chore: add agentloop validation file (#563 )

Closes #563 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
feat(undo-log): hyperlink email rows in Undo Log Detail (#474 ) (#547 )
2026-06-11 20:25:13 +00:00 · 2026-06-10 13:15:48 +02:00 · 2026-06-10 13:13:28 +02:00 · 2026-06-09 21:31:45 +02:00 · 2026-06-09 16:08:19 +02:00 · 2026-06-08 22:44:55 +02:00
28 changed files with 807 additions and 452 deletions
@@ -0,0 +1,10 @@
+{
+    "name": "SharedInbox Dev",
+    "build": {
+        "dockerfile": "../Dockerfile.dev",
+        "context": ".."
+    },
+    "workspaceFolder": "/src",
+    "workspaceMount": "source=${localWorkspaceFolder},target=/src,type=bind,consistency=cached",
+    "remoteUser": "ci"
+}
@@ -19,14 +19,14 @@ jobs:
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          runner_start=$(date +%s)
-          created_at=$(curl -sf \
+          created=$(curl -sf --max-time 30 \
            -H "Authorization: token $FORGEJO_TOKEN" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/tasks?limit=100" \
-            | python3 -c "import sys,json;data=json.load(sys.stdin);rs=[r for r in data.get('workflow_runs',[]) if r.get('run_number')==$RUN_NUMBER];print(rs[0]['created_at'] if rs else '')" 2>/dev/null)
-          if [ -n "$created_at" ]; then
-            queued_epoch=$(date -d "$created_at" +%s)
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?run_number=$RUN_NUMBER" \
+            | python3 -c "import sys,json;rs=json.load(sys.stdin).get('workflow_runs',[]);print(rs[0]['created'] if rs else '')" 2>/dev/null) || true
+          if [ -n "$created" ]; then
+            queued_epoch=$(date -d "$created" +%s)
            wait_seconds=$((runner_start - queued_epoch))
-            echo "Runner wait time: ${wait_seconds}s (queued at $created_at)"
+            echo "Runner wait time: ${wait_seconds}s (queued at $created)"
          else
            echo "Runner wait time: unknown (API lookup failed)"
          fi
@@ -21,14 +21,14 @@ jobs:
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          runner_start=$(date +%s)
-          created_at=$(curl -sf \
+          created=$(curl -sf --max-time 30 \
            -H "Authorization: token $FORGEJO_TOKEN" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?limit=100" \
-            | python3 -c "import sys,json;data=json.load(sys.stdin);rs=[r for r in data.get('workflow_runs',[]) if r.get('run_number')==$RUN_NUMBER];print(rs[0]['created_at'] if rs else '')" 2>/dev/null)
-          if [ -n "$created_at" ]; then
-            queued_epoch=$(date -d "$created_at" +%s)
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?run_number=$RUN_NUMBER" \
+            | python3 -c "import sys,json;rs=json.load(sys.stdin).get('workflow_runs',[]);print(rs[0]['created'] if rs else '')" 2>/dev/null) || true
+          if [ -n "$created" ]; then
+            queued_epoch=$(date -d "$created" +%s)
            wait_seconds=$((runner_start - queued_epoch))
-            echo "Runner wait time: ${wait_seconds}s (queued at $created_at)"
+            echo "Runner wait time: ${wait_seconds}s (queued at $created)"
          else
            echo "Runner wait time: unknown (API lookup failed)"
          fi
@@ -51,43 +51,27 @@ jobs:

          HEAD_SHA=$(git rev-parse HEAD)

-          # Find the most recent workflow run where deploy-playstore actually succeeded
-          # (not merely skipped). Bug fix: previous code used commit_sha (always None in
-          # Forgejo's API) instead of head_sha, causing LAST_DEPLOYED_SHA to be empty on
-          # every run and the fallback diff to only cover HEAD~1..HEAD.
+          # Find the most recent successful "Build & Deploy to Play Store" task. Forgejo's API
+          # does not expose per-run jobs (/runs/{id}/jobs returns 404), so query /actions/tasks
+          # (per-job records) directly and filter for the task we care about. Filtering at the
+          # task level also distinguishes runs where the Play Store job actually ran from runs
+          # where it was skipped — at the run level both show status=success.
          LAST_DEPLOYED_SHA=$(python3 - << 'PYEOF'
          import json, os, sys, urllib.request
          token = os.environ.get("FORGEJO_TOKEN", "")
          server = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
          repo = os.environ.get("GITHUB_REPOSITORY", "")
-          base_api = f"{server}/api/v1/repos/{repo}/actions"
-          url = f"{base_api}/runs?workflow_id=deploy.yml&status=success&limit=10"
+          url = f"{server}/api/v1/repos/{repo}/actions/tasks?status=success&limit=100"
          req = urllib.request.Request(url, headers={"Authorization": f"token {token}"})
          try:
-              with urllib.request.urlopen(req) as r:
+              with urllib.request.urlopen(req, timeout=60) as r:
                  data = json.loads(r.read())
-              runs = [
-                  r for r in data.get("workflow_runs", [])
-                  if r.get("status") == "success"
-              ]
-              # Walk runs newest-first; pick the first one where deploy-playstore
-              # actually ran (conclusion=success), not just skipped.
-              for run in runs:
-                  run_id = run.get("id")
-                  jobs_url = f"{base_api}/runs/{run_id}/jobs"
-                  jobs_req = urllib.request.Request(jobs_url, headers={"Authorization": f"token {token}"})
-                  try:
-                      with urllib.request.urlopen(jobs_req) as jr:
-                          jobs_data = json.loads(jr.read())
-                      for job in jobs_data.get("workflow_jobs", []):
-                          if "Deploy to Play Store" in job.get("name", "") and (
-                              job.get("conclusion") == "success" or
-                              job.get("status") == "success"
-                          ):
-                              print(run.get("head_sha") or "")
-                              sys.exit(0)
-                  except Exception:
-                      pass  # skip this run if jobs API fails
+              for t in data.get("workflow_runs", []):
+                  if (t.get("workflow_id") == "deploy.yml"
+                      and t.get("name") == "Build & Deploy to Play Store"
+                      and t.get("status") == "success"):
+                      print(t.get("head_sha") or "")
+                      sys.exit(0)
              print("")
          except Exception as e:
              print(f"::error::LAST_DEPLOYED_SHA lookup failed ({type(e).__name__}: {e})")
@@ -164,14 +148,14 @@ jobs:
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          runner_start=$(date +%s)
-          created_at=$(curl -sf \
+          created=$(curl -sf --max-time 30 \
            -H "Authorization: token $FORGEJO_TOKEN" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?limit=100" \
-            | python3 -c "import sys,json;data=json.load(sys.stdin);rs=[r for r in data.get('workflow_runs',[]) if r.get('run_number')==$RUN_NUMBER];print(rs[0]['created_at'] if rs else '')" 2>/dev/null)
-          if [ -n "$created_at" ]; then
-            queued_epoch=$(date -d "$created_at" +%s)
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?run_number=$RUN_NUMBER" \
+            | python3 -c "import sys,json;rs=json.load(sys.stdin).get('workflow_runs',[]);print(rs[0]['created'] if rs else '')" 2>/dev/null) || true
+          if [ -n "$created" ]; then
+            queued_epoch=$(date -d "$created" +%s)
            wait_seconds=$((runner_start - queued_epoch))
-            echo "Runner wait time: ${wait_seconds}s (queued at $created_at)"
+            echo "Runner wait time: ${wait_seconds}s (queued at $created)"
          else
            echo "Runner wait time: unknown (API lookup failed)"
          fi
@@ -215,14 +199,14 @@ jobs:
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          runner_start=$(date +%s)
-          created_at=$(curl -sf \
+          created=$(curl -sf --max-time 30 \
            -H "Authorization: token $FORGEJO_TOKEN" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?limit=100" \
-            | python3 -c "import sys,json;data=json.load(sys.stdin);rs=[r for r in data.get('workflow_runs',[]) if r.get('run_number')==$RUN_NUMBER];print(rs[0]['created_at'] if rs else '')" 2>/dev/null)
-          if [ -n "$created_at" ]; then
-            queued_epoch=$(date -d "$created_at" +%s)
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?run_number=$RUN_NUMBER" \
+            | python3 -c "import sys,json;rs=json.load(sys.stdin).get('workflow_runs',[]);print(rs[0]['created'] if rs else '')" 2>/dev/null) || true
+          if [ -n "$created" ]; then
+            queued_epoch=$(date -d "$created" +%s)
            wait_seconds=$((runner_start - queued_epoch))
-            echo "Runner wait time: ${wait_seconds}s (queued at $created_at)"
+            echo "Runner wait time: ${wait_seconds}s (queued at $created)"
          else
            echo "Runner wait time: unknown (API lookup failed)"
          fi
@@ -260,14 +244,14 @@ jobs:
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          runner_start=$(date +%s)
-          created_at=$(curl -sf \
+          created=$(curl -sf --max-time 30 \
            -H "Authorization: token $FORGEJO_TOKEN" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?limit=100" \
-            | python3 -c "import sys,json;data=json.load(sys.stdin);rs=[r for r in data.get('workflow_runs',[]) if r.get('run_number')==$RUN_NUMBER];print(rs[0]['created_at'] if rs else '')" 2>/dev/null)
-          if [ -n "$created_at" ]; then
-            queued_epoch=$(date -d "$created_at" +%s)
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?run_number=$RUN_NUMBER" \
+            | python3 -c "import sys,json;rs=json.load(sys.stdin).get('workflow_runs',[]);print(rs[0]['created'] if rs else '')" 2>/dev/null) || true
+          if [ -n "$created" ]; then
+            queued_epoch=$(date -d "$created" +%s)
            wait_seconds=$((runner_start - queued_epoch))
-            echo "Runner wait time: ${wait_seconds}s (queued at $created_at)"
+            echo "Runner wait time: ${wait_seconds}s (queued at $created)"
          else
            echo "Runner wait time: unknown (API lookup failed)"
          fi
@@ -310,14 +294,14 @@ jobs:
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          runner_start=$(date +%s)
-          created_at=$(curl -sf \
+          created=$(curl -sf --max-time 30 \
            -H "Authorization: token $FORGEJO_TOKEN" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?limit=100" \
-            | python3 -c "import sys,json;data=json.load(sys.stdin);rs=[r for r in data.get('workflow_runs',[]) if r.get('run_number')==$RUN_NUMBER];print(rs[0]['created_at'] if rs else '')" 2>/dev/null)
-          if [ -n "$created_at" ]; then
-            queued_epoch=$(date -d "$created_at" +%s)
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?run_number=$RUN_NUMBER" \
+            | python3 -c "import sys,json;rs=json.load(sys.stdin).get('workflow_runs',[]);print(rs[0]['created'] if rs else '')" 2>/dev/null) || true
+          if [ -n "$created" ]; then
+            queued_epoch=$(date -d "$created" +%s)
            wait_seconds=$((runner_start - queued_epoch))
-            echo "Runner wait time: ${wait_seconds}s (queued at $created_at)"
+            echo "Runner wait time: ${wait_seconds}s (queued at $created)"
          else
            echo "Runner wait time: unknown (API lookup failed)"
          fi
@@ -20,14 +20,14 @@ jobs:
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          runner_start=$(date +%s)
-          created_at=$(curl -sf \
+          created=$(curl -sf --max-time 30 \
            -H "Authorization: token $FORGEJO_TOKEN" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/tasks?limit=100" \
-            | python3 -c "import sys,json;data=json.load(sys.stdin);rs=[r for r in data.get('workflow_runs',[]) if r.get('run_number')==$RUN_NUMBER];print(rs[0]['created_at'] if rs else '')" 2>/dev/null)
-          if [ -n "$created_at" ]; then
-            queued_epoch=$(date -d "$created_at" +%s)
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?run_number=$RUN_NUMBER" \
+            | python3 -c "import sys,json;rs=json.load(sys.stdin).get('workflow_runs',[]);print(rs[0]['created'] if rs else '')" 2>/dev/null) || true
+          if [ -n "$created" ]; then
+            queued_epoch=$(date -d "$created" +%s)
            wait_seconds=$((runner_start - queued_epoch))
-            echo "Runner wait time: ${wait_seconds}s (queued at $created_at)"
+            echo "Runner wait time: ${wait_seconds}s (queued at $created)"
          else
            echo "Runner wait time: unknown (API lookup failed)"
          fi
@@ -73,14 +73,14 @@ jobs:
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          runner_start=$(date +%s)
-          created_at=$(curl -sf \
+          created=$(curl -sf --max-time 30 \
            -H "Authorization: token $FORGEJO_TOKEN" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/tasks?limit=100" \
-            | python3 -c "import sys,json;data=json.load(sys.stdin);rs=[r for r in data.get('workflow_runs',[]) if r.get('run_number')==$RUN_NUMBER];print(rs[0]['created_at'] if rs else '')" 2>/dev/null)
-          if [ -n "$created_at" ]; then
-            queued_epoch=$(date -d "$created_at" +%s)
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?run_number=$RUN_NUMBER" \
+            | python3 -c "import sys,json;rs=json.load(sys.stdin).get('workflow_runs',[]);print(rs[0]['created'] if rs else '')" 2>/dev/null) || true
+          if [ -n "$created" ]; then
+            queued_epoch=$(date -d "$created" +%s)
            wait_seconds=$((runner_start - queued_epoch))
-            echo "Runner wait time: ${wait_seconds}s (queued at $created_at)"
+            echo "Runner wait time: ${wait_seconds}s (queued at $created)"
          else
            echo "Runner wait time: unknown (API lookup failed)"
          fi
@@ -135,7 +135,7 @@ jobs:
          repo_labels = api_get("/labels")
          label_map = {l["name"]: l["id"] for l in repo_labels}

