renovate.yml

@@ -14,6 +14,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Check runner tools
+        run: |
+          command -v dagger  >/dev/null 2>&1 || { echo "ERROR: dagger is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
+          command -v task    >/dev/null 2>&1 || { echo "ERROR: task is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
+          dpkg -s stunnel4 netcat-openbsd >/dev/null 2>&1 || { echo "ERROR: stunnel4/netcat-openbsd are not installed in the runner image. Add them to .forgejo/Dockerfile."; exit 1; }
+
       - name: Setup Dagger Remote Engine (via stunnel)
         env:
           DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}

.forgejo/workflows/website.yml

@@ -13,20 +13,42 @@ jobs:
   deploy:
     name: Build & Deploy Website
     runs-on: ubuntu-latest
+    timeout-minutes: 60
 
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
 
+      - name: Check runner tools
+        run: |
+          command -v dagger  >/dev/null 2>&1 || { echo "ERROR: dagger is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
+          command -v task    >/dev/null 2>&1 || { echo "ERROR: task is not installed in the runner image. Add it to .forgejo/Dockerfile."; exit 1; }
+          dpkg -s stunnel4 netcat-openbsd >/dev/null 2>&1 || { echo "ERROR: stunnel4/netcat-openbsd are not installed in the runner image. Add them to .forgejo/Dockerfile."; exit 1; }
+
+      - name: Setup Dagger Remote Engine (via stunnel)
+        env:
+          DAGGER_STUNNEL_URL: ${{ secrets.DAGGER_STUNNEL_URL }}
+          DAGGER_CA_CERT: ${{ secrets.DAGGER_CA_CERT }}
+          DAGGER_CLIENT_CERT: ${{ secrets.DAGGER_CLIENT_CERT }}
+          DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
+        run: scripts/setup_dagger_remote.sh
+
       - name: Build & Deploy Website
+        if: ${{ secrets.SSH_PRIVATE_KEY != '' }}
         env:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
           SSH_USER: ${{ secrets.SSH_USER }}
           SSH_HOST: ${{ secrets.SSH_HOST }}
-        run: task website-deploy
+          DAGGER_NO_NAG: "1"
+        run: task publish-website
 
       - name: Verify Website
         env:
           SSH_HOST: ${{ secrets.WEBSITE_SSH_HOST }}
         run: scripts/website-verify.sh
+
+      - name: Cleanup TLS credentials
+        if: always()
+        run: rm -rf /tmp/dagger-tls /tmp/stunnel-dagger.conf /tmp/stunnel.pid

.pre-commit-config.yaml

@@ -33,12 +33,12 @@ repos:
       - id: ci-no-direct-dagger
         name: check for direct dagger calls in workflows (use Task instead)
         language: system
-        entry: "bash -c 'git grep \"dagger call\" .forgejo/workflows/ && echo \"ERROR: Direct dagger calls found in workflows. Use Taskfile instead.\" && exit 1 || exit 0'"
+        entry: "bash -c 'git --no-pager grep \"dagger call\" .forgejo/workflows/ && echo \"ERROR: Direct dagger calls found in workflows. Use Taskfile instead.\" && exit 1 || exit 0'"
         pass_filenames: false
         always_run: true
       - id: dagger-progress-plain
         name: ensure all dagger calls use --progress=plain
         language: system
-        entry: "bash -c 'git grep \"dagger call\" -- \":!.pre-commit-config.yaml\" | grep -v \"\\-\\-progress=plain\" && echo \"ERROR: All dagger calls must include --progress=plain\" && exit 1 || exit 0'"
+        entry: "bash -c 'git --no-pager grep \"dagger call\" -- \":!.pre-commit-config.yaml\" | grep -v \"\\-\\-progress=plain\" && echo \"ERROR: All dagger calls must include --progress=plain\" && exit 1 || exit 0'"
         pass_filenames: false
         always_run: true

ci/main.go

@@ -844,12 +844,24 @@ func (m *Ci) PublishAndroid(
 
 // Renovate runs Renovate bot against the repository on Forgejo/Codeberg.
 func (m *Ci) Renovate(ctx context.Context, renovateToken *dagger.Secret) (string, error) {
+	// Codeberg's GET /pulls?state=all&limit=100 times out with a 504, but limit=10
+	// completes in ~9 s. Patch the compiled pr-cache.js to use 10 instead of the
+	// hardcoded 20/100 values before launching renovate.
+	const patchCmd = `for f in \
+			/usr/local/renovate/dist/modules/platform/forgejo/pr-cache.js \
+			/usr/local/renovate/dist/modules/platform/gitea/pr-cache.js; do \
+		sed -i 's/limit: this\.items\.length ? 20 : 100/limit: this.items.length ? 10 : 10/' "$f" && echo "patched $f"; \
+		done`
 	return dag.Container().
-		From("renovate/renovate:39").
+		From("renovate/renovate:43").
 		WithSecretVariable("RENOVATE_TOKEN", renovateToken).
 		WithEnvVariable("RENOVATE_PLATFORM", "forgejo").
 		WithEnvVariable("RENOVATE_ENDPOINT", "https://codeberg.org").
 		WithEnvVariable("RENOVATE_REPOSITORIES", "guettli/sharedinbox").
+		WithEnvVariable("LOG_LEVEL", "info").
+		WithUser("root").
+		WithExec([]string{"/bin/sh", "-c", patchCmd}).
+		WithUser("ubuntu").
 		WithExec([]string{"renovate"}).
 		Stdout(ctx)
 }

done.md

@@ -4,6 +4,16 @@ This file contains tasks which got implemented.
 
