Merge branch 'feat/desktop-offline' into feat/do-policy-fixes

.env.example

@@ -366,6 +366,9 @@ LOGIN_WEBSITE_URL=https://bulwarkmail.org
 # that authenticate API tokens as Bearer tokens instead of passwords, such
 # as Fastmail (JMAP_SERVER_URL=https://api.fastmail.com).
 # LOGIN_SHOW_TOKEN_LOGIN=true
+# The desktop app's "Sign in with your browser" through this login page. On by default.
+# Turn it off on a terminal server: another user there could send a link asking for a sign-in.
+# DESKTOP_BROWSER_SIGN_IN=false
 #
 # Show the "Remember me" box (default false). Without it every sign-in is
 # remembered, provided SESSION_SECRET is set. The box also decides for SSO

.github/workflows/tests.yml

@@ -67,3 +67,26 @@ jobs:
 
       - name: Lint
         run: npm run lint
+
+  # The build the release tarball and a manual install use, with its guard at
+  # the end. Docker and the Lite images build another way (webpack, export), so
+  # nothing else would notice this one breaking before a release does.
+  standalone-build:
+    name: Standalone build and guard
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build

app/(main)/[locale]/auth/callback/page.tsx

@@ -1,8 +1,6 @@
 "use client";
 
 import { Suspense, useEffect, useRef, useState } from "react";
-import { IS_DESKTOP_BUILD } from "@/lib/desktop/flag";
-import { DESKTOP_CLIENT_ID_KEY, DESKTOP_REDIRECT_URI_KEY } from "@/lib/desktop/browser-sign-in";
 import { useRouter, useSearchParams } from "next/navigation";
 import { useTranslations } from "next-intl";
 import { useAuthStore } from "@/stores/auth-store";
@@ -12,8 +10,8 @@ import { LITE_OAUTH_AVAILABLE, getLiteOAuthRedirectUri } from "@/lib/auth/lite-o
 import { AlertCircle } from "@/components/icons";
 import { Button } from "@/components/ui/button";
 import { useParams } from "next/navigation";
-import { buildMobileHandoffUrl, mobileHandoffTarget } from "@/lib/auth/mobile-handoff";
-import { confirmMobileHandoffCodeUrl } from "@/lib/auth/mobile-handoff-client";
+import { buildMobileHandoffUrl, desktopHandoffDeclineUrl, desktopHandoffPort, desktopHandoffTarget, handoffTarget } from "@/lib/auth/mobile-handoff";
+import { confirmMobileHandoffCodeUrl, discardDesktopSignIn } from "@/lib/auth/mobile-handoff-client";
 import { MobileHandoffConsent } from "@/components/auth/mobile-handoff-consent";
 import { MailSkeleton } from "@/components/boot-skeleton/mail-skeleton";
 import { useSkeletonLabels } from "@/components/boot-skeleton/use-skeleton-labels";
@@ -32,7 +30,21 @@ function OAuthCallbackInner() {
     url: string | null;
     resolveUrl?: () => Promise<string | null>;
     username: string;
+    /** The desktop app's: what ends it, if the user says no or leaves. */
+    desktop?: { code: string; target: string; state: string };
   } | null>(null);
+  // Unanswered, and the tab goes: the tokens the server parked go too. A yes has left this
+  // to the app, and "Not now" has already said.
+  const desktopPending = pendingHandoff?.desktop;
+  const desktopAnswered = useRef(false);
+  useEffect(() => {
+    if (!desktopPending) return;
+    const leave = () => {
+      if (!desktopAnswered.current) discardDesktopSignIn(desktopPending.code);
+    };
+    window.addEventListener("pagehide", leave);
+    return () => window.removeEventListener("pagehide", leave);
+  }, [desktopPending]);
   // The authorization code is single-use. React's development double effect
   // ran this twice: the second pass no longer saw the pairing re-auth flag
   // (the first had removed it) and spent the code on the login flow instead.
@@ -118,12 +130,9 @@ function OAuthCallbackInner() {
       const prefix = getPathPrefix(params.locale as string);
       // Lite on Stalwart registers one locale-free URI (lib/auth/lite-oauth.ts);
       // the entry document brought us here from it.
-      // The desktop app's browser sign-in redirected to its loopback listener
-      // (lib/desktop/browser-sign-in.ts), which this page's origin can't tell.
-      const desktopRedirectUri = IS_DESKTOP_BUILD ? sessionStorage.getItem(DESKTOP_REDIRECT_URI_KEY) : null;
-      const redirectUri = desktopRedirectUri ?? (LITE_OAUTH_AVAILABLE
+      const redirectUri = LITE_OAUTH_AVAILABLE
         ? getLiteOAuthRedirectUri()
-        : `${window.location.origin}${prefix}/${params.locale}/auth/callback`);
+        : `${window.location.origin}${prefix}/${params.locale}/auth/callback`;
 
       loginWithOAuth(serverUrl, code, codeVerifier, redirectUri, serverId)
         .then((success) => {
@@ -133,10 +142,6 @@ function OAuthCallbackInner() {
             sessionStorage.removeItem("oauth_server_url");
             sessionStorage.removeItem("oauth_server_id");
             sessionStorage.removeItem("oauth_add_account_mode");
-            if (IS_DESKTOP_BUILD) {
-              sessionStorage.removeItem(DESKTOP_REDIRECT_URI_KEY);
-              sessionStorage.removeItem(DESKTOP_CLIENT_ID_KEY);
-            }
             let redirectTo = `${prefix}/${params.locale}`;
             try {
               const saved = sessionStorage.getItem('redirect_after_login');
@@ -160,7 +165,7 @@ function OAuthCallbackInner() {
       let mobileRedirectUri = "";
       let mobileState: string | null = null;
       try {
-        mobileRedirectUri = mobileHandoffTarget(sessionStorage.getItem("mobile_redirect_uri"));
+        mobileRedirectUri = handoffTarget(sessionStorage.getItem("mobile_redirect_uri"));
         mobileState = sessionStorage.getItem("mobile_state");
       } catch { /* sessionStorage may be unavailable */ }
 
@@ -193,14 +198,22 @@ function OAuthCallbackInner() {
                 sessionStorage.removeItem("mobile_redirect_uri");
                 sessionStorage.removeItem("mobile_state");
               } catch { /* ignore */ }
+              const desktopTarget = desktopHandoffTarget(mobileRedirectUri);
               setPendingHandoff({
                 url: null,
-                resolveUrl: () => confirmMobileHandoffCodeUrl({
-                  target: mobileRedirectUri,
-                  code: handoffCode,
-                  state: handoffState,
-                }),
-                username: typeof data.server_url === "string" ? data.server_url : "",
+                resolveUrl: () => {
+                  desktopAnswered.current = true;
+                  return confirmMobileHandoffCodeUrl({
+                    target: mobileRedirectUri,
+                    code: handoffCode,
+                    state: handoffState,
+                  });
+                },
+                ...(desktopTarget ? { desktop: { code: handoffCode, target: desktopTarget, state: handoffState } } : {}),
+                // Who is being handed over, where the server could say. Its address otherwise.
+                username: desktopTarget && typeof data.account === "string" && data.account
+                  ? data.account
+                  : typeof data.server_url === "string" ? data.server_url : "",
               });
               return;
             }
@@ -275,12 +288,22 @@ function OAuthCallbackInner() {
           url={pendingHandoff.url}
           resolveUrl={pendingHandoff.resolveUrl ?? null}
           username={pendingHandoff.username}
+          desktopPort={pendingHandoff.desktop ? desktopHandoffPort(pendingHandoff.desktop.target) : undefined}
           onError={() => {
             setPendingHandoff(null);
             setError("token_exchange_failed");
           }}
           onCancel={() => {
+            const desktop = pendingHandoff.desktop;
             setPendingHandoff(null);
+            if (desktop) {
+              // Ends the flow here and at the app. A plain login page from here would be a way
+              // to get a browser session nobody asked for.
+              desktopAnswered.current = true;
+              discardDesktopSignIn(desktop.code);
+              window.location.replace(desktopHandoffDeclineUrl(desktop.target, desktop.state));
+              return;
+            }
             router.push(toRouterPath(`${getPathPrefix(params.locale as string)}/${params.locale}/login`));
           }}
         />

app/(main)/[locale]/layout.tsx

@@ -31,6 +31,7 @@ import { OfflineHost } from "@/components/offline/offline-host";
 import { DeviceWipeHost } from "@/components/offline/device-wipe-host";
 import { NotificationActionsHost } from "@/components/providers/notification-actions-host";
 import { DesktopOsHost } from "@/components/desktop/desktop-os-host";
+import { EditedFilesHost } from "@/components/desktop/edited-files-host";
 import { DevicePolicyHost } from "@/components/device/device-policy-host";
 import { PushNotificationPrompt } from "@/components/push-notification-prompt";
 import { AccountArchiveRestorePrompt } from "@/components/account-archive-prompt";
@@ -92,6 +93,7 @@ export default async function LocaleLayout({
                     <ImpersonationReconciler />
                     <PushBindingsHost />
                     <DesktopOsHost />
+                    {!IS_LITE && <EditedFilesHost />}
                     <FreeBusyAutoShare />
                     {!IS_LITE && <PopoutHost />}
                   </MainWindowOnly>

app/(main)/[locale]/login/__tests__/login-page-desktop-policy.test.tsx

@@ -6,9 +6,11 @@ import { EMPTY_POLICY_LAYERS, resolvePolicies } from '@/lib/desktop/policy-schem
 
 // The device's OS policy on the two ways into SSO: nothing starts towards a refused server.
 