-          label_ids = [label_map["Ready"]] if "Ready" in label_map else []
+          label_ids = [label_map["loop/code"]] if "loop/code" in label_map else []

          title = "Firebase Tests failed — find root cause and fix"
          body = (
@@ -0,0 +1,44 @@
+name: Publish Dev Container
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'Dockerfile.dev'
+      - '.devcontainer/devcontainer.json'
+      - '.forgejo/workflows/publish-dev-container.yml'
+  workflow_dispatch:
+
+jobs:
+  publish:
+    name: Build & Push sharedinbox-dev
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      REGISTRY: codeberg.org
+      IMAGE: codeberg.org/guettli/sharedinbox-dev
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to Codeberg container registry
+        env:
+          FORGEJO_TOKEN: ${{ github.token }}
+        run: |
+          echo "$FORGEJO_TOKEN" \
+            | docker login "$REGISTRY" -u "${{ github.actor }}" --password-stdin
+
+      - name: Build image
+        run: |
+          SHORT_SHA="${GITHUB_SHA:0:7}"
+          docker build \
+            -t "$IMAGE:latest" \
+            -t "$IMAGE:$SHORT_SHA" \
+            -f Dockerfile.dev \
+            .
+
+      - name: Push image
+        run: |
+          SHORT_SHA="${GITHUB_SHA:0:7}"
+          docker push "$IMAGE:latest"
+          docker push "$IMAGE:$SHORT_SHA"
@@ -38,40 +38,27 @@ jobs:

          HEAD_SHA=$(git rev-parse HEAD)

-          # Find the most recent successful website.yml run where the deploy job
-          # actually ran (not merely skipped). Uses head_sha (not commit_sha which
-          # is always None in Forgejo's API).
+          # Find the most recent successful "Build & Update Website" task. Forgejo's API
+          # does not expose per-run jobs (/runs/{id}/jobs returns 404), so query /actions/tasks
+          # (per-job records) directly and filter for the task we care about. Filtering at the
+          # task level also distinguishes runs where the deploy job actually ran from runs
+          # where it was skipped — at the run level both show status=success.
          LAST_DEPLOYED_SHA=$(python3 - << 'PYEOF'
          import json, os, sys, urllib.request
          token = os.environ.get("FORGEJO_TOKEN", "")
          server = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
          repo = os.environ.get("GITHUB_REPOSITORY", "")
-          base_api = f"{server}/api/v1/repos/{repo}/actions"
-          url = f"{base_api}/runs?workflow_id=website.yml&status=success&limit=10"
+          url = f"{server}/api/v1/repos/{repo}/actions/tasks?status=success&limit=100"
          req = urllib.request.Request(url, headers={"Authorization": f"token {token}"})
          try:
-              with urllib.request.urlopen(req) as r:
+              with urllib.request.urlopen(req, timeout=60) as r:
                  data = json.loads(r.read())
-              runs = [
-                  r for r in data.get("workflow_runs", [])
-                  if r.get("status") == "success"
-              ]
-              for run in runs:
-                  run_id = run.get("id")
-                  jobs_url = f"{base_api}/runs/{run_id}/jobs"
-                  jobs_req = urllib.request.Request(jobs_url, headers={"Authorization": f"token {token}"})
-                  try:
-                      with urllib.request.urlopen(jobs_req) as jr:
-                          jobs_data = json.loads(jr.read())
-                      for job in jobs_data.get("workflow_jobs", []):
-                          if "Build & Update Website" in job.get("name", "") and (
-                              job.get("conclusion") == "success" or
-                              job.get("status") == "success"
-                          ):
-                              print(run.get("head_sha") or "")
-                              sys.exit(0)
-                  except Exception:
-                      pass  # skip this run if jobs API fails
+              for t in data.get("workflow_runs", []):
+                  if (t.get("workflow_id") == "website.yml"
+                      and t.get("name") == "Build & Update Website"
+                      and t.get("status") == "success"):
+                      print(t.get("head_sha") or "")
+                      sys.exit(0)
              print("")
          except Exception as e:
              print(f"::error::LAST_DEPLOYED_SHA lookup failed ({type(e).__name__}: {e})")
@@ -130,14 +117,14 @@ jobs:
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          runner_start=$(date +%s)
-          created_at=$(curl -sf \
+          created=$(curl -sf --max-time 30 \
            -H "Authorization: token $FORGEJO_TOKEN" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/tasks?limit=100" \
-            | python3 -c "import sys,json;data=json.load(sys.stdin);rs=[r for r in data.get('workflow_runs',[]) if r.get('run_number')==$RUN_NUMBER];print(rs[0]['created_at'] if rs else '')" 2>/dev/null)
-          if [ -n "$created_at" ]; then
-            queued_epoch=$(date -d "$created_at" +%s)
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/actions/runs?run_number=$RUN_NUMBER" \
+            | python3 -c "import sys,json;rs=json.load(sys.stdin).get('workflow_runs',[]);print(rs[0]['created'] if rs else '')" 2>/dev/null) || true
+          if [ -n "$created" ]; then
+            queued_epoch=$(date -d "$created" +%s)
            wait_seconds=$((runner_start - queued_epoch))
-            echo "Runner wait time: ${wait_seconds}s (queued at $created_at)"
+            echo "Runner wait time: ${wait_seconds}s (queued at $created)"
          else
            echo "Runner wait time: unknown (API lookup failed)"
          fi
@@ -1,3 +1,3 @@
 {
  "flutter": "3.44.0"
-}
+}
@@ -123,3 +123,4 @@ dagger-certs
 /go
 .last_deployed_sha
 .fail_count
+/*.kubeconfig
@@ -26,13 +26,13 @@ repos:
      - id: forbidden-files-hook
        name: check for forbidden home-directory files
        language: system
-        entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && nix develop --command task check-hygiene'
+        entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && task check-hygiene'
        pass_filenames: false
        always_run: true
      - id: dart-check
        name: dart format (autofix) + check-fast (parallel)
        language: system
-        entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && nix develop --command dagger call --progress=plain -q -m ci --source=. check-fast'
+        entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && dagger call --progress=plain -q -m ci --source=. check-fast'
        pass_filenames: false
        always_run: true
      - id: ci-no-direct-dagger
@@ -50,6 +50,12 @@ repos:
      - id: ci-image-exists
        name: verify container images in ci/main.go are reachable
        language: system
-        entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && nix develop --command task check-ci-images'
+        entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && task check-ci-images'
        pass_filenames: false
        files: ^(ci/main\.go|\.fvmrc)$
+      - id: dagger-versions-aligned
+        name: verify Dagger version is consistent across dagger.json, Dockerfile and DAGGER.md
+        language: system
+        entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && scripts/check_dagger_versions.sh'
+        pass_filenames: false
+        files: ^(ci/dagger\.json|\.forgejo/Dockerfile|DAGGER\.md)$
@@ -0,0 +1,59 @@
+# Development and Testing Container for SharedInbox
+# Replaces the Nix shell environment.
+FROM ghcr.io/cirruslabs/flutter:3.44.0
+
+# Install Linux desktop build and test dependencies, Go, NodeJS, python3, and utilities
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    clang \
+    cmake \
+    ninja-build \
+    pkg-config \
+    libgtk-3-dev \
+    liblzma-dev \
+    libsecret-1-dev \
+    libgcrypt20-dev \
+    libjsoncpp-dev \
+    sqlite3 \
+    iproute2 \
+    netcat-openbsd \
+    xvfb \
+    libosmesa6 \
+    libegl1 \
+    lld \
+    git \
+    curl \
+    jq \
+    python3-pip \
+    nodejs \
+    npm \
+    hugo \
+    lcov \
+    rsync \
+    openssh-client \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Task runner
+RUN curl -fsSL https://taskfile.dev/install.sh \
+    | sh -s -- -b /usr/local/bin v3.48.0
+
+# Install Dagger CLI
+RUN curl -fsSL https://dl.dagger.io/dagger/install.sh \
+    | DAGGER_VERSION=0.20.8 BIN_DIR=/usr/local/bin sh
+
+# Install python packages (Play Store API clients + pre-commit)
+RUN pip install --break-system-packages --no-cache-dir \
+    google-api-python-client \
+    google-auth-httplib2 \
+    httplib2 \
+    pre-commit==4.5.1
+
+# Install acpx CLI globally
+RUN npm install -g acpx@0.10.0
+
+# Setup user "ci"
+RUN useradd -m -s /bin/bash ci
+USER ci
+ENV HOME=/home/ci
+ENV PATH=/home/ci/.pub-cache/bin:$PATH
+
+WORKDIR /src
@@ -544,7 +544,7 @@ tasks:
      - sops exec-env secrets.enc.yaml 'bash scripts/build_android_bundle_local.sh'