 Tasks get moved from next.md to done.md
 
+## Tasks (2026-05-26)
+
+- **Renovate Bot (Issue #257)**: Renovate Bot runs daily via Forgejo Actions to keep
+  dependencies up to date. All required components are in main:
+  - `renovate.json` — Renovate configuration covering pub, Dockerfile, and Forgejo Actions
+  - `ci/main.go` — `Renovate()` Dagger function using Forgejo platform and Codeberg endpoint
+  - `.forgejo/workflows/renovate.yml` — daily cron (06:00 UTC) workflow
+  - `Taskfile.yml` — `renovate` task
+  - Issue #257 closed.
+
 ## Tasks (2026-05-11)
 
 - **Stabilize Email List UI during Selection (Issue #14)**: Prevented layout shifts when entering

lib/core/db_schema_version.dart

@@ -1 +1 @@
-const int dbSchemaVersion = 32;
+const int dbSchemaVersion = 33;

lib/core/repositories/sync_log_repository.dart

@@ -19,6 +19,8 @@ class SyncLogEntry {
     required this.id,
     required this.result,
     this.errorMessage,
+    this.stackTrace,
+    this.isPermanent = false,
     required this.protocol,
     required this.emailsFetched,
     required this.emailsSkipped,
@@ -34,6 +36,8 @@ class SyncLogEntry {
   final int id;
   final String result; // 'ok' or 'error'
   final String? errorMessage;
+  final String? stackTrace;
+  final bool isPermanent;
   final String protocol; // 'imap' or 'jmap'
   final int emailsFetched;
   final int emailsSkipped;
@@ -54,6 +58,8 @@ abstract class SyncLogRepository {
     required String accountId,
     required bool success,
     String? errorMessage,
+    String? stackTrace,
+    bool isPermanent = false,
     required String protocol,
     required int emailsFetched,
     required int emailsSkipped,
@@ -81,6 +87,8 @@ class NoOpSyncLogRepository implements SyncLogRepository {
     required String accountId,
     required bool success,
     String? errorMessage,
+    String? stackTrace,
+    bool isPermanent = false,
     required String protocol,
     required int emailsFetched,
     required int emailsSkipped,

lib/core/sync/account_sync_manager.dart

@@ -260,6 +260,8 @@ class _AccountSync implements _SyncLoop {
             accountId: account.id,
             success: false,
             errorMessage: e.toString(),
+            stackTrace: st.toString(),
+            isPermanent: isPermanent,
             protocol: 'imap',
             emailsFetched: 0,
             emailsSkipped: 0,
@@ -513,6 +515,8 @@ class _JmapAccountSync implements _SyncLoop {
             accountId: account.id,
             success: false,
             errorMessage: e.toString(),
+            stackTrace: st.toString(),
+            isPermanent: isPermanent,
             protocol: 'jmap',
             emailsFetched: 0,
             emailsSkipped: 0,

lib/data/db/database.dart

@@ -193,6 +193,9 @@ class SyncLogs extends Table {
   DateTimeColumn get finishedAt => dateTime()();
   // Added in schema v13: raw protocol log when account.verbose == true.
   TextColumn get protocolLog => text().nullable()();
+  // Added in schema v33: stack trace and permanent flag for error entries.
+  TextColumn get errorStackTrace => text().nullable()();
+  BoolColumn get isPermanent => boolean().withDefault(const Constant(false))();
 }
 
 /// Per-mailbox breakdown for a single sync cycle.
@@ -571,6 +574,10 @@ class AppDatabase extends _$AppDatabase {
           if (from < 32) {
             await m.createTable(localSieveApplied);
           }
+          if (from >= 7 && from < 33) {
+            await m.addColumn(syncLogs, syncLogs.errorStackTrace);
+            await m.addColumn(syncLogs, syncLogs.isPermanent);
+          }
         },
       );
 }

lib/data/repositories/sync_log_repository_impl.dart

@@ -13,6 +13,8 @@ class SyncLogRepositoryImpl implements SyncLogRepository {
     required String accountId,
     required bool success,
     String? errorMessage,
+    String? stackTrace,
+    bool isPermanent = false,
     required String protocol,
     required int emailsFetched,
     required int emailsSkipped,
@@ -30,6 +32,8 @@ class SyncLogRepositoryImpl implements SyncLogRepository {
               accountId: accountId,
               result: success ? 'ok' : 'error',
               errorMessage: Value(errorMessage),
+              errorStackTrace: Value(stackTrace),
+              isPermanent: Value(isPermanent),
               protocol: Value(protocol),
               itemsSynced: Value(emailsFetched),
               emailsSkipped: Value(emailsSkipped),
@@ -75,6 +79,8 @@ class SyncLogRepositoryImpl implements SyncLogRepository {
             id: r.id,
             result: r.result,
             errorMessage: r.errorMessage,
+            stackTrace: r.errorStackTrace,
+            isPermanent: r.isPermanent,
             protocol: r.protocol,
             emailsFetched: r.itemsSynced,
             emailsSkipped: r.emailsSkipped,

lib/ui/screens/about_screen.dart

@@ -1,15 +1,13 @@
 import 'dart:async';
-import 'dart:io';
 