+const params = vi.hoisted(() => ({ value: null as URLSearchParams | null }));
+
 vi.mock('next/navigation', () => ({
   useParams: () => ({ locale: 'en' }),
-  useSearchParams: () => new URLSearchParams(),
+  useSearchParams: () => params.value ?? new URLSearchParams(),
   useRouter: () => ({ push: vi.fn(), replace: vi.fn(), prefetch: vi.fn() }),
   usePathname: () => '/login',
 }));
@@ -30,6 +32,7 @@ vi.mock('@/hooks/use-config', () => ({
     oauthEnabled: true,
     oauthOnly: true,
     oauthClientId: 'webmail',
+    desktopBrowserSignIn: true,
     ...configOverrides.value,
   }),
 }));
@@ -56,6 +59,7 @@ let fetched: string[];
 
 beforeEach(() => {
   configOverrides.value = {};
+  params.value = null;
   fetched = [];
   sessionStorage.clear();
   vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL) => {
@@ -110,3 +114,243 @@ describe('automatic SSO', () => {
     await waitFor(() => expect(startedSso()).toBe(true), { timeout: 10000 });
   }, 30_000);
 });
+
+describe('sign-in with the browser, in the app', () => {
+  const REDIRECT = 'http://127.0.0.1:51234/bulwark-desktop/callback';
+
+  function appBridge(options: { servers?: string[]; browserSignIn?: boolean; complete?: () => unknown } = {}) {
+    const forced: Record<string, unknown> = {};
+    if (options.servers) forced.AllowedJmapServers = options.servers;
+    if (options.browserSignIn !== undefined) forced.BrowserSignIn = options.browserSignIn;
+    const snapshot = resolvePolicies({ ...EMPTY_POLICY_LAYERS, forcedMachine: forced });
+    const controls = {
+      begin: vi.fn(async () => ({ ok: true, flowId: 'f1', redirectUri: REDIRECT, state: 'main-state' })),
+      complete: vi.fn(async () => (options.complete ? options.complete() : { ok: false, error: 'cancelled' })),
+      cancel: vi.fn(),
+    };
+    window.bulwarkDesktop = {
+      version: 1,
+      platform: 'win32',
+      mode: 'instance',
+      auth: { claim: () => controls },
+      policy: { get: () => snapshot, onChange: () => () => {} },
+    } as unknown as BulwarkDesktopBridge;
+    return controls;
+  }
+
+  const browserButton = () => screen.findByTestId('desktop-browser-sign-in', {}, { timeout: 10000 });
+
+  it('stays the other choice next to the form', async () => {
+    configOverrides.value = { oauthEnabled: false, oauthOnly: false };
+    appBridge();
+    render(<LoginPage />);
+    expect((await browserButton()).textContent).toContain('button');
+    expect(document.getElementById('username')).not.toBeNull();
+    expect(document.getElementById('password')).not.toBeNull();
+  }, 30_000);
+
+  it('is the main way in on an OAuth-only instance, with no form', async () => {
+    appBridge();
+    render(<LoginPage />);
+    await browserButton();
+    expect(document.getElementById('password')).toBeNull();
+    expect(await ssoButton()).toBeInTheDocument();
+  }, 30_000);
+
+  it('is gone when a policy says so, and the form stays', async () => {
+    configOverrides.value = { oauthEnabled: false, oauthOnly: false };
+    appBridge({ browserSignIn: false });
+    render(<LoginPage />);
+    await waitFor(() => expect(document.getElementById('password')).not.toBeNull(), { timeout: 10000 });
+    expect(screen.queryByTestId('desktop-browser-sign-in')).toBeNull();
+  }, 30_000);
+
+  it('is gone when the instance\'s admin turned it off', async () => {
+    configOverrides.value = { oauthEnabled: false, oauthOnly: false, desktopBrowserSignIn: false };
+    appBridge();
+    render(<LoginPage />);
+    await waitFor(() => expect(document.getElementById('password')).not.toBeNull(), { timeout: 10000 });
+    expect(screen.queryByTestId('desktop-browser-sign-in')).toBeNull();
+  }, 30_000);
+
+  it('is not there in a browser', async () => {
+    configOverrides.value = { oauthEnabled: false, oauthOnly: false };
+    render(<LoginPage />);
+    await waitFor(() => expect(document.getElementById('password')).not.toBeNull(), { timeout: 10000 });
+    expect(screen.queryByTestId('desktop-browser-sign-in')).toBeNull();
+  }, 30_000);
+
+  it('starts nothing towards a server off the list, and says why', async () => {
+    const controls = appBridge({ servers: ['https://other.example.org'] });
+    render(<LoginPage />);
+    fireEvent.click(await browserButton());
+    expect(await screen.findByText('server_refused')).toBeInTheDocument();
+    expect(controls.begin).not.toHaveBeenCalled();
+  }, 30_000);
+
+  it('a flow that ran out says so, and the button comes back', async () => {
+    const controls = appBridge({ complete: () => ({ ok: false, error: 'timeout' }) });
+    render(<LoginPage />);
+    fireEvent.click(await browserButton());
+    expect(await screen.findByText('timed_out')).toBeInTheDocument();
+    expect(controls.complete).toHaveBeenCalledOnce();
+    expect(await browserButton()).not.toBeDisabled();
+  }, 30_000);
+
+  it('a forced server says no to a server of the user\'s own, in what it asks the instance', async () => {
+    const snapshot = resolvePolicies({ ...EMPTY_POLICY_LAYERS, forcedMachine: { InstanceUrl: 'https://bulwark.example.org' } });
+    const controls = appBridge({ complete: () => ({ ok: true, code: 'c'.repeat(64), state: 'main-state' }) });
+    window.bulwarkDesktop = {
+      version: 1,
+      platform: 'win32',
+      mode: 'instance',
+      auth: { claim: () => controls },
+      policy: { get: () => snapshot, onChange: () => () => {} },
+    } as unknown as BulwarkDesktopBridge;
+    let sent: Record<string, unknown> | null = null;
+    vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      if (url.includes('/api/auth/oauth/metadata')) return new Response(JSON.stringify(METADATA), { status: 200 });
+      if (url.includes('/api/auth/desktop-handoff/redeem')) {
+        sent = JSON.parse(String(init?.body));
+        return new Response(JSON.stringify({ error: 'blocked_by_policy' }), { status: 403 });
+      }
+      return new Response('{}', { status: 200 });
+    }));
+    render(<LoginPage />);
+    fireEvent.click(await browserButton());
+    await waitFor(() => expect(sent).toMatchObject({ custom_servers_allowed: false }));
+  }, 30_000);
+
+  it('asks the instance with the device\'s list, and a refusal is the policy\'s notice', async () => {
+    appBridge({ servers: ['https://mail.example.org'], complete: () => ({ ok: true, code: 'c'.repeat(64), state: 'main-state' }) });
+    vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      fetched.push(url);
+      if (url.includes('/api/auth/oauth/metadata')) return new Response(JSON.stringify(METADATA), { status: 200 });
+      if (url.includes('/api/auth/desktop-handoff/redeem')) {
+        // The same rule as the field for a server of one's own, on an instance with a server of its own.
+        expect(JSON.parse(String(init?.body))).toMatchObject({ allowed_servers: ['https://mail.example.org'], custom_servers_allowed: true });
+        return new Response(JSON.stringify({ error: 'blocked_by_policy' }), { status: 403 });
+      }
+      return new Response('{}', { status: 200 });
+    }));
+    render(<LoginPage />);
+    fireEvent.click(await browserButton());
+    expect(await screen.findByText('server_refused')).toBeInTheDocument();
+    expect(fetched.some((url) => url.includes('/api/auth/desktop-handoff/redeem'))).toBe(true);
+  }, 30_000);
+});
+
+describe('the page the app opens in the browser', () => {
+  const CHALLENGE = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
+  const search = (entries: Record<string, string>) => new URLSearchParams(entries);
+
+  function handoffPage(checkAnswer: () => Response = () => new Response('{"ok":true}', { status: 200 }), parkAnswer: () => Response = () => new Response(JSON.stringify({ code: 'a'.repeat(64) }), { status: 200 })) {
+    configOverrides.value = { oauthEnabled: false, oauthOnly: false, loginShowTotp: true };
+    params.value = search({ mobile_redirect_uri: 'http://127.0.0.1:51234/bulwark-desktop/callback', mobile_state: 's', mobile_code_challenge: CHALLENGE });
+    const parks: Record<string, unknown>[] = [];
+    vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      fetched.push(url);
+      if (url.includes('/api/auth/desktop-handoff/check')) return checkAnswer();
+      if (url.includes('/api/auth/desktop-handoff/park')) {
+        parks.push(JSON.parse(String(init?.body)));
+        return parkAnswer();
+      }
+      return new Response('{}', { status: 200 });
+    }));
+    return parks;
+  }
+
+  async function submit(totp?: string) {
+    render(<LoginPage />);
+    await screen.findByTestId('desktop-handoff-banner', {}, { timeout: 10000 });
+    fireEvent.change(document.getElementById('username')!, { target: { value: 'a@example.org' } });
+    fireEvent.change(document.getElementById('password')!, { target: { value: 'secret' } });
+    if (totp) {
+      fireEvent.click(screen.getByText('totp_toggle'));
+      fireEvent.change(await screen.findByLabelText('totp_label'), { target: { value: totp } });
+    }
+    fireEvent.submit(document.getElementById('password')!.closest('form')!);
+  }
+
+  it('holds the password until the yes: checked first, parked only then, with no browser session', async () => {
+    const parks = handoffPage();
+    await submit();
+    expect(await screen.findByText('consent_title')).toBeInTheDocument();
+    expect(parks).toEqual([]);
+    expect(fetched.filter((url) => url.includes('/desktop-handoff/check'))).toHaveLength(1);
+    fireEvent.click(screen.getByRole('button', { name: 'consent_confirm' }));
+    await waitFor(() => expect(parks).toHaveLength(1));
+    expect(parks[0]).toMatchObject({ code_challenge: CHALLENGE, state: 's', username: 'a@example.org', password: 'secret' });
+    // No session anywhere: nothing went to the routes a browser sign-in writes cookies from.
+    expect(fetched.some((url) => /api\/auth\/(session|verify|token)/.test(url))).toBe(false);
+  }, 30_000);
+
+  it('"Not now" parks nothing', async () => {
+    const parks = handoffPage();
+    await submit();
+    fireEvent.click(await screen.findByRole('button', { name: 'consent_cancel' }));
+    await waitFor(() => expect(screen.queryByText('consent_title')).toBeNull());
+    expect(parks).toEqual([]);
+  }, 30_000);
+
+  it('a two-factor code is not spent before the yes, as it works once', async () => {
+    const parks = handoffPage();
+    await submit('123456');
+    expect(await screen.findByText('consent_title')).toBeInTheDocument();
+    expect(parks).toEqual([]);
+    expect(fetched.some((url) => url.includes('/desktop-handoff/check'))).toBe(false);
+    fireEvent.click(screen.getByRole('button', { name: 'consent_confirm' }));
+    await waitFor(() => expect(parks).toHaveLength(1));
+    expect(parks[0]).toMatchObject({ totp: '123456' });
+  }, 30_000);
+
+  it('a wrong password stays on the form, with no question', async () => {
+    const parks = handoffPage(() => new Response(JSON.stringify({ error: 'invalid_credentials' }), { status: 401 }));
+    await submit();
+    expect(await screen.findByText('error.invalid_credentials')).toBeInTheDocument();
+    expect(screen.queryByText('consent_title')).toBeNull();
+    expect(parks).toEqual([]);
+  }, 30_000);
+
+  it('too many attempts says so, and not that something broke', async () => {
+    handoffPage(() => new Response(JSON.stringify({ error: 'too_many_attempts' }), { status: 429 }));
+    await submit();
+    expect(await screen.findByText('too_many')).toBeInTheDocument();
+    expect(screen.queryByText('error.server_error')).toBeNull();
+  }, 30_000);
+
+  it('a failure at the yes goes back to the form and says why', async () => {
+    handoffPage(undefined, () => new Response(JSON.stringify({ error: 'invalid_credentials' }), { status: 401 }));
+    await submit('000000');
+    fireEvent.click(await screen.findByRole('button', { name: 'consent_confirm' }));
+    await waitFor(() => expect(screen.queryByText('consent_title')).toBeNull());
+    expect(await screen.findByText(/totp_invalid/)).toBeInTheDocument();
+  }, 30_000);
+
+  it('is the ordinary page when the instance\'s admin turned it off', async () => {
+    configOverrides.value = { oauthEnabled: false, oauthOnly: false, desktopBrowserSignIn: false };
+    params.value = search({ mobile_redirect_uri: 'http://127.0.0.1:51234/bulwark-desktop/callback', mobile_state: 's', mobile_code_challenge: CHALLENGE });
+    render(<LoginPage />);
+    await waitFor(() => expect(document.getElementById('password')).not.toBeNull(), { timeout: 10000 });
+    expect(screen.queryByTestId('desktop-handoff-banner')).toBeNull();
+  }, 30_000);
+
+  it('ignores a loopback target with no challenge, and is the ordinary page', async () => {
+    configOverrides.value = { oauthEnabled: false, oauthOnly: false };
+    params.value = search({ mobile_redirect_uri: 'http://127.0.0.1:51234/bulwark-desktop/callback', mobile_state: 's' });
+    render(<LoginPage />);
+    await waitFor(() => expect(document.getElementById('password')).not.toBeNull(), { timeout: 10000 });
+    expect(screen.queryByTestId('desktop-handoff-banner')).toBeNull();
+  }, 30_000);
+
+  it('ignores a target that is not this computer', async () => {
+    configOverrides.value = { oauthEnabled: false, oauthOnly: false };
+    params.value = search({ mobile_redirect_uri: 'http://evil.example:51234/bulwark-desktop/callback', mobile_state: 's', mobile_code_challenge: CHALLENGE });
+    render(<LoginPage />);
+    await waitFor(() => expect(document.getElementById('password')).not.toBeNull(), { timeout: 10000 });
+    expect(screen.queryByTestId('desktop-handoff-banner')).toBeNull();
+  }, 30_000);
+});