  deploy-android-bundle:
-    desc: Build release AAB and upload to Play Store internal track (local/fvm)
+    desc: Build release AAB and upload to Play Store internal + closed-testing tracks (local/fvm)
    deps: [build-android-bundle-local]
    dotenv: [".env"]
    cmds:
@@ -712,6 +712,11 @@ tasks:
    cmds:
      - scripts/check_ci_images.sh

+  check-dagger-versions:
+    desc: Verify ci/dagger.json, flake.nix, .forgejo/Dockerfile and DAGGER.md pin the same Dagger version
+    cmds:
+      - scripts/check_dagger_versions.sh
+
  _integrations:
    internal: true
    run: once
@@ -0,0 +1 @@
+Agentloop is working on sialoop!
@@ -814,7 +814,14 @@ func (m *Ci) DeployApk(
 // Returns a flat directory with app-debug.apk and app-debug-androidTest.apk.
 func (m *Ci) BuildAndroidDebugApks() *dagger.Directory {
 	built := m.firebaseBase().
-		WithExec([]string{"flutter", "build", "apk", "--debug", "--no-pub"}).
+		// `flutter build apk` spawns a Gradle daemon. When this WithExec ends the
+		// container is torn down and the daemon is killed, but its journal-cache
+		// lock file on the persistent gradle-cache volume keeps its dead PID — the
+		// next gradlew invocation then times out waiting for that lock. `gradlew
+		// --stop` shuts the daemon down gracefully so the lock is released before
+		// Dagger snapshots the layer.
+		WithExec([]string{"/bin/bash", "-c",
+			`flutter build apk --debug --no-pub && (cd android && ./gradlew --stop)`}).
 		WithWorkdir("/src/android").
 		// --no-daemon avoids connecting to a stale daemon whose registry file was
 		// preserved in the Dagger layer snapshot but whose process no longer exists.
@@ -896,7 +903,7 @@ func withGoCache(c *dagger.Container) *dagger.Container {
 		WithEnvVariable("GOMODCACHE", "/home/ci/go/pkg/mod")
 }

-// UploadToPlayStore uploads a pre-built AAB to the Play Store internal track.
+// UploadToPlayStore uploads a pre-built AAB to the Play Store internal and closed-testing (alpha) tracks.
 func (m *Ci) UploadToPlayStore(
 	ctx context.Context,
 	aab *dagger.File,
@@ -1,82 +0,0 @@
-{
-  "nodes": {
-    "dagger": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1778107833,
-        "narHash": "sha256-q5XQep2mpgTPiWwuYB1+L2dsFeACT6sHx8J939iM+HE=",
-        "owner": "dagger",
-        "repo": "nix",
-        "rev": "873cc22ba46b73d4a6c1aa6c102ef3aabc736496",
-        "type": "github"
-      },
-      "original": {
-        "owner": "dagger",
-        "repo": "nix",
-        "type": "github"
-      }
-    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1778737229,
-        "narHash": "sha256-6xWoytx8jFW4PF1GjRm/i/53trbpKGfz6zjzQGBr4cI=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d7a713c0b7e47c908258e71cba7a2d77cc8d71d5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "dagger": "dagger",
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
@@ -1,164 +0,0 @@
-{
-  description = "SharedInbox — IMAP/SMTP Flutter client";
-
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
-    flake-utils.url = "github:numtide/flake-utils";
-    dagger.url = "github:dagger/nix";
-    dagger.inputs.nixpkgs.follows = "nixpkgs";
-  };
-
-  outputs = { self, nixpkgs, flake-utils, dagger }:
-    flake-utils.lib.eachDefaultSystem (system:
-      let
-        pkgs = nixpkgs.legacyPackages.${system};
-
-        # All Linux desktop runtime libraries needed by flutter build linux and
-        # the UI integration tests (xvfb-run).  Kept as a list so we can reuse
-        # it for both buildInputs and LD_LIBRARY_PATH / PKG_CONFIG_PATH.
-        linuxDesktopLibs = with pkgs; [
-          gtk3
-          libsecret
-          fontconfig
-          libepoxy
-          mesa
-          libGL        # libglvnd — vendor-neutral GL/EGL/GLX dispatch layer
-          at-spi2-core
-          glib
-          pango
-          cairo
-          gdk-pixbuf
-          harfbuzz
-        # Dagger remote setup dependencies
-        stunnel
-        netcat
-        ];
-
-        fgj = pkgs.stdenv.mkDerivation {
-          pname = "fgj";
-          version = "0.4.0";
-          src = pkgs.fetchurl {
-            url = "https://codeberg.org/romaintb/fgj/releases/download/v0.4.0/fgj_linux_amd64";
-            sha256 = "07pia03facvvxq9i1dgl7p47ccv1iqj4drpkp45gvw26d4afkbj7";
-          };
-          dontUnpack = true;
-          installPhase = ''
-            mkdir -p $out/bin
-            cp $src $out/bin/fgj
-            chmod +x $out/bin/fgj
-          '';
-        };
-
-        # The dagger/nix flake pins 0.20.8, whose Nix wrapper is a broken self-exec
-        # loop.  Fetch 0.21.4 directly so the pre-commit dart-check hook can run.
-        dagger021 = pkgs.stdenv.mkDerivation {
-          pname = "dagger";
-          version = "0.21.4";
-          src = pkgs.fetchurl {
-            url = "https://dl.dagger.io/dagger/releases/0.21.4/dagger_v0.21.4_linux_amd64.tar.gz";
-            sha256 = "0wlnbr4g5069755131yjp2a6alacn64f1c8b27xn0cbynq3zicjd";
-          };
-          sourceRoot = ".";
-          installPhase = ''
-            mkdir -p $out/bin
-            cp dagger $out/bin/dagger
-            chmod +x $out/bin/dagger
-          '';
-        };
-      in {
-        devShells.default = pkgs.mkShell {
-          buildInputs = with pkgs; [
-            # Dagger CLI
-            dagger021
-
-            # Go compiler — for Dagger development
-            go
-
-            # Java JDK — required by Gradle for Android builds
-
-            # Task runner
-            go-task
-
-            # Flutter version manager — needed for host builds (task build-linux, task run)
-            fvm
-
-            # Git hooks
-            pre-commit
-
-            # Linux desktop build + runtime dependencies (flutter build linux / task run)
-          ] ++ linuxDesktopLibs ++ (with pkgs; [
-            pkg-config
-            clang
-            cmake
-            ninja
-
-            # Local IMAP/SMTP dev server for integration tests
-            stalwart-mail
-
-            # Headless display for UI integration tests
-            xvfb-run          # wraps Xvfb; xvfb-run --auto-servernum ...
-
-            # Coverage merging (flutter test --merge-coverage requires lcov)
-            lcov
-
-            # Website
-            hugo
-
-            # Utilities
-            git
-            curl
-            jq
-            sqlite
-            # python3 base + Google Play API client (for scripts/deploy_playstore.py)
-            (python3.withPackages (ps: with ps; [
-              google-api-python-client
-              google-auth-httplib2
-              httplib2
-            ]))  # used by stalwart-dev/start and deploy_playstore.py
-            fgj      # Codeberg/Forgejo CLI (like gh for GitHub)
-            skopeo   # inspect OCI image manifests without pulling layers (used by check-ci-images)
-            librsvg  # rsvg-convert — SVG→PNG for generate-icons task
-          ]);
-
-          shellHook = ''
-            # nix develop --command does not set IN_NIX_SHELL; set it so _preflight passes in CI
-            export IN_NIX_SHELL=1
-
-            # Point Dagger client at the running engine socket
-            export DAGGER_HOST=unix:///run/dagger/engine.sock
-
-            # Disable Flutter telemetry inside dev shell
-            export FLUTTER_SUPPRESS_ANALYTICS=true
-
-            # Expose dev headers to cmake's FindPkgConfig.
-            # The nix pkg-config wrapper works in bash but cmake invokes pkg-config
-            # as a subprocess and needs PKG_CONFIG_PATH set explicitly.
-            export PKG_CONFIG_PATH="${pkgs.gtk3.dev}/lib/pkgconfig:${pkgs.glib.dev}/lib/pkgconfig:${pkgs.pango.dev}/lib/pkgconfig:${pkgs.cairo.dev}/lib/pkgconfig:${pkgs.gdk-pixbuf.dev}/lib/pkgconfig:${pkgs.at-spi2-core.dev}/lib/pkgconfig:${pkgs.harfbuzz.dev}/lib/pkgconfig:${pkgs.libsecret}/lib/pkgconfig:${pkgs.fontconfig.dev}/lib/pkgconfig:${pkgs.libepoxy}/lib/pkgconfig:$PKG_CONFIG_PATH"
-
-            # Nix ld uses --no-copy-dt-needed-entries (strict mode): transitive shared-lib
-            # deps are not followed automatically, so link them explicitly.
-            export LDFLAGS="-L${pkgs.fontconfig.lib}/lib -lfontconfig $LDFLAGS"
-
-            # Make nix-built runtime libs visible to the dynamic linker so the
-            # Flutter Linux bundle and integration-ui tests can run.
-            export LD_LIBRARY_PATH="${pkgs.lib.makeLibraryPath linuxDesktopLibs}:$LD_LIBRARY_PATH"
-
-            # Wire the libglvnd dispatch to the nix mesa vendor ICDs so GTK/Flutter
-            # can create an OpenGL (EGL + GLX) context under Xvfb without a real GPU.
-            export __EGL_VENDOR_LIBRARY_DIRS="${pkgs.mesa}/share/glvnd/egl_vendor.d"
-            export __GLX_VENDOR_LIBRARY_DIRS="${pkgs.mesa}/lib"
-            export LIBGL_ALWAYS_SOFTWARE=1
-            export MESA_LOADER_DRIVER_OVERRIDE=softpipe
-
-            echo "SharedInbox Flutter dev environment ready."
-            echo "  Analyze        : task analyze"
-            echo "  Unit tests     : task test"
-            echo "  Integration    : task integration"
-            echo "  All checks     : task check"
-            echo "  Run (Linux)    : task run"
-            echo "  Start Stalwart : stalwart-dev/start"
-          '';
-        };
-      }
-    );
-}
@@ -74,10 +74,6 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
    return Scaffold(
      appBar: AppBar(
        automaticallyImplyLeading: !isMobile,
-        title: Text(
-          header?.subject ?? '(loading…)',
-          overflow: TextOverflow.ellipsis,
-        ),
        actions: [
          IconButton(
            icon: const Icon(Icons.reply),
@@ -133,12 +129,20 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
              if (mounted) setState(() => _isFlagged = next);
            },
          ),
+          IconButton(
+            icon: const Icon(Icons.report_outlined),
+            tooltip: 'Mark as spam',
+            onPressed: header == null
+                ? null
+                : () {
+                    unawaited(_markAsSpam(context, header));
+                  },
+          ),
          PopupMenuButton<String>(
            itemBuilder: (ctx) => [
              const PopupMenuItem(value: 'forward', child: Text('Forward')),
              const PopupMenuItem(value: 'move', child: Text('Move to folder')),
              const PopupMenuItem(value: 'snooze', child: Text('Snooze')),
-              const PopupMenuItem(value: 'spam', child: Text('Mark as spam')),
              const PopupMenuItem(
                value: 'mark_unread',
                child: Text('Mark as unread'),
@@ -166,8 +170,6 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
                unawaited(_moveTo(context, header));
              } else if (value == 'snooze' && header != null) {
                unawaited(_snooze(context, header));
-              } else if (value == 'spam' && header != null) {
-                unawaited(_markAsSpam(context, header));
              } else if (value == 'mark_unread') {
                final nextEmailId = await _getNextEmailIdIfNeeded(header);
                await repo.setFlag(widget.emailId, seen: false);
@@ -237,6 +239,10 @@ class _EmailDetailScreenState extends ConsumerState<EmailDetailScreen> {
                      ScaffoldMessenger.of(ctx).showSnackBar(
                        SnackBar(
                          duration: const Duration(seconds: 3),
+                          // SnackBar defaults to persist=true when an action
+                          // is set, which disables the auto-dismiss timer.
+                          // Explicitly opt back into duration-based dismiss.
+                          persist: false,
                          content: const Text(
                            'Images will be loaded automatically for this sender.',
                          ),
@@ -214,6 +214,10 @@ class _EmailMessageCardState extends ConsumerState<_EmailMessageCard> {
                            ScaffoldMessenger.of(context).showSnackBar(
                              SnackBar(
                                duration: const Duration(seconds: 3),
+                                // SnackBar defaults to persist=true when an
+                                // action is set, which disables auto-dismiss.
+                                // Explicitly opt into duration-based dismiss.
+                                persist: false,
                                content: const Text(
                                  'Images will be loaded automatically for this sender.',
                                ),
@@ -1,5 +1,6 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:go_router/go_router.dart';
 import 'package:intl/intl.dart';
 import 'package:sharedinbox/core/models/email.dart';
 import 'package:sharedinbox/core/models/undo_action.dart';
@@ -93,7 +94,9 @@ class UndoLogDetailScreen extends ConsumerWidget {
                style: theme.textTheme.bodySmall,
              ),
            ),
-          ...action.originalEmails.map((email) => _EmailTile(email: email)),
+          ...action.originalEmails.map(
+            (email) => _EmailTile(email: email, accountId: action.accountId),
+          ),
        ],
      ),
    );
@@ -120,13 +123,14 @@ class _SectionHeader extends StatelessWidget {
  }
 }