-import 'package:device_info_plus/device_info_plus.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_markdown_plus/flutter_markdown_plus.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:package_info_plus/package_info_plus.dart';
-import 'package:sharedinbox/core/db_schema_version.dart';
 import 'package:sharedinbox/core/models/account.dart';
 import 'package:sharedinbox/di.dart';
+import 'package:sharedinbox/ui/utils/about_markdown.dart';
 import 'package:url_launcher/url_launcher.dart';
 
 class AboutScreen extends ConsumerStatefulWidget {
@@ -25,13 +23,11 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
   late final Stream<List<Account>> _accountsStream;
   String? _deviceModel;
 
-  static const _gitHash = String.fromEnvironment('GIT_HASH');
-
   @override
   void initState() {
     super.initState();
     _accountsStream = ref.read(accountRepositoryProvider).observeAccounts();
-    _deviceModelFuture = _fetchDeviceModel();
+    _deviceModelFuture = getDeviceModel();
     unawaited(
       _deviceModelFuture.then((model) {
         if (mounted) setState(() => _deviceModel = model);
@@ -39,71 +35,6 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
     );
   }
 
-  static Future<String?> _fetchDeviceModel() async {
-    try {
-      final info = DeviceInfoPlugin();
-      if (Platform.isAndroid) {
-        final android = await info.androidInfo;
-        return '${android.manufacturer} / ${android.model}';
-      } else if (Platform.isIOS) {
-        final ios = await info.iosInfo;
-        return ios.utsname.machine;
-      }
-    } catch (_) {}
-    return null;
-  }
-
-  String _buildMarkdown(
-    BuildContext context,
-    PackageInfo? pkg,
-    int imapCount,
-    int jmapCount, {
-    String? deviceModel,
-  }) {
-    final size = MediaQuery.of(context).size;
-    final pixelRatio = MediaQuery.of(context).devicePixelRatio;
-    final physW = (size.width * pixelRatio).toInt();
-    final physH = (size.height * pixelRatio).toInt();
-    final version =
-        pkg != null ? '${pkg.version}+${pkg.buildNumber}' : 'unknown';
-    final versionDisplay = _gitHash.isNotEmpty
-        ? '[$version](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash)'
-        : version;
-    final osName = _capitalize(Platform.operatingSystem);
-    final isDark = MediaQuery.of(context).platformBrightness == Brightness.dark;
-    final locale = Localizations.localeOf(context).toString();
-    final textScale =
-        MediaQuery.of(context).textScaler.scale(1.0).toStringAsFixed(1);
-
-    final gitCommitLine = _gitHash.isNotEmpty
-        ? '| Git Commit | [$_gitHash](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash) |\n'
-        : '';
-    final deviceModelLine =
-        deviceModel != null ? '| Device Model | $deviceModel |\n' : '';
-    return '## [sharedinbox.de](https://sharedinbox.de)\n\n'
-        '| Property | Value |\n'
-        '|----------|-------|\n'
-        '| App Version | $versionDisplay |\n'
-        '$gitCommitLine'
-        '| Platform | ${Platform.operatingSystem} |\n'
-        '| $osName Version | ${Platform.operatingSystemVersion} |\n'
-        '$deviceModelLine'
-        '| Resolution | ${physW}x$physH px'
-        ' (logical: ${size.width.toInt()}x${size.height.toInt()} pt,'
-        ' ratio: ${pixelRatio.toStringAsFixed(1)}x) |\n'
-        '| Dart Version | ${Platform.version.split(' ').first} |\n'
-        '| Processors | ${Platform.numberOfProcessors} |\n'
-        '| Dark Mode | ${isDark ? 'yes' : 'no'} |\n'
-        '| Locale | $locale |\n'
-        '| Text Scale | $textScale× |\n'
-        '| DB Schema Version | $dbSchemaVersion |\n'
-        '| IMAP Accounts | $imapCount |\n'
-        '| JMAP Accounts | $jmapCount |\n';
-  }
-
-  static String _capitalize(String s) =>
-      s.isEmpty ? s : '${s[0].toUpperCase()}${s.substring(1)}';
-
   Future<void> _copyToClipboard(
     BuildContext context,
     int imapCount,
@@ -120,11 +51,11 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
     if (!context.mounted) return;
     await Clipboard.setData(
       ClipboardData(
-        text: _buildMarkdown(
-          context,
-          pkg,
-          imapCount,
-          jmapCount,
+        text: buildAboutMarkdown(
+          context: context,
+          pkg: pkg,
+          imapCount: imapCount,
+          jmapCount: jmapCount,
           deviceModel: deviceModel,
         ),
       ),
@@ -178,11 +109,11 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
     } catch (_) {}
     if (!context.mounted) return;
     final body = Uri.encodeComponent(
-      _buildMarkdown(
-        context,
-        pkg,
-        imapCount,
-        jmapCount,
+      buildAboutMarkdown(
+        context: context,
+        pkg: pkg,
+        imapCount: imapCount,
+        jmapCount: jmapCount,
         deviceModel: deviceModel,
       ),
     );
@@ -235,11 +166,11 @@ class _AboutScreenState extends ConsumerState<AboutScreen> {
                       return const Center(child: CircularProgressIndicator());
                     }
                     return Markdown(
-                      data: _buildMarkdown(
-                        context,
-                        snapshot.data,
-                        imapCount,
-                        jmapCount,
+                      data: buildAboutMarkdown(
+                        context: context,
+                        pkg: snapshot.data,
+                        imapCount: imapCount,
+                        jmapCount: jmapCount,
                         deviceModel: _deviceModel,
                       ),
                       selectable: true,