app/(main)/[locale]/login/page.tsx

@@ -6,7 +6,7 @@ import { IS_DESKTOP_BUILD } from "@/lib/desktop/flag";
 import { forgetDesktopServer, getDesktopBridge } from "@/lib/desktop/bridge";
 import { customServerAllowedByDesktopPolicy, jmapServerAllowedByDesktopPolicy, useDesktopPolicy } from "@/lib/desktop/policy";
 import { accountRefusedByDesktopPolicy } from "@/lib/desktop/refused-accounts";
-import { browserSignInAvailable, runDesktopBrowserSignIn } from "@/lib/desktop/browser-sign-in";
+import { browserSignInAvailable, cancelBrowserSignIn, runDesktopBrowserSignIn, runInstanceBrowserSignIn, type DesktopBrowserSignInOutcome } from "@/lib/desktop/browser-sign-in";
 import { useRouter } from "@/i18n/navigation";
 import { useParams, useSearchParams } from "next/navigation";
 import { useTranslations } from "next-intl";
@@ -43,8 +43,8 @@ import {
 } from "@/lib/auth/lite-oauth";
 import { toAsciiDomain } from "@/lib/idn";
 import { usePrefetchMailView } from "@/hooks/use-prefetch-mail-view";
-import { buildMobileHandoffUrl, mobileCodeChallenge, mobileHandoffTarget, signedInLoginAction } from "@/lib/auth/mobile-handoff";
-import { requestMobileHandoffCodeUrl } from "@/lib/auth/mobile-handoff-client";
+import { buildMobileHandoffCodeUrl, buildMobileHandoffUrl, desktopHandoffDeclineUrl, desktopHandoffPort, desktopHandoffTarget, mobileCodeChallenge, mobileHandoffTarget, signedInLoginAction } from "@/lib/auth/mobile-handoff";
+import { checkDesktopSignIn, parkDesktopSignIn, requestMobileHandoffCodeUrl } from "@/lib/auth/mobile-handoff-client";
 import { MobileHandoffConsent } from "@/components/auth/mobile-handoff-consent";
 import { HelpLinks } from "@/components/layout/help-links";
 import { LoginSkeleton } from "@/components/boot-skeleton/login-skeleton";
@@ -194,11 +194,14 @@ function LoginPageContent() {
   const router = useRouter();
   const t = useTranslations("login");
   const tDesktop = useTranslations("desktop_sign_in");
+  const tBrowser = useTranslations("desktop_browser_sign_in");
   const tDesktopPolicy = useTranslations("desktop_policy");
   const desktopPolicy = useDesktopPolicy();
   // Only the desktop build sets these; a browser never shows them.
   const [desktopNotice, setDesktopNotice] = useState<string | null>(null);
   const [desktopWaiting, setDesktopWaiting] = useState(false);
+  // Leaving the page ends a sign-in it's waiting for: the verifier goes with it.
+  useEffect(() => () => cancelBrowserSignIn(), []);
   const tSessionLimits = useTranslations("session_limits");
   const tOffline = useTranslations("offline");
   const tOfflineWipe = useTranslations("offlineWipe");
@@ -230,9 +233,16 @@ function LoginPageContent() {
   // server to park the sign-in on and keeps handing over in the fragment.
   const rawMobileCodeChallenge = IS_LITE ? "" : searchParams.get("mobile_code_challenge") ?? "";
   const mobileChallenge = mobileCodeChallenge(rawMobileCodeChallenge);
-  const mobileRedirectUri = rawMobileCodeChallenge && !mobileChallenge
+  // The desktop app's loopback listener is the other target, only ever with a code and a
+  // state, and the desktop build itself has no hand-off routes (lib/desktop/blocked-routes.ts).
+  const { desktopBrowserSignIn: desktopSignInEnabled } = useConfig();
+  const desktopTarget = !IS_DESKTOP_BUILD && desktopSignInEnabled && mobileChallenge && rawMobileState
+    ? desktopHandoffTarget(searchParams.get("mobile_redirect_uri"))
+    : "";
+  const isDesktopHandoff = Boolean(desktopTarget);
+  const mobileRedirectUri = desktopTarget || (rawMobileCodeChallenge && !mobileChallenge
     ? ""
-    : mobileHandoffTarget(searchParams.get("mobile_redirect_uri"));
+    : mobileHandoffTarget(searchParams.get("mobile_redirect_uri")));
   const mobileState = mobileRedirectUri ? rawMobileState : "";
   const isMobileHandoff = Boolean(mobileRedirectUri);
   const [pendingHandoff, setPendingHandoff] = useState<{
@@ -392,7 +402,8 @@ function LoginPageContent() {
   const canRememberSession = rememberMeEnabled && (!IS_LITE || liteTokenLoginSupported !== false);
   // Sign-ins are remembered without asking unless the admin offers the box
   // (LOGIN_SHOW_REMEMBER_ME).
-  const showRememberMe = canRememberSession && loginShowRememberMe;
+  // Not in the browser the desktop app opened: nothing stays in this browser to remember.
+  const showRememberMe = canRememberSession && loginShowRememberMe && !isDesktopHandoff;
   const persistSession = canRememberSession && (!loginShowRememberMe || rememberMe);
   // A provider sign-in follows the box whenever it is shown, the automatic
   // one included (it starts unticked), and is remembered otherwise. Lite
@@ -679,7 +690,8 @@ function LoginPageContent() {
           locale: params.locale,
           server_id: selectedServer?.id,
           remember: persistProviderSession,
-          ...(freshLoginRequired() ? { fresh_login: true } : {}),
+          // In the browser the desktop app opened, its word counts: the flag is in the app.
+          ...(freshLoginRequired() || (isDesktopHandoff && searchParams.get("fresh_login") === "1") ? { fresh_login: true } : {}),
           ...(isMobileHandoff
             ? {
                 mobile_redirect_uri: mobileRedirectUri,
@@ -692,6 +704,8 @@ function LoginPageContent() {
 