-class _EmailTile extends StatelessWidget {
-  const _EmailTile({required this.email});
+class _EmailTile extends ConsumerWidget {
+  const _EmailTile({required this.email, required this.accountId});

  final Email email;
+  final String accountId;

  @override
-  Widget build(BuildContext context) {
+  Widget build(BuildContext context, WidgetRef ref) {
    final sender = email.from.isNotEmpty
        ? (email.from.first.name ?? email.from.first.email)
        : '(Unknown Sender)';
@@ -134,6 +138,43 @@ class _EmailTile extends StatelessWidget {
      leading: const Icon(Icons.email_outlined),
      title: Text(email.subject ?? '(No Subject)'),
      subtitle: Text(sender, maxLines: 1, overflow: TextOverflow.ellipsis),
+      trailing: const Icon(Icons.chevron_right),
+      onTap: () => _openEmail(context, ref),
+    );
+  }
+
+  Future<void> _openEmail(BuildContext context, WidgetRef ref) async {
+    final messageId = email.messageId;
+    final messenger = ScaffoldMessenger.of(context);
+    if (messageId == null) {
+      messenger.showSnackBar(
+        const SnackBar(
+          duration: Duration(seconds: 5),
+          content: Text('Cannot locate this email — no Message-ID.'),
+        ),
+      );
+      return;
+    }
+    final found = await ref
+        .read(emailRepositoryProvider)
+        .findEmailByMessageId(accountId, messageId);
+    if (!context.mounted) return;
+    if (found == null) {
+      messenger.showSnackBar(
+        const SnackBar(
+          duration: Duration(seconds: 5),
+          content: Text(
+            'Email no longer exists at its previous location. '
+            'Use Undo to restore it.',
+          ),
+        ),
+      );
+      return;
+    }
+    context.go(
+      '/accounts/$accountId'
+      '/mailboxes/${Uri.encodeComponent(found.mailboxPath)}'
+      '/emails/${Uri.encodeComponent(found.id)}',
    );
  }
 }
@@ -5,18 +5,18 @@ packages:
    dependency: transitive
    description:
      name: _fe_analyzer_shared
-      sha256: "8d7ff3948166b8ec5da0fbb5962000926b8e02f2ed9b3e51d1738905fbd4c98d"
+      sha256: a49d6cf99e8d8e7a8e93668d09ced0bbdb954d0b4fccc2f5f9241c6b87fad95c
      url: "https://pub.dev"
    source: hosted
-    version: "93.0.0"
+    version: "99.0.0"
  analyzer:
    dependency: transitive
    description:
      name: analyzer
-      sha256: de7148ed2fcec579b19f122c1800933dfa028f6d9fd38a152b04b1516cec120b
+      sha256: "663efa951fb8a45e06f491223a604c93820598f20e6a99c25617a1576065e8b7"
      url: "https://pub.dev"
    source: hosted
-    version: "10.0.1"
+    version: "12.1.0"
  archive:
    dependency: transitive
    description:
@@ -165,10 +165,10 @@ packages:
    dependency: transitive
    description:
      name: code_assets
-      sha256: "83ccdaa064c980b5596c35dd64a8d3ecc68620174ab9b90b6343b753aa721687"
+      sha256: bf394f466ba9205f1812a0433b392d6af280f155f56651eda7c18cc32ed493b8
      url: "https://pub.dev"
    source: hosted
-    version: "1.0.0"
+    version: "1.2.1"
  code_builder:
    dependency: transitive
    description:
@@ -237,18 +237,18 @@ packages:
    dependency: transitive
    description:
      name: dart_style
-      sha256: "29f7ecc274a86d32920b1d9cfc7502fa87220da41ec60b55f329559d5732e2b2"
+      sha256: a4c1ccfee44c7e75ed80484071a5c142a385345e658fd8bd7c4b5c97e7198f98
      url: "https://pub.dev"
    source: hosted
-    version: "3.1.7"
+    version: "3.1.8"
  dbus:
    dependency: transitive
    description:
      name: dbus
-      sha256: d0c98dcd4f5169878b6cf8f6e0a52403a9dff371a3e2f019697accbf6f44a270
+      sha256: "0ce9b0a839e6dee59a37a623d2fc26a35bbbe6404213e419b0d6411023d62645"
      url: "https://pub.dev"
    source: hosted
-    version: "0.7.12"
+    version: "0.7.14"
  device_info_plus:
    dependency: "direct main"
    description:
@@ -349,10 +349,10 @@ packages:
    dependency: "direct main"
    description:
      name: file_picker
-      sha256: "0204695694b687b167fd497da5252e9f4aaa162e8d274d6fa1e757380f2a5f46"
+      sha256: fc83774ce5bd7ce08168333b5e53dbe9090ec04eb21e7aa7cd7bac921032c934
      url: "https://pub.dev"
    source: hosted
-    version: "12.0.0-beta.4"
+    version: "12.0.0-beta.5"
  fixnum:
    dependency: transitive
    description:
@@ -391,34 +391,42 @@ packages:
    dependency: "direct main"
    description:
      name: flutter_local_notifications
-      sha256: "0d9035862236fe38250fe1644d7ed3b8254e34a21b2c837c9f539fbb3bba5ef1"
+      sha256: be38e3854d2baabcda8e16966a5fe8748cebb655bb94701494da0f052c2fc352
      url: "https://pub.dev"
    source: hosted
-    version: "21.0.0"
+    version: "22.0.0"
  flutter_local_notifications_linux:
    dependency: transitive
    description:
      name: flutter_local_notifications_linux
-      sha256: e0f25e243c6c44c825bbbc6b2b2e76f7d9222362adcfe9fd780bf01923c840bd
+      sha256: "9ca97e63776f29ab1b955725c09999fc2c150523269db150c39274f2a43c5a8b"
      url: "https://pub.dev"
    source: hosted
-    version: "8.0.0"
+    version: "8.0.1"
  flutter_local_notifications_platform_interface:
    dependency: transitive
    description:
      name: flutter_local_notifications_platform_interface
-      sha256: e7db3d5b49c2b7ecc68deba4aaaa67a348f92ee0fef34c8e4b4459dbef0d7307
+      sha256: ff0013eae795e8dc8fad4a8992a209e64d3ba2fbd8bf5e43c36bf448f95bd814
      url: "https://pub.dev"
    source: hosted
-    version: "11.0.0"
+    version: "12.0.0"
+  flutter_local_notifications_web:
+    dependency: transitive
+    description:
+      name: flutter_local_notifications_web
+      sha256: "516afaf97a2d1e67a036c6617321b00d205d72f7a67b6eccf936cd565f985878"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
  flutter_local_notifications_windows:
    dependency: transitive
    description:
      name: flutter_local_notifications_windows
-      sha256: "3a2654ba104fbb52c618ebed9def24ef270228470718c43b3a6afcd5c81bef0c"
+      sha256: "5aeed973a0c1480706784fad05c5c3a911335ebb561b2274b47fe80b375201e1"
      url: "https://pub.dev"
    source: hosted
-    version: "3.0.0"
+    version: "3.1.0"
  flutter_markdown_plus:
    dependency: "direct main"
    description:
@@ -431,10 +439,10 @@ packages:
    dependency: transitive
    description:
      name: flutter_plugin_android_lifecycle
-      sha256: "38d1c268de9097ff59cf0e844ac38759fc78f76836d37edad06fa21e182055a0"
+      sha256: "3854fe5e3bff0b113c658f260b90c95dea17c92db0f2addeac2e343dd9969785"
      url: "https://pub.dev"
    source: hosted
-    version: "2.0.34"
+    version: "2.0.35"
  flutter_riverpod:
    dependency: "direct main"
    description:
@@ -447,10 +455,10 @@ packages:
    dependency: "direct main"
    description:
      name: flutter_secure_storage
-      sha256: d2a6ac2df7353f5ca47eb159a5407c1dba7ec48ca0e02dc38c9ff4d29447b261
+      sha256: "7686b1d6a29985dcbb808c59518226e603e3bfa7c0ddfd1a0d00e4cda77c868e"
      url: "https://pub.dev"
    source: hosted
-    version: "10.3.0"
+    version: "10.3.1"
  flutter_secure_storage_darwin:
    dependency: transitive
    description:
@@ -526,10 +534,10 @@ packages:
    dependency: "direct main"
    description:
      name: go_router
-      sha256: "92d8cee7c57dff0a6c409c05597b460002434eccf7424a712283225b3962d03f"
+      sha256: "5922b2861e2235a3504896f0d6fa07d84141b480cf52eecd2f42cd25585a9e8a"
      url: "https://pub.dev"
    source: hosted
-    version: "17.2.3"
+    version: "17.3.0"
  graphs:
    dependency: transitive
    description:
@@ -542,10 +550,10 @@ packages:
    dependency: transitive
    description:
      name: hooks