lib/ui/screens/sync_log_screen.dart

@@ -1,11 +1,15 @@
 import 'dart:async';
 
 import 'package:flutter/material.dart';
+import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:intl/intl.dart';
+import 'package:package_info_plus/package_info_plus.dart';
 
+import 'package:sharedinbox/core/models/account.dart';
 import 'package:sharedinbox/core/repositories/sync_log_repository.dart';
 import 'package:sharedinbox/di.dart';
+import 'package:sharedinbox/ui/utils/about_markdown.dart';
 
 final _timeFmt = DateFormat('MMM d, HH:mm:ss');
 
@@ -21,6 +25,57 @@ String _fmtBytes(int bytes) {
   return '${(bytes / (1024 * 1024)).toStringAsFixed(1)} MB';
 }
 
+String _buildSyncEntryMarkdown(SyncLogEntry entry) {
+  final buf = StringBuffer();
+  buf.writeln('## Sync Entry');
+  buf.writeln();
+  buf.writeln('| Property | Value |');
+  buf.writeln('|----------|-------|');
+  buf.writeln('| Started | ${_timeFmt.format(entry.startedAt)} |');
+  buf.writeln('| Finished | ${_timeFmt.format(entry.finishedAt)} |');
+  buf.writeln('| Duration | ${_fmtDuration(entry.duration)} |');
+  if (entry.protocol.isNotEmpty) {
+    buf.writeln('| Protocol | ${entry.protocol.toUpperCase()} |');
+  }
+  final statusLabel = entry.isOk
+      ? 'OK'
+      : entry.isPermanent
+          ? 'Error (permanent)'
+          : 'Error';
+  buf.writeln('| Status | $statusLabel |');
+  buf.writeln('| Emails fetched | ${entry.emailsFetched} |');
+  buf.writeln('| Emails up-to-date | ${entry.emailsSkipped} |');
+  buf.writeln('| Mailboxes synced | ${entry.mailboxesSynced} |');
+  buf.writeln('| Pending changes flushed | ${entry.pendingFlushed} |');
+  buf.writeln('| Data transferred | ${_fmtBytes(entry.bytesTransferred)} |');
+  if (entry.mailboxStats.isNotEmpty) {
+    buf.writeln();
+    buf.writeln('### Per mailbox');
+    buf.writeln();
+    buf.writeln('| Mailbox | Fetched | Up-to-date | Duration |');
+    buf.writeln('|---------|---------|------------|----------|');
+    for (final m in entry.mailboxStats) {
+      final dur = m.duration != null ? _fmtDuration(m.duration!) : '-';
+      buf.writeln('| ${m.mailboxPath} | ${m.fetched} | ${m.skipped} | $dur |');
+    }
+  }
+  if (entry.errorMessage != null) {
+    buf.writeln();
+    buf.writeln('**Error:**');
+    buf.writeln();
+    buf.writeln(entry.errorMessage);
+  }
+  if (entry.stackTrace != null) {
+    buf.writeln();
+    buf.writeln('**Stack trace:**');
+    buf.writeln();
+    buf.writeln('```');
+    buf.write(entry.stackTrace);
+    buf.writeln('```');
+  }
+  return buf.toString();
+}
+
 class SyncLogScreen extends ConsumerStatefulWidget {
   const SyncLogScreen({super.key, required this.accountId});
 
@@ -69,6 +124,41 @@ class _SyncLogScreenState extends ConsumerState<SyncLogScreen> {
     ref.read(syncManagerProvider).syncNow(widget.accountId);
   }
 