       if (!res.ok) {
         setOauthLoading(false);
+        // The app is waiting on this tab, so it can't just stay quiet here.
+        if (isDesktopHandoff) setHandoffError("server_error");
         return;
       }
 
@@ -713,7 +727,7 @@ function LoginPageContent() {
     } catch {
       setOauthLoading(false);
     }
-  }, [params.locale, selectedServer?.id, serverUrl, desktopPolicy, tDesktopPolicy, persistProviderSession, isMobileHandoff, mobileRedirectUri, mobileState, mobileChallenge]);
+  }, [params.locale, selectedServer?.id, serverUrl, desktopPolicy, tDesktopPolicy, persistProviderSession, isMobileHandoff, isDesktopHandoff, searchParams, mobileRedirectUri, mobileState, mobileChallenge]);
 
   useEffect(() => {
     // After signing out, show the login page rather than signing straight
@@ -1041,38 +1055,91 @@ function LoginPageContent() {
     window.location.href = authUrl.toString();
   };
 
-  /** The desktop build: the server's own sign-in page in the system browser. */
-  // Spelled out, not IS_DESKTOP_BUILD: only this form keeps the route out of other
-  // builds' bundles, which Lite's check on API strings relies on.
-  const handleDesktopBrowserSignIn = async () => {
+  /** What the user sees when a browser sign-in ends without one. Cancelling says nothing. */
+  const showBrowserSignInOutcome = (outcome: DesktopBrowserSignInOutcome) => {
+    setDesktopWaiting(false);
+    if (outcome.kind === "policy") setDesktopPolicyNotice(tDesktopPolicy("server_refused"));
+    else if (outcome.kind === "denied") setDesktopNotice(tBrowser("declined"));
+    else if (outcome.kind === "declined") setDesktopNotice(tDesktop("server_declined"));
+    else if (outcome.kind === "invalid") setDesktopNotice(tDesktop("server_invalid"));
+    else if (outcome.kind === "timeout") setDesktopNotice(tBrowser("timed_out"));
+    else if (outcome.kind === "no_browser") setDesktopNotice(tBrowser("no_browser"));
+    else if (outcome.kind === "failed") setDesktopNotice(tBrowser("failed"));
+  };
+
+  /** The server's or the instance's own sign-in page in the system browser. */
+  const handleBrowserSignIn = async () => {
+    setDesktopNotice(null);
+    setDesktopPolicyNotice(null);
+    // Spelled out, not IS_DESKTOP_BUILD: only this form keeps the route out of other
+    // builds' bundles, which Lite's check on API strings relies on.
     if (process.env.NEXT_PUBLIC_BULWARK_DESKTOP === '1') {
       const target = jmapEndpoint.trim();
       if (!target) {
         setDesktopNotice(tDesktop("server_needed"));
         return;
       }
-      setDesktopNotice(null);
+      if (!jmapServerAllowedByDesktopPolicy(target, desktopPolicy)) {
+        setDesktopPolicyNotice(tDesktopPolicy("server_refused"));
+        return;
+      }
       setDesktopWaiting(true);
-      const prefix = getPathPrefix(params.locale as string);
       const outcome = await runDesktopBrowserSignIn({
         serverUrl: target,
-        callbackPath: `${prefix}/${params.locale}/auth/callback`,
         slot: useAccountStore.getState().getNextCookieSlot(),
         remember: persistProviderSession,
         addAccount: isAddAccountMode,
+        fresh: freshLoginRequired(),
+        redeem: (server, code, verifier, redirectUri) => useAuthStore.getState().loginWithOAuth(server, code, verifier, redirectUri),
+        tryPassword: async ({ username, password, totp }) => {
+          if (await useAuthStore.getState().login(target, username, password, totp, persistSession)) {
+            if (!rememberMeEnabled || persistSession) saveUsername(username);
+            return { ok: true };
+          }
+          const failed = useAuthStore.getState().error;
+          return { ok: false, error: failed === "invalid_credentials" || failed === "totp_required" ? failed : "other" };
+        },
       });
-      if (outcome.kind === "callback") {
-        window.location.href = outcome.callbackUrl;
+      if (outcome.kind === "signed-in") {
+        setDesktopWaiting(false);
+        router.push('/');
         return;
       }
-      setDesktopWaiting(false);
       forgetDesktopServer(target, "failed");
-      if (outcome.kind === "unavailable") setDesktopNotice(tDesktop("browser_unavailable"));
-      else if (outcome.kind === "declined") setDesktopNotice(tDesktop("server_declined"));
-      else if (outcome.kind === "failed") setDesktopNotice(tDesktop("browser_failed"));
+      showBrowserSignInOutcome(outcome);
+      return;
     }
+    // A server the device's OS policy refuses, where it's known up front. With a list of
+    // servers the browser picks, and the redeem below is what checks.
+    if (!hasServerList && serverUrl && !jmapServerAllowedByDesktopPolicy(serverUrl, desktopPolicy)) {
+      setDesktopPolicyNotice(tDesktopPolicy("server_refused"));
+      return;
+    }
+    setDesktopWaiting(true);
+    const outcome = await runInstanceBrowserSignIn({
+      base: `${window.location.origin}${getPathPrefix(params.locale as string)}`,
+      locale: params.locale as string,
+      fresh: freshLoginRequired(),
+    });
+    if (outcome.kind !== "code") {
+      showBrowserSignInOutcome(outcome);
+      return;
+    }
+    const redeemed = await useAuthStore.getState().loginWithDesktopHandoff(outcome.code, outcome.verifier, {
+      remember: persistProviderSession,
+      rememberPassword: persistSession,
+      allowedServers: desktopPolicy.AllowedJmapServers.value,
+      // The same rule as the field for a server of one's own on this page.
+      customServersAllowed: customServerAllowedByDesktopPolicy(desktopPolicy) || !configuredServerUrl,
+    });
+    setDesktopWaiting(false);
+    if (redeemed === "ok") router.push('/');
+    else if (redeemed === "blocked") setDesktopPolicyNotice(tDesktopPolicy("server_refused"));
+    else setDesktopNotice(tBrowser("failed"));
   };
 
+  const browserSignInShown = browserSignInAvailable() && desktopSignInEnabled;
+
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault();
 