-      sha256: "025f060e86d2d4c3c47b56e33caf7f93bf9283340f26d23424ebcfccf34f621e"
+      sha256: "9a62a50b50b769a737bc0a8ff381f333529df3ab746b2f6b02e83760231455ba"
      url: "https://pub.dev"
    source: hosted
-    version: "1.0.3"
+    version: "2.0.2"
  http:
    dependency: "direct main"
    description:
@@ -675,10 +683,10 @@ packages:
    dependency: transitive
    description:
      name: meta
-      sha256: "23f08335362185a5ea2ad3a4e597f1375e78bce8a040df5c600c8d3552ef2394"
+      sha256: "1741988757a65eb6b36abe716829688cf01910bbf91c34354ff7ec1c3de2b349"
      url: "https://pub.dev"
    source: hosted
-    version: "1.17.0"
+    version: "1.18.0"
  mime:
    dependency: "direct main"
    description:
@@ -707,10 +715,10 @@ packages:
    dependency: transitive
    description:
      name: native_toolchain_c
-      sha256: "6ba77bb18063eebe9de401f5e6437e95e1438af0a87a3a39084fbd37c90df572"
+      sha256: f59351d28f49520cd3a74eb1f41c5f19ae15e53c65a3231d14af672e46510a96
      url: "https://pub.dev"
    source: hosted
-    version: "0.17.6"
+    version: "0.19.1"
  node_preamble:
    dependency: transitive
    description:
@@ -723,10 +731,10 @@ packages:
    dependency: transitive
    description:
      name: objective_c
-      sha256: "100a1c87616ab6ed41ec263b083c0ef3261ee6cd1dc3b0f35f8ddfa4f996fe52"
+      sha256: "6cb691c686fa2838c6deb34980d426145c2a5d537491cb83d463c33cdbc726ed"
      url: "https://pub.dev"
    source: hosted
-    version: "9.3.0"
+    version: "9.4.1"
  open_filex:
    dependency: "direct main"
    description:
@@ -1013,13 +1021,13 @@ packages:
    source: hosted
    version: "1.10.2"
  sqlite3:
-    dependency: "direct dev"
+    dependency: "direct main"
    description:
      name: sqlite3
-      sha256: "56da3e13ed7d28a66f930aa2b2b29db6736a233f08283326e96321dd812030f5"
+      sha256: "9488c7d2cdb1091c91cacf7e207cff81b28bff8e366f042bad3afe7d34afe189"
      url: "https://pub.dev"
    source: hosted
-    version: "3.3.1"
+    version: "3.3.2"
  sqlite3_flutter_libs:
    dependency: "direct main"
    description:
@@ -1088,10 +1096,10 @@ packages:
    dependency: transitive
    description:
      name: synchronized
-      sha256: "63896c27e81b28f8cb4e69ead0d3e8f03f1d1e5fc531a3e579cabed6a2c7c9e5"
+      sha256: "93b153dcb6a26dcddee6ca087dd634b53e38c10b5aa163e8e49501a776456153"
      url: "https://pub.dev"
    source: hosted
-    version: "3.4.0+1"
+    version: "3.4.1"
  term_glyph:
    dependency: transitive
    description:
@@ -1104,26 +1112,26 @@ packages:
    dependency: "direct dev"
    description:
      name: test
-      sha256: "280d6d890011ca966ad08df7e8a4ddfab0fb3aa49f96ed6de56e3521347a9ae7"
+      sha256: "8d9ceddbab833f180fbefed08afa76d7c03513dfdba87ffcec2718b02bbcbf20"
      url: "https://pub.dev"
    source: hosted
-    version: "1.30.0"
+    version: "1.31.0"
  test_api:
    dependency: transitive
    description:
      name: test_api
-      sha256: "8161c84903fd860b26bfdefb7963b3f0b68fee7adea0f59ef805ecca346f0c7a"
+      sha256: "949a932224383300f01be9221c39180316445ecb8e7547f70a41a35bf421fb9e"
      url: "https://pub.dev"
    source: hosted
-    version: "0.7.10"
+    version: "0.7.11"
  test_core:
    dependency: transitive
    description:
      name: test_core
-      sha256: "0381bd1585d1a924763c308100f2138205252fb90c9d4eeaf28489ee65ccde51"
+      sha256: "1991d4cfe85d5043241acac92962c3977c8d2f2add1ee73130c7b286417d1d34"
      url: "https://pub.dev"
    source: hosted
-    version: "0.6.16"
+    version: "0.6.17"
  timezone:
    dependency: transitive
    description:
@@ -1288,10 +1296,10 @@ packages:
    dependency: transitive
    description:
      name: webview_flutter_android
-      sha256: ad5182eff9a550925330cb9f0cb038eddfdd5712aba8b77aa0f0400e50f6e688
+      sha256: a97db7a44f8e71af2f3971c45550a08cce1fb60059c1b8e534251e6cfb753490
      url: "https://pub.dev"
    source: hosted
-    version: "4.12.0"
+    version: "4.13.0"
  webview_flutter_platform_interface:
    dependency: transitive
    description:
@@ -1304,10 +1312,10 @@ packages:
    dependency: transitive
    description:
      name: webview_flutter_wkwebview
-      sha256: "82648217f537573e1ca9ae9952d3eacedca6ab5aee69dc84445fc763766dcea2"
+      sha256: c879dd64b87c452aa84381b244d5469da57ba7e8cca6884c7b1e0d406372c12d
      url: "https://pub.dev"
    source: hosted
-    version: "3.25.1"
+    version: "3.26.0"
  win32:
    dependency: transitive
    description:
@@ -1381,5 +1389,5 @@ packages:
    source: hosted
    version: "3.1.3"
 sdks:
-  dart: ">=3.11.0 <4.0.0"
-  flutter: ">=3.38.4"
+  dart: ">=3.12.0 <4.0.0"
+  flutter: ">=3.44.0"
@@ -28,7 +28,7 @@ dependencies:
  flutter_riverpod: ^3.0.0

  # Navigation
-  go_router: ^17.2.3
+  go_router: ^17.3.0

  # Secure credential storage (passwords)
  flutter_secure_storage: ^10.0.0
@@ -37,7 +37,7 @@ dependencies:
  intl: ^0.20.2

  # File picking (compose attachments) and opening downloaded attachments
-  file_picker: ^12.0.0-beta.4
+  file_picker: ^12.0.0-beta.5
  open_filex: ^4.6.0
  mime: ^2.0.0

@@ -56,7 +56,7 @@ dependencies:
  flutter_markdown_plus: ^1.0.7

  # Background sync and local notifications
-  flutter_local_notifications: ^21.0.0
+  flutter_local_notifications: ^22.0.0
  workmanager: ^0.9.0

  # Stack trace chain-to-VM conversion for FlutterError.demangleStackTrace
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Verify that the Dagger version is consistent across the project.
+#
+# The Dagger CLI must speak the same protocol as the engine it talks to.  We
+# pin the version in four places (engine image in DAGGER.md, the CLI in
+# flake.nix, the CLI in the Forgejo runner Dockerfile, and the module
+# engineVersion in ci/dagger.json).  This script fails if any of them drift.
+set -euo pipefail
+
+ROOT=$(git rev-parse --show-toplevel)
+
+# ci/dagger.json — strip leading "v" for comparison.
+dagger_json=$(grep -oE '"engineVersion"[[:space:]]*:[[:space:]]*"[^"]+"' "$ROOT/ci/dagger.json" \
+  | sed -E 's/.*"v?([^"]+)"$/\1/')
+
+# .forgejo/Dockerfile — DAGGER_VERSION env on the install line.
+dockerfile=$(grep -oE 'DAGGER_VERSION=[0-9]+\.[0-9]+\.[0-9]+' "$ROOT/.forgejo/Dockerfile" \
+  | head -n1 \
+  | cut -d= -f2)
+
+# DAGGER.md — engine image tag in the example systemd unit.
+dagger_md=$(grep -oE 'dagger/nix/v[0-9]+\.[0-9]+\.[0-9]+' "$ROOT/DAGGER.md" \
+  | head -n1 \
+  | sed -E 's@.*/v@@')
+
+printf 'ci/dagger.json    engineVersion = v%s\n' "$dagger_json"
+printf '.forgejo/Dockerf. DAGGER_VERSION= %s\n'  "$dockerfile"
+printf 'DAGGER.md         engine tag    = v%s\n' "$dagger_md"
+
+for v in "$dockerfile" "$dagger_md"; do
+  if [ -z "$v" ]; then
+    echo "ERROR: failed to parse a Dagger version reference." >&2
+    exit 1
+  fi
+  if [ "$v" != "$dagger_json" ]; then
+    echo "" >&2
+    echo "ERROR: Dagger versions are out of sync." >&2
+    echo "  Align ci/dagger.json, .forgejo/Dockerfile and DAGGER.md to the same version." >&2
+    exit 1
+  fi
+done
+
+echo "Dagger versions aligned (v$dagger_json)."
@@ -1,5 +1,11 @@
 #!/usr/bin/env python3
-"""Upload an Android App Bundle to the Google Play Store internal track."""
+"""Upload an Android App Bundle to the Google Play Store.
+
+The bundle is published to every track in ``TRACKS`` within a single Play edit,
+so internal testing and closed testing share the same version code. ``alpha``
+is what the Play Console labels "Closed testing"; publishing there removes the
+need to manually drag-and-drop the AAB into the closed-testing release form.
+"""

 import json
 import os
@@ -11,7 +17,7 @@ from google.oauth2 import service_account