+  Future<void> _copyEntry(SyncLogEntry entry, BuildContext context) async {
+    final accounts =
+        await ref.read(accountRepositoryProvider).observeAccounts().first;
+    final imapCount = accounts.where((a) => a.type == AccountType.imap).length;
+    final jmapCount = accounts.where((a) => a.type == AccountType.jmap).length;
+
+    PackageInfo? pkg;
+    try {
+      pkg = await PackageInfo.fromPlatform();
+    } catch (_) {}
+
+    final deviceModel = await getDeviceModel();
+
+    if (!context.mounted) return;
+
+    final syncMd = _buildSyncEntryMarkdown(entry);
+    final aboutMd = buildAboutMarkdown(
+      context: context,
+      pkg: pkg,
+      imapCount: imapCount,
+      jmapCount: jmapCount,
+      deviceModel: deviceModel,
+    );
+    await Clipboard.setData(ClipboardData(text: '$syncMd\n$aboutMd'));
+
+    if (context.mounted) {
+      ScaffoldMessenger.of(context).showSnackBar(
+        const SnackBar(
+          duration: Duration(seconds: 3),
+          content: Text('Copied to clipboard'),
+        ),
+      );
+    }
+  }
+
   @override
   Widget build(BuildContext context) {
     return Scaffold(
@@ -96,16 +186,20 @@ class _SyncLogScreenState extends ConsumerState<SyncLogScreen> {
           ? const Center(child: Text('No sync entries yet'))
           : ListView.builder(
               itemCount: _entries.length,
-              itemBuilder: (ctx, i) => _SyncLogTile(entry: _entries[i]),
+              itemBuilder: (ctx, i) => _SyncLogTile(
+                entry: _entries[i],
+                onCopy: () => _copyEntry(_entries[i], ctx),
+              ),
             ),
     );
   }
 }
 
 class _SyncLogTile extends StatelessWidget {
-  const _SyncLogTile({required this.entry});
+  const _SyncLogTile({required this.entry, required this.onCopy});
 
   final SyncLogEntry entry;
+  final VoidCallback onCopy;
 
   @override
   Widget build(BuildContext context) {
@@ -115,6 +209,12 @@ class _SyncLogTile extends StatelessWidget {
     final theme = Theme.of(context);
     final errorColor = theme.colorScheme.error;
 
+    final subtitleText = entry.isOk
+        ? '${entry.emailsFetched} new · ${entry.emailsSkipped} up-to-date · took $durationLabel'
+        : entry.isPermanent
+            ? 'Error (permanent) · took $durationLabel'
+            : 'Error · took $durationLabel';
+
     return ExpansionTile(
       leading: Icon(
         entry.isOk ? Icons.check_circle : Icons.error_outline,
@@ -125,11 +225,20 @@ class _SyncLogTile extends StatelessWidget {
         style: entry.isOk ? null : TextStyle(color: errorColor),
       ),
       subtitle: Text(
-        entry.isOk
-            ? '${entry.emailsFetched} new · ${entry.emailsSkipped} up-to-date · took $durationLabel'
-            : 'Error · took $durationLabel',
+        subtitleText,
         style: TextStyle(fontSize: 12, color: entry.isOk ? null : errorColor),
       ),
+      trailing: Row(
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          IconButton(
+            icon: const Icon(Icons.copy, size: 18),
+            tooltip: 'Copy as markdown',
+            onPressed: onCopy,
+          ),
+          const Icon(Icons.expand_more),
+        ],
+      ),
       children: [
         Padding(
           padding: const EdgeInsets.fromLTRB(72, 0, 16, 12),
@@ -171,6 +280,31 @@ class _SyncLogTile extends StatelessWidget {
                     style: TextStyle(color: errorColor, fontSize: 12),
                   ),
                 ),
+              if (entry.stackTrace != null) ...[
+                const Padding(
+                  padding: EdgeInsets.only(top: 6, bottom: 2),
+                  child: Text(
+                    'Stack trace',
+                    style: TextStyle(fontSize: 12, color: Colors.grey),
+                  ),
+                ),
+                Container(
+                  width: double.infinity,
+                  padding: const EdgeInsets.all(8),
+                  decoration: BoxDecoration(
+                    color: Colors.black87,
+                    borderRadius: BorderRadius.circular(4),
+                  ),
+                  child: Text(
+                    entry.stackTrace!,
+                    style: TextStyle(
+                      fontSize: 10,
+                      fontFamily: 'monospace',
+                      color: Colors.red[300],
+                    ),
+                  ),
+                ),
+              ],
               if (entry.protocolLog != null) ...[
                 const Padding(
                   padding: EdgeInsets.only(top: 6, bottom: 2),