@@ -1080,6 +1147,54 @@ function LoginPageContent() {
     // when the admin hasn't configured a server list.
     const effectiveServerUrl = selectedServer?.url
       || (allowCustomJmapEndpoint ? jmapEndpoint : serverUrl);
+    // The desktop app opened this page in the user's browser. Nothing leaves this page until
+    // the user says yes: the password is only checked, and a two-factor code can't be, as it
+    // works once. This browser gets no session of its own out of any of it.
+    if (isDesktopHandoff) {
+      const failed = (reason: string) => {
+        useAuthStore.setState({
+          isLoading: false,
+          error: reason === "invalid_credentials" || reason === "totp_required" ? reason : reason === "too_many_attempts" ? null : "server_error",
+        });
+        setDesktopNotice(reason === "too_many_attempts" ? tBrowser("too_many") : null);
+      };
+      const { username, password } = formData;
+      const totp = totpCode || undefined;
+      useAuthStore.setState({ isLoading: true, error: null });
+      setHandoffError(null);
+      setDesktopNotice(null);
+      if (!totp) {
+        const checked = await checkDesktopSignIn({ serverUrl: effectiveServerUrl, serverId: selectedServer?.id, username, password });
+        if ("error" in checked) {
+          failed(checked.error);
+          return;
+        }
+      }
+      useAuthStore.setState({ isLoading: false });
+      const prefix = getPathPrefix(params.locale as string);
+      setPendingHandoff({
+        url: null,
+        resolveUrl: async () => {
+          const parked = await parkDesktopSignIn({
+            challenge: mobileChallenge,
+            state: mobileState,
+            serverUrl: effectiveServerUrl,
+            serverId: selectedServer?.id,
+            username,
+            password,
+            totp,
+            redirectUri: `${window.location.origin}${prefix}/${params.locale}/auth/callback`,
+          });
+          if ("error" in parked) {
+            failed(parked.error);
+            return null;
+          }
+          return buildMobileHandoffCodeUrl(mobileRedirectUri, parked.code, mobileState);
+        },
+        username,
+      });
+      return;
+    }
     // The device's OS policy, also on an instance: nothing is sent to a server it refuses.
     setDesktopPolicyNotice(null);
     if (!jmapServerAllowedByDesktopPolicy(effectiveServerUrl, desktopPolicy)) {
@@ -1193,6 +1308,53 @@ function LoginPageContent() {
   // has to pick which one SSO targets before the button starts the flow, since
   // the selection drives OAuth discovery and the server_id sent to the callback
   // (issue #799).
+  // In the app: the main way in, above the form, which stays as the other choice.
+  const browserSignInOption = browserSignInShown && (
+    <div className="space-y-3">
+      <Button
+        type="button"
+        className="w-full h-11 font-medium text-[0.9375rem] bg-primary hover:bg-primary/90 transition-all duration-200 rounded-xl shadow-md shadow-primary/15 hover:shadow-lg hover:shadow-primary/20"
+        onClick={handleBrowserSignIn}
+        disabled={desktopWaiting || isLoading}
+        data-testid="desktop-browser-sign-in"
+      >
+        {desktopWaiting ? <Loader2 className="w-4 h-4 animate-spin me-2" /> : <LogIn className="w-4 h-4 me-2" />}
+        {desktopWaiting ? tBrowser("waiting") : tBrowser("button")}
+      </Button>
+      {desktopWaiting && (
+        <p role="status" data-testid="desktop-browser-waiting" className="text-center text-xs text-muted-foreground leading-relaxed">
+          {tBrowser("waiting_hint")}{" "}
+          <button
+            type="button"
+            className="underline hover:text-foreground"
+            data-testid="desktop-browser-cancel"
+            onClick={() => {
+              cancelBrowserSignIn();
+              setDesktopWaiting(false);
+            }}
+          >
+            {tBrowser("cancel")}
+          </button>
+        </p>
+      )}
+      <div className="relative py-1">
+        <div className="absolute inset-0 flex items-center">
+          <span className="w-full border-t border-border/60" />
+        </div>
+        <div className="relative flex justify-center text-xs">
+          <span className="bg-background/80 px-3 text-muted-foreground">{tBrowser("or_here")}</span>
+        </div>
+      </div>
+    </div>
+  );
+
+  // The desktop app's sign-in, in the browser: says what this page is for.
+  const desktopHandoffBanner = isDesktopHandoff && (
+    <p data-testid="desktop-handoff-banner" className="mb-4 text-center text-sm text-muted-foreground leading-relaxed">
+      {tBrowser("handoff_banner")}
+    </p>
+  );
+
   const desktopPolicyAlert = desktopPolicyNotice && (
     <p role="alert" data-testid="desktop-policy-notice" className="mt-2 text-sm text-warning leading-relaxed">
       {desktopPolicyNotice}
@@ -1426,13 +1588,17 @@ function LoginPageContent() {
         url={pendingHandoff?.url ?? null}
         resolveUrl={pendingHandoff?.resolveUrl ?? null}
         username={pendingHandoff?.username ?? ""}
+        desktopPort={isDesktopHandoff ? desktopHandoffPort(desktopTarget) : undefined}
         onCancel={() => {
           setPendingHandoff(null);
-          router.push('/');
+          // Ends the flow at the app, which isn't left waiting. Nothing was parked.
+          if (isDesktopHandoff) window.location.replace(desktopHandoffDeclineUrl(desktopTarget, mobileState));
+          else router.push('/');
         }}
         onError={() => {
           setPendingHandoff(null);
-          setHandoffError("server_error");
+          // The desktop's answer has said what went wrong, on the form.
+          if (!isDesktopHandoff) setHandoffError("server_error");
         }}
       />
       {/* Theme toggle - top right, dropdown style; hidden while the theme policy locks the mode (#1280) */}
@@ -1598,6 +1764,8 @@ function LoginPageContent() {
               </div>
             )}
 
+            {desktopHandoffBanner}
+
             {/* Dev Mode: One-click login */}
             {devMode ? (
               <div className="space-y-4">
@@ -1629,10 +1797,14 @@ function LoginPageContent() {
                 {serverPicker}
                 {desktopPolicyAlert}
                 {oauthMetadata && showRememberMe && rememberMeBox}
+                {browserSignInOption}
                 {oauthMetadata ? (
                   <Button
                     type="button"
-                    className="w-full h-11 font-medium text-[0.9375rem] bg-primary hover:bg-primary/90 transition-all duration-200 rounded-xl shadow-md shadow-primary/15 hover:shadow-lg hover:shadow-primary/20"
+                    variant={browserSignInShown ? "outline" : undefined}
+                    className={browserSignInShown
+                      ? "w-full h-11 font-medium text-[0.9375rem] rounded-xl border-border/60 hover:bg-muted/50"
+                      : "w-full h-11 font-medium text-[0.9375rem] bg-primary hover:bg-primary/90 transition-all duration-200 rounded-xl shadow-md shadow-primary/15 hover:shadow-lg hover:shadow-primary/20"}
                     onClick={() => handleOAuthLogin()}
                     disabled={oauthLoading}
                   >
@@ -1663,6 +1835,11 @@ function LoginPageContent() {
                   // Where the sign-in button goes once the provider answers.
                   <Block className="w-full h-11 rounded-xl" />
                 )}
+                {desktopNotice && (
+                  <p role="alert" data-testid="desktop-notice" className="mt-2 text-sm text-warning leading-relaxed">
+                    {desktopNotice}
+                  </p>
+                )}
               </div>
             ) : (
               /* Login Form */
@@ -1690,6 +1867,8 @@ function LoginPageContent() {
                     </div>
                   )}
 
+                  {browserSignInOption}
+
                   {/* Username field. The access token names the account, so
                       token sign-in has none. */}
                   <div className={cn("space-y-1.5", signInWithToken && "hidden")}>
@@ -1897,7 +2076,10 @@ function LoginPageContent() {
 
                 <Button
                   type="submit"
-                  className="w-full h-11 font-medium text-[0.9375rem] bg-primary hover:bg-primary/90 transition-all duration-200 rounded-xl shadow-md shadow-primary/15 hover:shadow-lg hover:shadow-primary/20"
+                  variant={browserSignInShown ? "outline" : undefined}
+                  className={browserSignInShown
+                    ? "w-full h-11 font-medium text-[0.9375rem] rounded-xl border-border/60 hover:bg-muted/50"
+                    : "w-full h-11 font-medium text-[0.9375rem] bg-primary hover:bg-primary/90 transition-all duration-200 rounded-xl shadow-md shadow-primary/15 hover:shadow-lg hover:shadow-primary/20"}
                   disabled={isLoading || (liteSsoRequired && oauthLoading)}
                 >
                   {isLoading || (liteSsoRequired && oauthLoading) ? (
@@ -1944,21 +2126,8 @@ function LoginPageContent() {
                   </>
                 )}
 
-                {process.env.NEXT_PUBLIC_BULWARK_DESKTOP === "1" && !hasServerList && browserSignInAvailable() && (
-                  <Button
-                    type="button"
-                    variant="outline"
-                    className="mt-3 w-full h-11 font-medium text-[0.9375rem] rounded-xl border-border/60 hover:bg-muted/50"
-                    onClick={handleDesktopBrowserSignIn}
-                    disabled={desktopWaiting || isLoading}
-                    data-testid="desktop-browser-sign-in"
-                  >
-                    {desktopWaiting ? <Loader2 className="w-4 h-4 animate-spin me-2" /> : <LogIn className="w-4 h-4 me-2" />}
-                    {desktopWaiting ? tDesktop("browser_waiting") : tDesktop("browser_button")}
-                  </Button>
-                )}
                 {desktopPolicyAlert}
-                {IS_DESKTOP_BUILD && desktopNotice && (
+                {desktopNotice && (
                   <p role="alert" data-testid="desktop-notice" className="mt-2 text-sm text-warning leading-relaxed">
                     {desktopNotice}
                   </p>

app/(main)/admin/__tests__/marketplace-install-version.test.tsx

@@ -49,6 +49,36 @@ describe('installVersion', () => {
     expect(calls).toHaveLength(1);
   });
 