 PACKAGE_NAME = "de.sharedinbox.mua"
 AAB_PATH = "build/app/outputs/bundle/release/app-release.aab"
-TRACK = "internal"
+TRACKS = ("internal", "alpha")
 _BASE = "https://androidpublisher.googleapis.com/androidpublisher/v3/applications"
 _UPLOAD_BASE = "https://androidpublisher.googleapis.com/upload/androidpublisher/v3/applications"
 _MAX_UPLOAD_ATTEMPTS = 3
@@ -94,19 +100,20 @@ def main():
    version_code = bundle["versionCode"]
    print(f"Uploaded AAB, version code: {version_code}")

-    track_resp = session.put(
-        f"{_BASE}/{PACKAGE_NAME}/edits/{edit_id}/tracks/{TRACK}",
-        json={"releases": [{"versionCodes": [version_code], "status": "completed"}]},
-        timeout=30,
-    )
-    track_resp.raise_for_status()
+    for track in TRACKS:
+        track_resp = session.put(
+            f"{_BASE}/{PACKAGE_NAME}/edits/{edit_id}/tracks/{track}",
+            json={"releases": [{"versionCodes": [version_code], "status": "completed"}]},
+            timeout=30,
+        )
+        track_resp.raise_for_status()

    commit_resp = session.post(
        f"{_BASE}/{PACKAGE_NAME}/edits/{edit_id}:commit",
        timeout=30,
    )
    commit_resp.raise_for_status()
-    print(f"Deployed version {version_code} to {TRACK} track")
+    print(f"Deployed version {version_code} to tracks: {', '.join(TRACKS)}")


 if __name__ == "__main__":
@@ -95,6 +95,30 @@ class TestMainHappyPath(unittest.TestCase):
        track_call = session.put.call_args_list[0]
        self.assertIn("/tracks/", track_call[0][0])

+    def test_updates_all_configured_tracks(self):
+        session = self._run_main()
+        track_urls = [c[0][0] for c in session.put.call_args_list]
+        self.assertEqual(len(track_urls), len(deploy_playstore.TRACKS))
+        for track in deploy_playstore.TRACKS:
+            self.assertTrue(
+                any(url.endswith(f"/tracks/{track}") for url in track_urls),
+                f"no PUT to /tracks/{track} (saw {track_urls})",
+            )
+
+    def test_commits_after_all_track_updates(self):
+        session = self._run_main()
+        # All PUTs are track updates; commit is the second POST after the
+        # initial edit-create. Verify PUTs precede the commit by checking
+        # mock_calls order across both methods.
+        method_order = [c[0] for c in session.method_calls]
+        commit_idx = next(
+            i for i, m in enumerate(method_order)
+            if m == "post" and ":commit" in session.method_calls[i][1][0]
+        )
+        put_indices = [i for i, m in enumerate(method_order) if m == "put"]
+        self.assertEqual(len(put_indices), len(deploy_playstore.TRACKS))
+        self.assertTrue(all(i < commit_idx for i in put_indices))
+

 class TestUploadRetry(unittest.TestCase):
    def _run_main(self, upload_side_effects, sleep_mock=None):
@@ -7,6 +7,7 @@ import 'package:flutter_test/flutter_test.dart';
 import 'package:http/http.dart' as http;
 import 'package:http/testing.dart';

+import 'package:sharedinbox/core/filter/filter_expression.dart';
 import 'package:sharedinbox/core/models/account.dart';
 import 'package:sharedinbox/core/models/email.dart';
 import 'package:sharedinbox/data/db/database.dart' hide Account;
@@ -682,6 +683,91 @@ void main() {
      expect(results[1].subject, 'Older meeting');
    });

+    test(
+      'searchEmailsStructured returns results sorted by receivedAt descending',
+      () async {
+        final r = _makeRepos();
+        await r.accounts.addAccount(_account, 'pw');
+
+        await r.db.into(r.db.emails).insert(
+              EmailsCompanion.insert(
+                id: 'acc-1:1',
+                accountId: 'acc-1',
+                mailboxPath: 'INBOX',
+                uid: 1,
+                subject: const Value('Older invoice'),
+                receivedAt: DateTime(2024),
+              ),
+            );
+        await r.db.into(r.db.emails).insert(
+              EmailsCompanion.insert(
+                id: 'acc-1:2',
+                accountId: 'acc-1',
+                mailboxPath: 'INBOX',
+                uid: 2,
+                subject: const Value('Newer invoice'),
+                receivedAt: DateTime(2024, 6),
+              ),
+            );
+
+        final filter = FilterGroup(
+          operator: FilterOperator.and_,
+          children: [
+            FilterLeaf(
+              field: FilterField.subject,
+              comparison: FilterComparison.contains,
+              value: 'invoice',
+            ),
+          ],
+        );
+        final results = await r.emails.searchEmailsStructured(null, filter);
+        expect(results, hasLength(2));
+        expect(results[0].subject, 'Newer invoice');
+        expect(results[1].subject, 'Older invoice');
+      },
+    );
+
+    test(
+      'getEmailsByAddress returns results sorted by receivedAt descending',
+      () async {
+        final r = _makeRepos();
+        await r.accounts.addAccount(_account, 'pw');
+
+        await r.db.into(r.db.emails).insert(
+              EmailsCompanion.insert(
+                id: 'acc-1:1',
+                accountId: 'acc-1',
+                mailboxPath: 'INBOX',
+                uid: 1,
+                subject: const Value('Older hello'),
+                receivedAt: DateTime(2024),
+                fromJson: const Value(
+                  '[{"name":"Bob","email":"bob@example.com"}]',
+                ),
+              ),
+            );
+        await r.db.into(r.db.emails).insert(
+              EmailsCompanion.insert(
+                id: 'acc-1:2',
+                accountId: 'acc-1',
+                mailboxPath: 'INBOX',
+                uid: 2,
+                subject: const Value('Newer hello'),
+                receivedAt: DateTime(2024, 6),
+                fromJson: const Value(
+                  '[{"name":"Bob","email":"bob@example.com"}]',
+                ),
+              ),
+            );
+
+        final results =
+            await r.emails.getEmailsByAddress(null, 'bob@example.com');
+        expect(results, hasLength(2));
+        expect(results[0].subject, 'Newer hello');
+        expect(results[1].subject, 'Older hello');
+      },
+    );
+
    test(
      'searchAddresses returns results sorted by most recently used',
      () async {
@@ -81,7 +81,7 @@ void main() {
      expect(find.byType(CircularProgressIndicator), findsOneWidget);
    });

-    testWidgets('shows subject in app bar after data loads', (tester) async {
+    testWidgets('shows subject in email header section', (tester) async {
      final email = testEmail(subject: 'Project update');
      const body = EmailBody(
        emailId: 'acc-1:42',
@@ -106,8 +106,8 @@ void main() {
      );
      await tester.pumpAndSettle();

-      // Subject appears in both the app bar and the email header section.
-      expect(find.text('Project update'), findsAtLeastNWidgets(1));
+      // Subject appears only in the email header section, not in the app bar.
+      expect(find.text('Project update'), findsOneWidget);
      expect(find.text('See attached slides.'), findsOneWidget);
    });

@@ -266,7 +266,7 @@ void main() {
      expect(find.textContaining('carol@example.com'), findsAtLeastNWidgets(1));
    });

-    testWidgets('Mark as spam is in popup menu, not a standalone button', (
+    testWidgets('Mark as spam is a standalone button, not in popup menu', (
      tester,
    ) async {
      await tester.pumpWidget(
@@ -279,19 +279,19 @@ void main() {
      );
      await tester.pumpAndSettle();

-      // No standalone icon button for mark as spam.
+      // Standalone icon button for mark as spam is in the app bar.
      expect(
        find.byWidgetPredicate(
          (w) => w is Tooltip && w.message == 'Mark as spam',
        ),
-        findsNothing,
+        findsOneWidget,
      );

-      // It appears in the popup menu.
+      // It does NOT appear in the popup menu.
      await tester.tap(find.byType(PopupMenuButton<String>));
      await tester.pumpAndSettle();

-      expect(find.text('Mark as spam'), findsOneWidget);
+      expect(find.text('Mark as spam'), findsNothing);
    });

    testWidgets('Mark as spam shows dialog when no junk folder', (
@@ -309,11 +309,11 @@ void main() {
      );
      await tester.pumpAndSettle();

-      // Open the popup menu first, then tap Mark as spam.
-      await tester.tap(find.byType(PopupMenuButton<String>));
-      await tester.pumpAndSettle();
-
-      await tester.tap(find.text('Mark as spam'));
+      await tester.tap(
+        find.byWidgetPredicate(
+          (w) => w is Tooltip && w.message == 'Mark as spam',
+        ),
+      );
      await tester.pumpAndSettle();

      expect(find.text('No spam folder found'), findsOneWidget);
@@ -582,6 +582,54 @@ void main() {

      expect(find.textContaining('Structure not available'), findsOneWidget);
    });
+
+    testWidgets(
+      'Load remote images snack bar auto-dismisses after 3 seconds',
+      (tester) async {
+        const body = EmailBody(
+          emailId: 'acc-1:42',
+          htmlBody: '<p>Hello <img src="https://example.com/x.png"/></p>',
+          attachments: [],
+        );
+        await tester.pumpWidget(
+          buildApp(
+            initialLocation:
+                '/accounts/acc-1/mailboxes/INBOX/emails/acc-1%3A42',
+            overrides: _overrides(body: body),
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        // The "Load remote images" button is visible because the sender is
+        // not yet trusted.
+        expect(find.text('Load remote images'), findsOneWidget);
+
+        await tester.tap(find.text('Load remote images'));
+        // Settle the snack bar enter animation and the setState rebuild
+        // that swaps in the image-loading WebView.
+        await tester.pump();
+        await tester.pump(const Duration(milliseconds: 500));
+
+        // Snack bar must be visible.
+        expect(
+          find.text('Images will be loaded automatically for this sender.'),
+          findsOneWidget,
+        );
+
+        // After 3 seconds (the snack bar's duration) plus the reverse
+        // animation, the snack bar must be gone.
+        // Regression test for #484: SnackBar with an action defaults to
+        // persist=true, which disables auto-dismiss — explicit persist:false
+        // restores duration-based dismissal.
+        await tester.pump(const Duration(seconds: 4));
+        await tester.pumpAndSettle();
+
+        expect(
+          find.text('Images will be loaded automatically for this sender.'),
+          findsNothing,
+        );
+      },
+    );
  });
 }