lib/ui/utils/about_markdown.dart

@@ -0,0 +1,75 @@
+import 'dart:io';
+
+import 'package:device_info_plus/device_info_plus.dart';
+import 'package:flutter/material.dart';
+import 'package:package_info_plus/package_info_plus.dart';
+import 'package:sharedinbox/core/db_schema_version.dart';
+
+const _gitHash = String.fromEnvironment('GIT_HASH');
+
+/// Builds the About markdown table used in [AboutScreen] and sync log copies.
+String buildAboutMarkdown({
+  required BuildContext context,
+  PackageInfo? pkg,
+  required int imapCount,
+  required int jmapCount,
+  String? deviceModel,
+}) {
+  final size = MediaQuery.of(context).size;
+  final pixelRatio = MediaQuery.of(context).devicePixelRatio;
+  final physW = (size.width * pixelRatio).toInt();
+  final physH = (size.height * pixelRatio).toInt();
+  final version = pkg != null ? '${pkg.version}+${pkg.buildNumber}' : 'unknown';
+  final versionDisplay = _gitHash.isNotEmpty
+      ? '[$version](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash)'
+      : version;
+  final osName = _capitalize(Platform.operatingSystem);
+  final isDark = MediaQuery.of(context).platformBrightness == Brightness.dark;
+  final locale = Localizations.localeOf(context).toString();
+  final textScale =
+      MediaQuery.of(context).textScaler.scale(1.0).toStringAsFixed(1);
+
+  final gitCommitLine = _gitHash.isNotEmpty
+      ? '| Git Commit | [$_gitHash](https://codeberg.org/guettli/sharedinbox/commit/$_gitHash) |\n'
+      : '';
+  final deviceModelLine =
+      deviceModel != null ? '| Device Model | $deviceModel |\n' : '';
+
+  return '## [sharedinbox.de](https://sharedinbox.de)\n\n'
+      '| Property | Value |\n'
+      '|----------|-------|\n'
+      '| App Version | $versionDisplay |\n'
+      '$gitCommitLine'
+      '| Platform | ${Platform.operatingSystem} |\n'
+      '| $osName Version | ${Platform.operatingSystemVersion} |\n'
+      '$deviceModelLine'
+      '| Resolution | ${physW}x$physH px'
+      ' (logical: ${size.width.toInt()}x${size.height.toInt()} pt,'
+      ' ratio: ${pixelRatio.toStringAsFixed(1)}x) |\n'
+      '| Dart Version | ${Platform.version.split(' ').first} |\n'
+      '| Processors | ${Platform.numberOfProcessors} |\n'
+      '| Dark Mode | ${isDark ? 'yes' : 'no'} |\n'
+      '| Locale | $locale |\n'
+      '| Text Scale | $textScale× |\n'
+      '| DB Schema Version | $dbSchemaVersion |\n'
+      '| IMAP Accounts | $imapCount |\n'
+      '| JMAP Accounts | $jmapCount |\n';
+}
+
+/// Fetches device model string, or null when unavailable.
+Future<String?> getDeviceModel() async {
+  try {
+    final info = DeviceInfoPlugin();
+    if (Platform.isAndroid) {
+      final android = await info.androidInfo;
+      return '${android.manufacturer} / ${android.model}';
+    } else if (Platform.isIOS) {
+      final ios = await info.iosInfo;
+      return ios.utsname.machine;
+    }
+  } catch (_) {}
+  return null;
+}
+
+String _capitalize(String s) =>
+    s.isEmpty ? s : '${s[0].toUpperCase()}${s.substring(1)}';

renovate.json

@@ -6,5 +6,11 @@
   "labels": ["dependencies"],
   "github-actions": {
     "fileMatch": ["^\\.forgejo/workflows/[^/]+\\.ya?ml$"]
-  }
+  },
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["minor", "patch", "pin", "digest", "lockFileMaintenance"],
+      "addLabels": ["automerge"]
+    }
+  ]
 }

scripts/agent_loop.py

@@ -46,7 +46,7 @@ import time
 from datetime import datetime, timezone
 from pathlib import Path
 
-# Cron runs with a minimal PATH; ensure Nix profile binaries (tea, claude) and ~/go/bin (fgj) are found.
+# Cron runs with a minimal PATH; ensure Nix profile binaries (claude) and ~/go/bin (fgj) are found.
 os.environ["PATH"] = (
     f"{Path.home()}/.nix-profile/bin"
     f":{Path.home()}/go/bin"
@@ -97,22 +97,27 @@ def _fgj(*args: str) -> None:
         )
 
 
-def _tea_get(path: str) -> dict | list | None:
-    """Run a tea api GET and return parsed JSON. Only use for reads — tea PATCH/PUT
-    silently fails (exits 0) when unauthenticated, so writes must go via fgj."""
-    cmd = ["tea", "api", path]
-    result = subprocess.run(cmd, capture_output=True, text=True)
+def _fgj_run_list(limit: int = 20) -> list[dict]:
+    """Return workflow runs via fgj actions run list."""
+    result = subprocess.run(
+        ["fgj", "--hostname", "codeberg.org", "actions", "run", "list",
+         "--repo", REPO, "--json", "-L", str(limit)],
+        capture_output=True, text=True,
+    )
     if result.returncode != 0:
         raise RuntimeError(
-            f"tea api {path} failed:\n{result.stderr or result.stdout}"
+            f"fgj actions run list failed:\n{result.stderr or result.stdout}"
         )
     out = result.stdout.strip()
     if not out:
-        return None
-    data = json.loads(out)
-    if isinstance(data, dict) and "message" in data and "url" in data:
-        raise RuntimeError(f"tea api {path} returned error: {data['message']}")
-    return data
+        return []
+    try:
+        data = json.loads(out)
+    except json.JSONDecodeError as exc:
+        raise RuntimeError(
+            f"fgj actions run list returned non-JSON:\n{out[:500]}"
+        ) from exc
+    return data if isinstance(data, list) else []
 
 
 def _set_labels(issue: int, add: list[str], remove: list[str]) -> None:
@@ -181,9 +186,7 @@ def _latest_main_ci_run() -> dict | None:
     event=push and prettyref=main, so filtering by event alone is not enough.
     We also require workflow_id == "ci.yml".
     """
-    data = _tea_get(f"repos/{REPO}/actions/runs?limit=20")
-    runs = (data or {}).get("workflow_runs", [])
-    for run in runs:
+    for run in _fgj_run_list(limit=20):
         if (run.get("event") == "push"
                 and run.get("prettyref") == "main"
                 and run.get("workflow_id") == "ci.yml"):
@@ -194,20 +197,16 @@ def _latest_main_ci_run() -> dict | None:
 def _latest_ci_run_for_branch(branch: str) -> dict | None:
     """Return the latest CI run for a specific branch, or None.
 