+  it('says what an update adds, and repeats with what the admin saw', async () => {
+    responses = [json({ error: 'adds', permissionsAdded: ['keystore'] }, 409), json({ warnings: [] })];
+    const asked: string[] = [];
+    const result = await installVersion(BODY, (q) => { asked.push(`${q.title} ${q.message}`); return true; });
+    expect(asked[0]).toContain('new permissions');
+    expect(asked[0]).toContain('keystore');
+    expect(calls.map((c) => c.body.acceptPermissions)).toEqual([undefined, ['keystore']]);
+    expect(calls.map((c) => c.body.force), 'not the same as forcing it').toEqual([undefined, undefined]);
+    expect(result.ok).toBe(true);
+  });
+
+  it('does not update past new permissions the admin declined', async () => {
+    responses = [json({ error: 'adds', permissionsAdded: ['keystore'] }, 409)];
+    expect(await installVersion(BODY, () => false)).toEqual({ ok: false, error: 'Not installed.' });
+    expect(calls).toHaveLength(1);
+  });
+
+  it('asks about both when a withdrawn version also adds permissions, and keeps both answers', async () => {
+    responses = [
+      json({ error: 'withdrawn', yanked: { reason: null } }, 409),
+      json({ error: 'adds', permissionsAdded: ['keystore'] }, 409),
+      json({ warnings: [] }),
+    ];
+    const asked: string[] = [];
+    const result = await installVersion(BODY, (q) => { asked.push(q.title); return true; });
+    expect(asked).toHaveLength(2);
+    expect(calls.at(-1)!.body).toMatchObject({ force: true, acceptPermissions: ['keystore'] });
+    expect(result.ok).toBe(true);
+  });
+
   it('shows any other 409 as the error it is', async () => {
     responses = [json({ error: 'The configuration is read-only' }, 409)];
     const result = await installVersion(BODY, () => true);

app/(main)/admin/_pages/marketplace-detail.tsx

@@ -28,6 +28,7 @@ import { apiFetch } from '@/lib/browser-navigation';
 import { compareVersions, isVersionSatisfied } from '@/lib/version-compare';
 import type { MarketplaceListing } from '@/lib/admin/marketplace-directory';
 import { adminPath } from '@/lib/admin/admin-nav';
+import { declaredPermissions, HIGH_RISK_PERMISSIONS } from '@/lib/plugin-sandbox/permission-text';
 import { cn } from '@/lib/utils';
 import { SettingsSection } from '@/components/settings/settings-section';
 import { Button } from '@/components/ui/button';
@@ -97,6 +98,8 @@ interface PreviewData {
   requestedVersionMissing: string | null;
   bundle: {
     manifest: Record<string, unknown> | null;
+    /** What this version asks for that the installed one doesn't. */
+    addedPermissions?: string[];
     source: { name: string; content: string; truncated: boolean } | null;
     size: number;
     error: string | null;
@@ -307,8 +310,10 @@ export function MarketplaceDetailPage({ slug }: { slug: string }) {
   const bundle = data.bundle;
   const preview = data.preview;
   const isPlugin = ext.type === 'plugin';
-  const manifestPerms = (bundle.manifest?.permissions as string[] | undefined) || preview && ext.versions.find((v) => v.version === preview.version)?.permissions || ext.permissions || [];
+  // Optional permissions are granted like the others, so they count here too.
+  const manifestPerms = bundle.manifest ? declaredPermissions(bundle.manifest) : (preview && ext.versions.find((v) => v.version === preview.version)?.permissions) || ext.permissions || [];
   const permissionText = new Map(ext.permissionDetails.map((p) => [p.id, p]));
+  const addedPermissions = new Set(bundle.addedPermissions ?? []);
   const frameOrigins = (bundle.manifest?.frameOrigins as string[] | undefined) || [];
   const settingsSchema = bundle.manifest?.settingsSchema as Record<string, { type: string; label: string; description?: string; default?: unknown }> | undefined;
 
@@ -705,7 +710,7 @@ export function MarketplaceDetailPage({ slug }: { slug: string }) {
               <ul className="space-y-1.5">
                 {manifestPerms.map(perm => {
                   const text = permissionText.get(perm);
-                  const risky = text?.highRisk || RISKY_PERMISSIONS.has(perm);
+                  const risky = text?.highRisk || RISKY_PERMISSIONS.has(perm) || HIGH_RISK_PERMISSIONS.has(perm);
                   return (
                     <li
                       key={perm}
@@ -721,6 +726,7 @@ export function MarketplaceDetailPage({ slug }: { slug: string }) {
                         <div className="flex flex-wrap items-center gap-2">
                           {text && <span className="font-medium">{text.title}</span>}
                           <code className="font-mono text-xs opacity-80">{perm}</code>
+                          {addedPermissions.has(perm) && <Badge tone="warning">New in this version</Badge>}
                         </div>
                         {text?.body && <p className="mt-0.5 text-xs opacity-90">{text.body}</p>}
                       </div>

app/(main)/admin/_pages/marketplace.tsx

@@ -45,6 +45,7 @@ interface InstalledEntry {
 interface UpdatesResult {
   installed: InstalledEntry[];
   updates: Array<{
+    addedPermissions?: string[];
     slug: string; currentVersion: string; version: string; channel: 'stable' | 'beta'; publishedAt: string | null;
     changelog: string | null; notes?: ChangelogFlags; changelogs?: ChangelogEntry[];
   }>;
@@ -95,7 +96,9 @@ const pillClass = (active: boolean) => cn(
  * Installs one version of an extension. A version the publisher withdrew,
  * or one older than the installed version, comes back as 409; the admin is
  * asked (in the page's ConfirmDialog), and the install is repeated with
- * `force` if they insist. Returns the error text to show, or null.
+ * `force` if they insist. An update that asks for more permissions comes back
+ * the same way, and is repeated with the ones the admin saw. "Update all" goes
+ * through here too, so it asks about each. Returns the error text to show, or null.
  */
 export interface InstallQuestion {
   title: string;
@@ -108,28 +111,39 @@ export async function installVersion(
   body: { slug: string; version: string; type: 'plugin' | 'theme' },
   confirm: (question: InstallQuestion) => boolean | Promise<boolean>,
 ): Promise<{ ok: true; warnings: string[]; signature: string | null; updated: boolean } | { ok: false; error: string }> {
-  const send = (force: boolean) => apiFetch('/api/admin/marketplace', {
+  let force = false;
+  let acceptPermissions: string[] | undefined;
+  const send = () => apiFetch('/api/admin/marketplace', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(force ? { ...body, force: true } : body),
+    body: JSON.stringify({ ...body, ...(force ? { force: true } : {}), ...(acceptPermissions ? { acceptPermissions } : {}) }),
   });
   try {
-    let res = await send(false);
-    if (res.status === 409) {
+    let res = await send();
+    // At most one of each question: withdrawn or older, then permissions.
+    for (let asked = 0; res.status === 409 && asked < 3; asked += 1) {
       const data = await res.json().catch(() => ({}));
-      if (data.yanked) {
+      if (Array.isArray(data.permissionsAdded) && !acceptPermissions) {
+        const names = (data.permissionsAdded as string[]).join(', ');
+        const message = `${body.slug} ${body.version} asks for new permissions that the installed version doesn't have: ${names}.`;
+        if (!(await confirm({ title: 'Allow the new permissions?', message, confirmText: 'Update', cancelText: 'Cancel' }))) {
+          return { ok: false, error: 'Not installed.' };
+        }
+        acceptPermissions = data.permissionsAdded;
+      } else if (data.yanked && !force) {
         if (!(await confirm({ title: 'Install it anyway?', message: data.error, confirmText: 'Install', cancelText: 'Cancel' }))) {
           return { ok: false, error: 'Not installed.' };
         }
-        res = await send(true);
-      } else if (data.downgrade) {
+        force = true;
+      } else if (data.downgrade && !force) {
         if (!(await confirm({ title: 'Install the older version anyway?', message: data.error, confirmText: 'Install', cancelText: 'Cancel' }))) {
           return { ok: false, error: 'Not installed.' };
         }
-        res = await send(true);
+        force = true;
       } else {
         return { ok: false, error: data.error || 'Installation failed' };
       }
+      res = await send();
     }
     const data = await res.json().catch(() => ({}));
     if (!res.ok) return { ok: false, error: data.error || 'Installation failed' };
@@ -463,6 +477,11 @@ function UpdatesSection({
                       {u.channel === 'beta' && <Badge tone="info">beta</Badge>}
                       <ChangelogBadges flags={{ security: anyFlag(entries, 'security'), breaking: anyFlag(entries, 'breaking') }} />
                     </div>
+                    {(u.addedPermissions?.length ?? 0) > 0 && (
+                      <p className="mt-1 text-xs text-amber-800 dark:text-amber-300" data-testid={`update-permissions-${u.slug}`}>
+                        New permissions: <span className="font-mono">{u.addedPermissions!.join(', ')}</span>
+                      </p>
+                    )}
                     {withNotes.length > 0 ? (
                       <details className="mt-1" data-testid={`update-notes-${u.slug}`}>
                         <summary className="cursor-pointer text-xs font-medium text-muted-foreground hover:text-foreground">

app/(main)/admin/_pages/settings.tsx

@@ -133,6 +133,7 @@ export function SettingsPage() {
         </SettingsSection>
 
         <SettingsSection id="login" title="Login page">
+          <ConfigToggleItem label="Desktop app: sign in with the browser" description="Lets the desktop app sign in through this login page in the user's browser, so their password manager works there. Turn off on a terminal server or any computer several people use at once: another user there can send a link that asks for someone's sign-in. The app's own form keeps working." configKey="desktopBrowserSignIn" value={currentValue('desktopBrowserSignIn') as boolean} source={config.desktopBrowserSignIn?.source} onChange={handleChange} onRevert={handleRevert} />
           <ConfigToggleItem label="Show version" description="Show the webmail version in the login page footer. Turn off to keep the exact version hidden from visitors who are not signed in." configKey="loginShowVersion" value={currentValue('loginShowVersion') as boolean} source={config.loginShowVersion?.source} onChange={handleChange} onRevert={handleRevert} />
           <ConfigToggleItem label="Show 2FA code option" term="two_factor" description="Show the &quot;I have a 2FA code&quot; toggle on the login form. Turn off when two-factor authentication is handled by an external identity provider. Accounts that require a code still get the field." configKey="loginShowTotp" value={currentValue('loginShowTotp') as boolean} source={config.loginShowTotp?.source} onChange={handleChange} onRevert={handleRevert} />
           <ConfigToggleItem label="Show access token sign-in" term="access_token" description="Offer signing in with an access token instead of a password. For JMAP servers that authenticate API tokens as Bearer tokens, such as Fastmail, which accepts no passwords over JMAP." configKey="loginShowTokenLogin" value={currentValue('loginShowTokenLogin') as boolean} source={config.loginShowTokenLogin?.source} onChange={handleChange} onRevert={handleRevert} />

app/api/admin/marketplace/[slug]/route.ts

@@ -23,12 +23,22 @@ import {
   type DirectoryDetail,
   type DirectoryVersion,
 } from '@/lib/admin/marketplace-directory';
-import { MAX_PLUGIN_SIZE, MAX_THEME_SIZE } from '@/lib/plugin-types';
+import { IMPLICIT_PERMISSIONS, MAX_PLUGIN_SIZE, MAX_THEME_SIZE } from '@/lib/plugin-types';
+import { declaredPermissions, HIGH_RISK_PERMISSIONS } from '@/lib/plugin-sandbox/permission-text';
+import { getPluginRegistry } from '@/lib/admin/plugin-registry';
 import { productName } from '@/lib/product-name';
 import { withAppName } from '@/lib/settings-search';
 
 const MAX_PREVIEW_SOURCE_LEN = 100_000;
 