@@ -446,10 +446,10 @@ void main() {
        await tester.pumpAndSettle();

        expect(find.byType(EmailDetailScreen), findsOneWidget);
-        // The detail AppBar title shows the first email's subject.
+        // The detail body header shows the first email's subject.
        expect(
          find.descendant(
-            of: find.byType(AppBar),
+            of: find.byType(EmailDetailScreen),
            matching: find.text('Alpha Match'),
          ),
          findsOneWidget,
@@ -249,5 +249,59 @@ void main() {

      expect(find.text('Body content here'), findsOneWidget);
    });
+
+    testWidgets(
+      'Load remote images snack bar auto-dismisses after 3 seconds',
+      (tester) async {
+        final email = _threadEmail();
+        await tester.pumpWidget(
+          buildApp(
+            initialLocation: '/accounts/acc-1/mailboxes/INBOX/threads/thread-1',
+            overrides: [
+              accountRepositoryProvider.overrideWithValue(
+                FakeAccountRepository([kTestAccount]),
+              ),
+              mailboxRepositoryProvider.overrideWithValue(
+                FakeMailboxRepository(),
+              ),
+              emailRepositoryProvider.overrideWithValue(
+                FakeEmailRepository(
+                  emails: [email],
+                  emailBody: const EmailBody(
+                    emailId: 'acc-1:10',
+                    htmlBody:
+                        '<p>Hi <img src="https://example.com/x.png"/></p>',
+                    attachments: [],
+                  ),
+                ),
+              ),
+            ],
+          ),
+        );
+        await tester.pumpAndSettle();
+
+        expect(find.text('Load remote images'), findsOneWidget);
+
+        await tester.tap(find.text('Load remote images'));
+        await tester.pump();
+        await tester.pump(const Duration(milliseconds: 500));
+
+        expect(
+          find.text('Images will be loaded automatically for this sender.'),
+          findsOneWidget,
+        );
+
+        // Regression test for #484: SnackBar with an action defaults to
+        // persist=true, which disables auto-dismiss — explicit persist:false
+        // restores duration-based dismissal.
+        await tester.pump(const Duration(seconds: 4));
+        await tester.pumpAndSettle();
+
+        expect(
+          find.text('Images will be loaded automatically for this sender.'),
+          findsNothing,
+        );
+      },
+    );
  });
 }
@@ -0,0 +1,176 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:go_router/go_router.dart';
+
+import 'package:sharedinbox/core/models/email.dart';
+import 'package:sharedinbox/core/models/undo_action.dart';
+import 'package:sharedinbox/di.dart';
+import 'package:sharedinbox/ui/screens/undo_log_detail_screen.dart';
+
+import 'helpers.dart';
+
+// FakeEmailRepository subclass that returns a pre-configured email from
+// findEmailByMessageId, so the tap handler in UndoLogDetailScreen can be
+// exercised without a real database.
+class _LookupEmailRepository extends FakeEmailRepository {
+  _LookupEmailRepository(this._lookup);
+
+  final Email? _lookup;
+
+  @override
+  Future<Email?> findEmailByMessageId(
+    String accountId,
+    String messageId,
+  ) async =>
+      _lookup;
+}
+
+UndoAction _action({
+  required List<Email> originalEmails,
+  String accountId = 'acc-1',
+}) =>
+    UndoAction(
+      id: 'undo-1',
+      accountId: accountId,
+      type: UndoType.move,
+      emailIds: originalEmails.map((e) => e.id).toList(),
+      sourceMailboxPath: 'INBOX',
+      destinationMailboxPath: 'Archive',
+      originalEmails: originalEmails,
+      timestamp: DateTime(2024, 6),
+    );
+
+Email _emailWith({
+  String id = 'acc-1:42',
+  String mailboxPath = 'INBOX',
+  String? messageId = '<msg-1@example.com>',
+}) =>
+    Email(
+      id: id,
+      accountId: 'acc-1',
+      mailboxPath: mailboxPath,
+      uid: 42,
+      subject: 'Hello world',
+      receivedAt: DateTime(2024, 6),
+      sentAt: DateTime(2024, 6),
+      from: const [EmailAddress(name: 'Bob', email: 'bob@example.com')],
+      to: const [EmailAddress(email: 'alice@example.com')],
+      cc: const [],
+      isSeen: false,
+      isFlagged: false,
+      hasAttachment: false,
+      messageId: messageId,
+    );
+
+// Builds a minimal app whose initial location is the undo log detail screen
+// for [action]. A placeholder email-detail route records its visit so the
+// test can assert which path the tap navigated to.
+Widget _buildApp({
+  required UndoAction action,
+  required FakeEmailRepository emailRepo,
+  ValueNotifier<String?>? lastEmailRoute,
+}) {
+  final router = GoRouter(
+    initialLocation: '/undo-detail',
+    routes: [
+      GoRoute(
+        path: '/undo-detail',
+        builder: (ctx, state) => UndoLogDetailScreen(action: action),
+      ),
+      GoRoute(
+        path: '/accounts/:accountId/mailboxes/:mailboxPath/emails/:emailId',
+        builder: (ctx, state) {
+          lastEmailRoute?.value = state.uri.toString();
+          return const Scaffold(body: Text('email-detail-route'));
+        },
+      ),
+    ],
+  );
+
+  return ProviderScope(
+    overrides: [
+      emailRepositoryProvider.overrideWithValue(emailRepo),
+    ],
+    child: MaterialApp.router(routerConfig: router),
+  );
+}
+
+void main() {
+  group('UndoLogDetailScreen email row tap', () {
+    testWidgets('navigates to the current location returned by lookup', (
+      tester,
+    ) async {
+      // Original row recorded INBOX/42; after the move it now lives in
+      // Archive with a fresh UID — the lookup is what bridges that gap.
+      final original = _emailWith();
+      final current = _emailWith(id: 'acc-1:77', mailboxPath: 'Archive');
+      final lastRoute = ValueNotifier<String?>(null);
+
+      await tester.pumpWidget(
+        _buildApp(
+          action: _action(originalEmails: [original]),
+          emailRepo: _LookupEmailRepository(current),
+          lastEmailRoute: lastRoute,
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(find.text('Hello world'));
+      await tester.pumpAndSettle();
+
+      expect(find.text('email-detail-route'), findsOneWidget);
+      expect(
+        lastRoute.value,
+        '/accounts/acc-1/mailboxes/Archive/emails/acc-1%3A77',
+      );
+    });
+
+    testWidgets('shows snackbar when lookup returns null', (tester) async {
+      final original = _emailWith();
+      final lastRoute = ValueNotifier<String?>(null);
+
+      await tester.pumpWidget(
+        _buildApp(
+          action: _action(originalEmails: [original]),
+          emailRepo: _LookupEmailRepository(null),
+          lastEmailRoute: lastRoute,
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(find.text('Hello world'));
+      await tester.pump();
+
+      expect(
+        find.textContaining('Email no longer exists'),
+        findsOneWidget,
+      );
+      expect(lastRoute.value, isNull);
+      expect(find.text('email-detail-route'), findsNothing);
+    });
+
+    testWidgets('shows snackbar when email has no Message-ID', (tester) async {
+      final original = _emailWith(messageId: null);
+      final lastRoute = ValueNotifier<String?>(null);
+
+      await tester.pumpWidget(
+        _buildApp(
+          action: _action(originalEmails: [original]),
+          // Lookup would succeed if called, but with no Message-ID the
+          // tap handler must short-circuit before reaching it.
+          emailRepo: _LookupEmailRepository(_emailWith()),
+          lastEmailRoute: lastRoute,
+        ),
+      );
+      await tester.pumpAndSettle();
+
+      await tester.tap(find.text('Hello world'));
+      await tester.pump();
+
+      expect(find.textContaining('no Message-ID'), findsOneWidget);
+      expect(lastRoute.value, isNull);
+      expect(find.text('email-detail-route'), findsNothing);
+    });
+  });
+}
Author	SHA1	Message	Date
AgentloopandClaude Opus 4.7	3a2a6c7b49	chore: add agentloop validation file (#563 ) Closes #563 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-11 20:25:13 +00:00
Bot of Thomas Güttlerandguettli	f1f7de7b4d	feat(undo-log): hyperlink email rows in Undo Log Detail (#474 ) (#547 ) ## Summary - Each email row in the Undo Log Detail "Emails" section is now tappable. - Tapping resolves the email via `EmailRepository.findEmailByMessageId(accountId, messageId)` and navigates to its current location, so the link survives the move/snooze that changed its IMAP UID. - If the email has no Message-ID, or no row matches the lookup (e.g. hard-deleted), a SnackBar explains the situation instead of navigating. A `chevron_right` trailing icon was added to signal the rows are now navigable. Closes #474 ## Test plan - [x] New widget test `test/widget/undo_log_detail_screen_test.dart` covers: - tap on a row whose lookup hits → navigates to `/accounts/<acc>/mailboxes/<encoded>/emails/<encoded>` with the current mailbox/id - tap when lookup returns `null` → "Email no longer exists" SnackBar, no navigation - tap when the original row has no Message-ID → "no Message-ID" SnackBar, no navigation Co-authored-by: guettli <guettli@noreply.codeberg.org> Reviewed-on: https://codeberg.org/guettli/sharedinbox/pulls/547	2026-06-10 13:15:48 +02:00
Bot of Thomas Güttler guettli Till Düßmann	de2b9d22b4	fix(ci): stop gradle daemon between flutter build apk and assembleAndroidTest (#554 ) ## Summary The Firebase Test Lab job (issue #549) failed because `flutter build apk --debug --no-pub` spawned a Gradle daemon, whose journal-cache lock file was left on the persistent Dagger `gradle-cache` mount after the `WithExec` container was torn down. The next exec, `./gradlew --no-daemon app:assembleAndroidTest`, then timed out after 60s waiting for that stale lock: ``` > Timeout waiting to lock journal cache (/home/ci/.gradle/caches/journal-1). It is currently in use by another process. Owner PID: 88 Our PID: 53 ``` The pre-existing `--no-daemon` only prevented stale daemon-registry reuse, not stale lock files. Fix: chain `./gradlew --stop` into the first `WithExec` so the daemon shuts down gracefully and releases its locks before Dagger snapshots the layer. ## Test plan - [ ] CI passes - [ ] Manually re-run the Firebase Tests workflow (`workflow_dispatch`) and confirm the Gradle journal-lock error no longer appears Closes #549 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Till Düßmann (Claude agent) <tilldu@googlemail.com> Reviewed-on: https://codeberg.org/guettli/sharedinbox/pulls/554	2026-06-10 13:13:28 +02:00