-    Forgejo's workflow_runs API has no top-level head_branch field.
-    For push events the branch is in ``prettyref``; for pull_request
-    events it lives inside ``event_payload["pull_request"]["head"]["ref"]``.
+    For push events fgj reports the branch in ``prettyref``; for pull_request
+    events ``prettyref`` is ``#N``, so we resolve the PR number first.
     """
-    data = _tea_get(f"repos/{REPO}/actions/runs?limit=20")
-    runs = (data or {}).get("workflow_runs", [])
+    runs = _fgj_run_list(limit=20)
+    pr_data = _find_pr_for_branch(branch)
+    pr_ref = f"#{pr_data['number']}" if pr_data else None
     for run in runs:
         if run.get("event") == "pull_request":
-            try:
-                payload = json.loads(run.get("event_payload", "{}"))
-                if payload.get("pull_request", {}).get("head", {}).get("ref") == branch:
-                    return run
-            except (json.JSONDecodeError, AttributeError):
-                pass
+            if pr_ref and run.get("prettyref") == pr_ref:
+                return run
         elif run.get("event") == "push":
             if run.get("prettyref") == branch:
                 return run
@@ -254,24 +253,27 @@ def _open_issue_prs() -> list[dict]:
 
 def _latest_ci_run_for_pr(pr_number: int) -> dict | None:
     """Return the latest CI run triggered by a pull_request event for the given PR number."""
-    data = _tea_get(f"repos/{REPO}/actions/runs?event=pull_request&limit=50")
-    runs = (data or {}).get("workflow_runs", [])
-    for run in runs:
-        try:
-            payload = json.loads(run.get("event_payload", "{}"))
-            if payload.get("pull_request", {}).get("number") == pr_number:
-                return run
-        except (json.JSONDecodeError, AttributeError):
-            pass
+    pr_ref = f"#{pr_number}"
+    for run in _fgj_run_list(limit=50):
+        if run.get("event") == "pull_request" and run.get("prettyref") == pr_ref:
+            return run
     return None
 
 
 def _get_issue_labels(issue: int) -> list[str]:
     """Return label names for an issue."""
-    data = _tea_get(f"repos/{REPO}/issues/{issue}")
-    if not data:
+    result = subprocess.run(
+        ["fgj", "--hostname", "codeberg.org", "issue", "view", str(issue),
+         "--repo", REPO, "--json"],
+        capture_output=True, text=True,
+    )
+    if result.returncode != 0 or not result.stdout.strip():
         return []
-    return [lbl["name"] for lbl in data.get("labels", [])]
+    try:
+        data = json.loads(result.stdout)
+    except json.JSONDecodeError:
+        return []
+    return [lbl["name"] for lbl in data.get("issue", {}).get("labels", [])]
 
 
 def _merge_pr(pr_number: int) -> None:
@@ -287,8 +289,18 @@ def _handle_pr_still_open_after_merge(pr_number: int, branch: str, issue_num: in
       "merged"         — PR closed after a retry
       "fallback"       — all options exhausted; caller should set State/Question
     """
-    pr_data = _tea_get(f"repos/{REPO}/pulls/{pr_number}")
-    mergeable = (pr_data or {}).get("mergeable")
+    result = subprocess.run(
+        ["fgj", "--hostname", "codeberg.org", "pr", "view", str(pr_number),
+         "--repo", REPO, "--json"],
+        capture_output=True, text=True,
+    )
+    pr_data: dict = {}
+    if result.returncode == 0 and result.stdout.strip():
+        try:
+            pr_data = json.loads(result.stdout)
+        except json.JSONDecodeError:
+            pass
+    mergeable = pr_data.get("mergeable")
 
     if mergeable is False:
         prompt = (
@@ -831,9 +843,8 @@ def _run_loop() -> int:
         # spawning another agent, check whether any CI run is currently in
         # progress (the branch run) and wait if so.
         if ci_run_id_at_start is not None and run["id"] == ci_run_id_at_start:
-            check = _tea_get(f"repos/{REPO}/actions/runs?limit=5")
             in_flight = [
-                r for r in (check or {}).get("workflow_runs", [])
+                r for r in _fgj_run_list(limit=5)
                 if r.get("status") == "running"
             ]
             if in_flight:

scripts/check_coverage.dart

@@ -58,6 +58,7 @@ const _excluded = {
   'lib/ui/widgets/try_connection_button.dart',
   'lib/ui/widgets/undo_shell.dart',
   'lib/ui/screens/about_screen.dart',
+  'lib/ui/utils/about_markdown.dart',
   'lib/ui/widgets/email_tile.dart',
   'lib/core/sync/account_sync_manager.dart',
   'lib/core/sync/background_sync.dart',