+/** For a directory that predates it. It only lists what it knows about, and admin pages are in English. */
+const LOCAL_PERMISSION_TEXT: Record<string, { title: string; body: string }> = {
+  keystore: {
+    title: 'Use certificates on this computer',
+    body: 'Ask to sign and decrypt messages with certificates on this computer or a smart card. The app asks each user first. The plugin never gets the private key, but while they allow it, it can sign in their name and read what it decrypts.',
+  },
+};
+
 /** A version row as the detail page renders it. */
 function versionRow(v: DirectoryVersion) {
   return {
@@ -176,6 +186,17 @@ export async function GET(
     const state = installedStateOf(installed, slug, type);
     const history = await historyFor(type, slug);
     const appName = productName(configManager.get<string>('appName'));
+    // What the bundle itself declares, optional permissions too: the directory's list can leave some out.
+    const declared = type === 'plugin' ? declaredPermissions(manifest) : [];
+    const listed = new Set((detail.permissions ?? []).map((p) => p.id));
+    const unlisted = declared.filter((id) => !listed.has(id) && LOCAL_PERMISSION_TEXT[id]).map((id) => ({
+      id,
+      ...LOCAL_PERMISSION_TEXT[id],
+      highRisk: HIGH_RISK_PERMISSIONS.has(id),
+    }));
+    const installedPlugin = state.installed && type === 'plugin' ? (await getPluginRegistry()).plugins.find((p) => p.id === slug) : null;
+    const implicit = new Set<string>(IMPLICIT_PERMISSIONS);
+    const addedPermissions = installedPlugin ? declared.filter((p) => !installedPlugin.permissions?.includes(p) && !implicit.has(p)) : [];
 
     return NextResponse.json(
       {
@@ -189,7 +210,7 @@ export async function GET(
           themePreviews: detail.themePreviews ?? [],
           advisories: detail.advisories ?? [],
           // The directory ships the webmail's permission texts unfilled.
-          permissionDetails: (detail.permissions ?? []).map((p) => withAppName(p, appName) as typeof p),
+          permissionDetails: [...(detail.permissions ?? []), ...unlisted].map((p) => withAppName(p, appName) as typeof p),
           source: detail.source,
           createdAt: detail.createdAt ?? null,
           updatedAt: detail.updatedAt ?? null,
@@ -202,6 +223,7 @@ export async function GET(
         requestedVersionMissing: requested && !requestedRow ? requested : null,
         bundle: {
           manifest,
+          addedPermissions,
           source: sourcePreview,
           size: bundleSize,
           error: bundleError,

app/api/admin/marketplace/__tests__/preview.test.ts

@@ -19,7 +19,7 @@ vi.mock('@/lib/admin/config-manager', () => ({
 }));
 vi.mock('@/lib/admin/plugin-registry', () => ({
   getPluginRegistry: vi.fn(async () => ({
-    plugins: [{ id: 'pretty-dates', name: 'Pretty Dates', version: '1.1.0', enabled: true, source: { kind: 'marketplace', slug: 'pretty-dates', directoryUrl: 'https://extensions.test' } }],
+    plugins: [{ id: 'pretty-dates', name: 'Pretty Dates', version: '1.1.0', permissions: ['email:read'], enabled: true, source: { kind: 'marketplace', slug: 'pretty-dates', directoryUrl: 'https://extensions.test' } }],
   })),
   getThemeRegistry: vi.fn(async () => ({ themes: [] })),
 }));
@@ -127,3 +127,43 @@ describe('GET /api/admin/marketplace/[slug]', () => {
     expect((await preview('?version=..%2F..%2Fetc')).status).toBe(400);
   });
 });
+
+describe('permissions in the preview', () => {
+  async function previewOf(manifest: Record<string, unknown>) {
+    const zip = new JSZip();
+    zip.file('manifest.json', JSON.stringify({ id: 'pretty-dates', name: 'Pretty Dates', version: '1.2.0', author: 'x', description: 'd', type: 'hook', entrypoint: 'index.js', ...manifest }));
+    zip.file('index.js', '// x');
+    const bytes = (await zip.generateAsync({ type: 'uint8array' })).slice().buffer as ArrayBuffer;
+    const versions = [v('1.2.0')];
+    vi.stubGlobal('fetch', vi.fn(async (url: string) => {
+      const u = new URL(String(url));
+      if (u.pathname === '/api/v2/extensions/pretty-dates') {
+        return Response.json({ data: { ...summary, latest: versions[0], newest: versions[0], longDescription: 'long', versions, permissions: [{ id: 'crypto:full', title: 'Full crypto', body: 'b', highRisk: true }], screenshots: [], themePreviews: [], advisories: [] } });
+      }
+      if (u.pathname.endsWith('/versions')) return Response.json({ data: versions });
+      if (u.pathname.endsWith('/bundle')) return new Response(bytes);
+      return Response.json({ data: versions[0] });
+    }));
+    const res = await GET(new NextRequest('http://localhost/api/admin/marketplace/pretty-dates'), { params: Promise.resolve({ slug: 'pretty-dates' }) });
+    return res.json();
+  }
+
+  it('names an optional keystore with its own text and as high risk, even if the directory does not', async () => {
+    const body = await previewOf({ tier: 'privileged', permissions: ['crypto:full'], optionalPermissions: ['keystore'] });
+    const entry = body.extension.permissionDetails.find((p: { id: string }) => p.id === 'keystore');
+    expect(entry).toMatchObject({ highRisk: true });
+    expect(entry.title).toMatch(/certificates/i);
+    expect(body.extension.permissionDetails.filter((p: { id: string }) => p.id === 'crypto:full')).toHaveLength(1);
+  });
+
+  it('says what this version adds to the installed one', async () => {
+    const body = await previewOf({ tier: 'privileged', permissions: ['crypto:full', 'email:read'], optionalPermissions: ['keystore'] });
+    expect(body.bundle.addedPermissions).toEqual(['crypto:full', 'keystore']);
+  });
+
+  it('adds nothing for an untrusted plugin, which can not get it', async () => {
+    const body = await previewOf({ permissions: ['email:read'], optionalPermissions: ['keystore'] });
+    expect(body.extension.permissionDetails.map((p: { id: string }) => p.id)).not.toContain('keystore');
+    expect(body.bundle.addedPermissions).toEqual([]);
+  });
+});

app/api/admin/marketplace/__tests__/route.test.ts

@@ -215,3 +215,49 @@ describe('POST /api/admin/marketplace', () => {
     expect(registry.get('pgp-plugin')?.version).toBe('2.0.0');
   });
 });
+
+describe('an update that asks for more than the installed version', () => {
+  const INSTALLED = { id: 'pretty-dates', name: 'Pretty Dates', version: '0.9.0', permissions: ['email:read'], enabled: true };
+
+  it('is refused until someone has seen what it adds, and installs nothing meanwhile', async () => {
+    registry.set('pretty-dates', { ...INSTALLED });
+    directory(await bundle({ ...MANIFEST, id: 'pretty-dates', permissions: ['email:read', 'email:send'] }));
+    const res = await install({ slug: 'pretty-dates', version: '1.0.0', type: 'plugin' });
+    expect(res.status).toBe(409);
+    expect((await res.json()).permissionsAdded).toEqual(['email:send']);
+    expect(registry.get('pretty-dates')!.version).toBe('0.9.0');
+  });
+
+  it('counts an optional permission, since it is granted like any other', async () => {
+    registry.set('pretty-dates', { ...INSTALLED });
+    directory(await bundle({ ...MANIFEST, id: 'pretty-dates', optionalPermissions: ['email:send'] }));
+    const res = await install({ slug: 'pretty-dates', version: '1.0.0', type: 'plugin' });
+    expect(res.status).toBe(409);
+    expect((await res.json()).permissionsAdded).toEqual(['email:send']);
+  });
+
+  it('forcing it is about something else, and does not get past this', async () => {
+    registry.set('pretty-dates', { ...INSTALLED });
+    directory(await bundle({ ...MANIFEST, id: 'pretty-dates', permissions: ['email:read', 'email:send'] }));
+    expect((await install({ slug: 'pretty-dates', version: '1.0.0', type: 'plugin', force: true })).status).toBe(409);
+  });
+
+  it('goes through when what was accepted covers it, and only then', async () => {
+    registry.set('pretty-dates', { ...INSTALLED });
+    directory(await bundle({ ...MANIFEST, id: 'pretty-dates', permissions: ['email:read', 'email:send', 'email:raw-send'] }));
+    expect((await install({ slug: 'pretty-dates', version: '1.0.0', type: 'plugin', acceptPermissions: ['email:send'] })).status).toBe(409);
+    expect((await install({ slug: 'pretty-dates', version: '1.0.0', type: 'plugin', acceptPermissions: 'email:send,email:raw-send' })).status).toBe(409);
+    const res = await install({ slug: 'pretty-dates', version: '1.0.0', type: 'plugin', acceptPermissions: ['email:send', 'email:raw-send'] });
+    expect(res.status).toBe(200);
+    expect(registry.get('pretty-dates')!.permissions).toEqual(['email:read', 'email:send', 'email:raw-send']);
+  });
+
+  it('asks nothing when nothing is added, or on a first install', async () => {
+    registry.set('pretty-dates', { ...INSTALLED });
+    directory(await bundle({ ...MANIFEST, id: 'pretty-dates' }));
+    expect((await install({ slug: 'pretty-dates', version: '1.0.0', type: 'plugin' })).status).toBe(200);
+    registry.clear();
+    directory(await bundle({ ...MANIFEST, id: 'pretty-dates', permissions: ['email:read', 'email:send'] }));
+    expect((await install({ slug: 'pretty-dates', version: '1.0.0', type: 'plugin' })).status).toBe(200);
+  });
+});