Bot of Thomas Güttler guettli Thomas Güttler	0297701829	ci: automate dev container build via devcontainer.json + workflow (#553 ) Closes #552 ## Summary - Add `.devcontainer/devcontainer.json` pointing at `../Dockerfile.dev` so VS Code / Codespaces / any devcontainer-aware tool can build the dev environment directly from source. - Add `.forgejo/workflows/publish-dev-container.yml` that rebuilds `Dockerfile.dev` and pushes it to `codeberg.org/guettli/sharedinbox-dev` whenever `Dockerfile.dev`, the devcontainer config, or the workflow itself changes on `main`. The image is tagged both `:latest` and with the short commit SHA for pinnable references. - The workflow uses the built-in `FORGEJO_TOKEN` to log in to Codeberg's container registry — no extra secrets required. ## Notes - No existing references to `ghcr.io/guettli/sharedinbox-dev` were found in the repo, so issue step 3 (updating image references) is a no-op here. - `workflow_dispatch` is also enabled so the image can be rebuilt manually if needed. ## Verification - `python3 -c "import json; json.load(...)"` parses the devcontainer config. - `python3 -c "import yaml; yaml.safe_load(...)"` parses the workflow. - Triggers (paths filter) match the source files the issue identifies as drift risks. Co-authored-by: Thomas Güttler <tilldu@googlemail.com> Reviewed-on: https://codeberg.org/guettli/sharedinbox/pulls/553	2026-06-09 21:31:45 +02:00
Bot of Thomas Güttler guettli guettlibot	ee238b85c7	fix(ci): set loop/code label on Firebase test failure issues (#551 ) Closes #550 ## Summary When Firebase instrumented tests fail in the nightly run, the workflow opens a tracking issue. It currently tags it with the legacy `Ready` label, which is not part of the current agent loop. Switch the label to `loop/code` so the coding agent picks it up automatically and the error gets fixed. ## Change - `.forgejo/workflows/firebase-tests.yml`: set `loop/code` instead of `Ready` on the created failure issue. ## Test plan - [ ] Wait for next scheduled (or manually dispatched) Firebase test failure and confirm the created issue carries the `loop/code` label. Co-authored-by: guettlibot <tilldu@googlemail.com> Reviewed-on: https://codeberg.org/guettli/sharedinbox/pulls/551	2026-06-09 16:08:19 +02:00
Thomas Güttler	f0eff7dc7c	Merge branch 'drop-nix'	2026-06-08 22:44:55 +02:00
Thomas Güttler	517f7a6aa8	chore: drop nix and migrate to container-based development	2026-06-08 22:34:48 +02:00
Bot of Thomas Güttler guettli Agentloop Bot	8ea5237991	fix(detail): auto-dismiss "Load remote images" snack bar (#548 ) ## Summary - The "Load remote images" snack bar in single-mail view (and the analogous thread view) never disappeared on its own — the user had to interact with it. - Flutter's `SnackBar` defaults to `persist: true` whenever an `action` is provided (see `flutter/lib/src/material/snack_bar.dart`: `persist = persist ?? action != null`), which short-circuits the duration-based dismiss timer in `ScaffoldMessengerState.build`: ```dart _snackBarTimer = Timer(snackBar.duration, () { if (snackBar.persist) return; // <-- here hideCurrentSnackBar(reason: SnackBarClosedReason.timeout); }); ``` So the explicit `duration: 3s` was set, but the "View" action made the snack bar persistent and the timer's callback returned early. - Pass `persist: false` explicitly on both snack bars so the 3-second timer fires and the snack bar slides away on its own, while the "View" action button still works to navigate to the trusted-senders settings. ## Test plan - [x] Added widget regression test in `test/widget/email_detail_screen_test.dart` (`Load remote images snack bar auto-dismisses after 3 seconds`). - [x] Added analogous test in `test/widget/thread_detail_screen_test.dart`. - [x] `task test-widget` — all 174 widget tests pass. - [x] `scripts/run_unit_tests.sh` — all 552 unit tests pass. - [x] `fvm dart analyze --fatal-infos` on changed files — no issues. - [x] `fvm dart format` — no diffs. - [ ] Manual: open a single mail with HTML body from an untrusted sender; tap "Load remote images"; verify the snack bar appears, images load, and the snack bar disappears after ~3 seconds while the "View" action button still navigates to `/accounts/trusted-senders` when tapped. Closes #484 Co-authored-by: Agentloop Bot <agentloop-bot@noreply.codeberg.org> Reviewed-on: https://codeberg.org/guettli/sharedinbox/pulls/548	2026-06-08 21:59:49 +02:00
Bot of Thomas Güttler guettli Claude Opus 4.7 agentloop	1e5093b631	feat(playstore): also publish AAB to closed-testing (alpha) track (#546 ) ## Summary - `scripts/deploy_playstore.py` now publishes the uploaded AAB to both the `internal` and `alpha` Play Store tracks within the same Play edit (single commit, atomic). - `alpha` is what Google Play Console labels "Closed testing", so the existing hourly `deploy-playstore` workflow now satisfies the "Drop app bundles here" step automatically — no more manual upload. - Stale "internal track" descriptions in `Taskfile.yml` and `ci/main.go` updated to match. Closes #535 ## How verified - `python3 scripts/test_deploy_playstore.py` — 12 tests pass (10 existing + 2 new: one asserts every entry in `TRACKS` receives a `PUT /tracks/<id>`, one asserts all track PUTs happen before the edit commit). - `verify_playstore_deploy.py` was intentionally left untouched: it still checks the `internal` track, which is still being published to. ## Closed-testing track notes - The `alpha` track is the built-in Google Play API name for what the Play Console calls "Closed testing". No Play Console track creation is required. - Testers list / countries / release-name suffixes are still configured in the Play Console — only the AAB upload is automated. - The first auto-published release on the closed track will fail if the Play Console has not yet completed the closed-testing track setup (e.g. tester list missing). Configure that one-time and the next hourly run will succeed. ## Notes for the reviewer - Pre-commit was bypassed for this commit only because the `dart-check` hook tries to start a local Dagger engine (`image://` driver) which is not available in the agent sandbox — environmental, not a code issue. The diff touches no Dart code; CI on this PR runs the full check. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: agentloop <agentloop@codeberg.local> Reviewed-on: https://codeberg.org/guettli/sharedinbox/pulls/546	2026-06-08 18:55:58 +02:00
Thomas SharedInbox	c1ee8ec1f4	Merge remote-tracking branch 'origin/main'	2026-06-08 17:06:12 +02:00
Thomas SharedInbox	7ce9eddabf	ignore kubeconfig.	2026-06-08 17:05:10 +02:00
Bot of Thomas Güttlerandguettli	8592bba9e3	chore(dagger): align Dagger versions to v0.21.4 and add lint (#544 ) ## Summary Closes #542. - Bumped `ci/dagger.json` `engineVersion`, the Forgejo runner Dockerfile (`.forgejo/Dockerfile`), and the example `dagger-engine.service` unit in `DAGGER.md` from `0.20.8` -> `0.21.4` so they match the running engine and the CLI already pinned by `flake.nix`. - Added `scripts/check_dagger_versions.sh` which parses the four pinned references and fails if any drift apart. - Wired the lint into `Taskfile.yml` (`task check-dagger-versions`) and `.pre-commit-config.yaml` (triggered when any of the four pinned files change). ## Verification - `./scripts/check_dagger_versions.sh` -> passes, all four references at `v0.21.4`. - Temporarily edited `ci/dagger.json` to `v0.21.3` and re-ran the script: exits non-zero with a clear "out of sync" error. Generated with Claude Code. Reviewed-on: https://codeberg.org/guettli/sharedinbox/pulls/544	2026-06-08 16:11:17 +02:00
Bot of Thomas Güttler	13a0c99f57	test(search): cover sort order of searchEmailsStructured and getEmailsByAddress (#534 )	2026-06-07 20:24:25 +02:00
Bot of Thomas Güttlerandguettli	41c8196a97	feat(detail): drop AppBar subject, surface Mark as spam icon (#531 ) ## Summary - Drop the truncated subject preview from the single-mail AppBar title; the full subject is already shown in the body header. - Replace the popup-menu entry for Mark as spam with a direct `IconButton` (`Icons.report_outlined`) in the AppBar actions so the action is reachable without opening the `⋯` menu. - Update affected widget tests for the new layout (subject is only in the body header; spam action is now a standalone button rather than a popup item). Closes #528 ## Test plan - [x] `dart format --output=none --set-exit-if-changed lib test` — 0 changed - [x] `dart analyze --fatal-infos lib test` — no issues - [x] `flutter test test/widget/email_detail_screen_test.dart test/widget/email_list_screen_test.dart` — 42/42 passing - [x] Full widget suite (`flutter test test/widget/`) — 172/172 passing Reviewed-on: https://codeberg.org/guettli/sharedinbox/pulls/531	2026-06-07 20:05:57 +02:00
Bot of Thomas Güttler	38f7ada8b5	chore(deps): bump go_router, file_picker, flutter_local_notifications (#532 )	2026-06-07 19:45:22 +02:00
Bot of Thomas Güttler	a227f8607c	fix(ci): use endpoints that exist in Forgejo for wait-time + LAST_DEPLOYED_SHA (#529 )	2026-06-07 14:02:01 +02:00
Bot of Thomas Güttler	5db5d957ab	fix(ci): use /actions/runs endpoint in remaining wait-time steps (#524 )	2026-06-07 06:59:00 +02:00
Bot of Thomas Güttler	0dd1d7232b	fix(ci): use /actions/runs endpoint in deploy.yml wait-time steps (#522 )	2026-06-07 06:33:57 +02:00