test/backend/account_sync_manager_test.dart

@@ -288,6 +288,8 @@ class _FakeLogs implements SyncLogRepository {
     required String accountId,
     required bool success,
     String? errorMessage,
+    String? stackTrace,
+    bool isPermanent = false,
     required String protocol,
     required int emailsFetched,
     required int emailsSkipped,

test/unit/account_sync_manager_test.dart

@@ -181,6 +181,8 @@ class FakeSyncLogRepository implements SyncLogRepository {
     required String accountId,
     required bool success,
     String? errorMessage,
+    String? stackTrace,
+    bool isPermanent = false,
     required String protocol,
     required int emailsFetched,
     required int emailsSkipped,

test/unit/migration_test.dart

@@ -14,7 +14,7 @@ void main() {
   group('Migration', () {
     test('schemaVersion matches expected value', () async {
       final db = AppDatabase(NativeDatabase.memory());
-      expect(db.schemaVersion, 32);
+      expect(db.schemaVersion, 33);
       await db.close();
     });
 
@@ -194,6 +194,11 @@ void main() {
       // v32: local_sieve_applied table.
       await db.customSelect('SELECT count(*) FROM local_sieve_applied').get();
 
+      // v33: error_stack_trace and is_permanent columns on sync_logs.
+      final syncLogColumns = await _tableColumns(db, 'sync_logs');
+      expect(syncLogColumns, contains('error_stack_trace'));
+      expect(syncLogColumns, contains('is_permanent'));
+
       await db.close();
       if (dbFile.existsSync()) dbFile.deleteSync();
     });
@@ -381,11 +386,16 @@ void main() {
           await _tableColumns(db, 'sync_log_mailboxes');
       expect(syncLogMailboxColumns, contains('duration_ms'));
 
+      // v33: error_stack_trace and is_permanent columns on sync_logs.
+      final syncLogColumns = await _tableColumns(db, 'sync_logs');
+      expect(syncLogColumns, contains('error_stack_trace'));
+      expect(syncLogColumns, contains('is_permanent'));
+
       await db.close();
       if (dbFile.existsSync()) dbFile.deleteSync();
     });
 
-    test('fresh install creates all tables at schemaVersion 32', () async {
+    test('fresh install creates all tables at schemaVersion 33', () async {
       final db = AppDatabase(NativeDatabase.memory());
       await db.select(db.accounts).get();
 
@@ -426,6 +436,11 @@ void main() {
           await _tableColumns(db, 'sync_log_mailboxes');
       expect(syncLogMailboxColumns, contains('duration_ms'));
 
+      // v33: error_stack_trace and is_permanent columns on sync_logs.
+      final syncLogColumns = await _tableColumns(db, 'sync_logs');
+      expect(syncLogColumns, contains('error_stack_trace'));
+      expect(syncLogColumns, contains('is_permanent'));
+
       await db.close();
     });
   });

test/unit/reliability_runner_test.dart

@@ -170,6 +170,8 @@ class _FakeSyncLog implements SyncLogRepository {
     required String accountId,
     required bool success,
     String? errorMessage,
+    String? stackTrace,
+    bool isPermanent = false,
     required String protocol,
     required int emailsFetched,
     required int emailsSkipped,

test/unit/sync_log_repository_impl_test.dart

@@ -126,4 +126,34 @@ void main() {
     expect(rows.first.result, 'error');
     expect(rows.first.errorMessage, 'Connection refused');
   });
+
+  test('stores and retrieves stackTrace and isPermanent on error entries',
+      () async {
+    final repo = SyncLogRepositoryImpl(db);
+    final start = DateTime(2024, 3, 1, 9);
+    final end = DateTime(2024, 3, 1, 9, 0, 1);
+    const fakeTrace = '#0 main (file:///app/lib/main.dart:10:5)';
+
+    await repo.log(
+      accountId: 'acc1',
+      success: false,
+      errorMessage: 'MissingPluginException',
+      stackTrace: fakeTrace,
+      isPermanent: true,
+      protocol: 'imap',
+      emailsFetched: 0,
+      emailsSkipped: 0,
+      mailboxesSynced: 0,
+      pendingFlushed: 0,
+      bytesTransferred: 0,
+      startedAt: start,
+      finishedAt: end,
+    );
+
+    final entries = await repo.observeSyncLogs('acc1').first;
+    final entry = entries.firstWhere((e) => e.startedAt == start);
+    expect(entry.stackTrace, fakeTrace);
+    expect(entry.isPermanent, true);
+    expect(entry.errorMessage, 'MissingPluginException');
+  });
 }

website/content/privacy.md

@@ -25,7 +25,8 @@ The app processes the following data **exclusively on your device**:
   device's secure storage and never transmitted to us.
 - **Email messages and attachments** — fetched directly from your email provider's IMAP server and
   displayed in the app. We never receive, store, or process your emails.
-- **App settings and configuration** — stored locally on your device.
+- **App settings and configuration** — stored locally on your device. The app will never upload
+  this data to sharedinbox.de or any third-party service.
 
 ### Network connections