app/api/admin/marketplace/__tests__/updates.test.ts

@@ -17,7 +17,7 @@ vi.mock('@/lib/admin/config-manager', () => ({
 vi.mock('@/lib/admin/plugin-registry', () => ({
   getPluginRegistry: vi.fn(async () => ({
     plugins: [
-      { id: 'quick-reply', name: 'Quick Reply', version: '1.2.0', enabled: true, source: { kind: 'marketplace', slug: 'quick-reply', directoryUrl: 'https://extensions.test' } },
+      { id: 'quick-reply', name: 'Quick Reply', version: '1.2.0', permissions: ['email:read'], enabled: true, source: { kind: 'marketplace', slug: 'quick-reply', directoryUrl: 'https://extensions.test' } },
       { id: 'house-plugin', name: 'House', version: '0.1.0', enabled: true, source: { kind: 'upload' } },
       // Installed before the source was recorded: still asked about.
       { id: 'old-install', name: 'Old', version: '3.0.0', enabled: false },
@@ -34,6 +34,21 @@ import { GET } from '../updates/route';
 afterEach(() => vi.unstubAllGlobals());
 
 describe('GET /api/admin/marketplace/updates', () => {
+  it('says which permissions each update adds', async () => {
+    vi.stubGlobal('fetch', vi.fn(async () => Response.json({
+      data: {
+        updates: [
+          { slug: 'quick-reply', currentVersion: '1.2.0', version: '1.3.0', channel: 'stable', changelog: null, permissions: ['email:read', 'keystore'] },
+          { slug: 'old-install', currentVersion: '3.0.0', version: '3.1.0', channel: 'stable', changelog: null },
+        ],
+        yanked: [], deprecated: [], suspended: [], advisories: [], unknown: [],
+      },
+    })));
+    const body = await (await GET(new NextRequest('http://localhost/api/admin/marketplace/updates'))).json();
+    expect(body.updates[0].addedPermissions).toEqual(['keystore']);
+    expect(body.updates[1].addedPermissions).toEqual([]);
+  });
+
   it('asks the directory about the marketplace installs only, on the configured channel', async () => {
     let posted: { url: string; body: unknown } | null = null;
     vi.stubGlobal('fetch', vi.fn(async (url: string, init: RequestInit) => {

app/api/admin/marketplace/route.ts

@@ -42,7 +42,7 @@ import {
   type DirectorySummary,
   type DirectoryVersion,
 } from '@/lib/admin/marketplace-directory';
-import { MAX_PLUGIN_SIZE, MAX_THEME_SIZE } from '@/lib/plugin-types';
+import { MAX_PLUGIN_SIZE, MAX_THEME_SIZE, IMPLICIT_PERMISSIONS } from '@/lib/plugin-types';
 import { createHash } from 'node:crypto';
 import { devicePolicyPluginRefusal } from '@/lib/desktop/server-policy';
 
@@ -116,7 +116,7 @@ export async function POST(request: NextRequest) {
     }
 
     const ip = getClientIP(request);
-    const { slug, version, type, force } = await request.json();
+    const { slug, version, type, force, acceptPermissions } = await request.json();
 
     if (!slug || !version || !type) {
       return NextResponse.json({ error: 'Missing slug, version, or type' }, { status: 400 });
@@ -340,6 +340,20 @@ export async function POST(request: NextRequest) {
     const existingPlugin = await getPlugin(slug);
     const isUpdate = existingPlugin !== null;
 
+    // An update must not widen what a plugin may do with nobody seeing it. `force` is for
+    // withdrawn and older versions, and says nothing about this.
+    const implicit = new Set<string>(IMPLICIT_PERMISSIONS);
+    const permissionsAdded = isUpdate
+      ? manifest.permissions.filter((p) => !existingPlugin.permissions?.includes(p) && !implicit.has(p))
+      : [];
+    const accepted = Array.isArray(acceptPermissions) ? acceptPermissions : [];
+    if (permissionsAdded.some((p) => !accepted.includes(p))) {
+      return NextResponse.json(
+        { error: `Version ${version} asks for new permissions: ${permissionsAdded.join(', ')}.`, permissionsAdded },
+        { status: 409 },
+      );
+    }
+
     const plugin: ServerPlugin = {
       id: slug,
       name: manifest.name,
@@ -382,6 +396,7 @@ export async function POST(request: NextRequest) {
         httpOrigins: plugin.httpOrigins ?? [],
         apiPostPaths: plugin.apiPostPaths ?? [],
         signature: signature.status,
+        ...(permissionsAdded.length > 0 ? { permissionsAdded } : {}),
         ...(meta.yanked ? { yanked: true } : {}),
         ...(isUpdate ? { previousVersion: existingPlugin.version } : {}),
       },

app/api/admin/marketplace/updates/route.ts

@@ -1,6 +1,8 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { requireAdminAuth } from '@/lib/admin/session';
 import { logger } from '@/lib/logger';
+import { getPluginRegistry } from '@/lib/admin/plugin-registry';
+import { IMPLICIT_PERMISSIONS } from '@/lib/plugin-types';
 import {
   APP_VERSION,
   DirectoryError,
@@ -19,7 +21,8 @@ import {
 
 export interface UpdatesAnswer {
   /** `changelogs` is missing from directories older than 2026-10-30; `changelog` is then the offered version's alone. */
-  updates: Array<DirectoryVersion & { slug: string; currentVersion: string; changelog: string | null; changelogs?: DirectoryChangelogEntry[] }>;
+  /** `addedPermissions` is what the directory lists against what's installed; the install itself reads the bundle. */
+  updates: Array<DirectoryVersion & { slug: string; currentVersion: string; changelog: string | null; changelogs?: DirectoryChangelogEntry[]; addedPermissions?: string[] }>;
   yanked: Array<{ slug: string; version: string; reason: string | null; at: string }>;
   deprecated: Array<{ slug: string; message: string | null; replacement: string | null }>;
   suspended: string[];
@@ -66,6 +69,13 @@ export async function GET(request: NextRequest) {
           body: JSON.stringify({ appVersion: APP_VERSION || undefined, channel, installed: ask }),
         });
         answer = { ...EMPTY, ...res.data };
+        const { plugins } = await getPluginRegistry();
+        const held = new Map(plugins.map((p) => [p.id, new Set<string>(p.permissions ?? [])]));
+        const implicit = new Set<string>(IMPLICIT_PERMISSIONS);
+        answer.updates = answer.updates.map((u) => ({
+          ...u,
+          addedPermissions: (u.permissions ?? []).filter((p) => !implicit.has(p) && !(held.get(u.slug)?.has(p) ?? true)),
+        }));
       } catch (err) {
         // The installed list is still useful without the directory; say what
         // went wrong instead of failing the whole view.

app/api/auth/desktop-handoff/check/route.ts

@@ -0,0 +1,61 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { logger } from '@/lib/logger';
+import { resolveDesktopHandoffServer } from '@/lib/auth/desktop-handoff-server';
+import { loginClientAddress } from '@/lib/auth/client-address';
+import { isStoreUnavailable, storeUnavailableResponse } from '@/lib/auth/store-unavailable';
+import { LOGIN_BUDGET_RETRY_AFTER_SECONDS, reserveLoginAttempt } from '@/lib/auth/verify-budget';
+import { JmapAuthVerificationError, verifyJmapAuth } from '@/lib/auth/verify-jmap-auth';
+import { rejectCrossOriginRequest } from '@/lib/security/same-origin';
+
+// The desktop app's sign-in, in the browser, before the question: is this password right?
+// So a password manager never saves a wrong one, and the user isn't asked about a sign-in
+// that can't work. Nothing is kept: the page holds the password until the user says yes.
+
+const NO_STORE = { 'Cache-Control': 'no-store' };
+
+function answer(error: string, status: number) {
+  return NextResponse.json({ error }, { status, headers: NO_STORE });
+}
+
+export async function POST(request: NextRequest) {
+  const crossOrigin = rejectCrossOriginRequest(request);
+  if (crossOrigin) return crossOrigin;
+  try {
+    const body = await request.json().catch(() => null);
+    const { server_url: serverUrl, username, password } = body ?? {};
+    if (
+      typeof serverUrl !== 'string' || !serverUrl || serverUrl.length > 2048
+      || typeof username !== 'string' || !username || username.length > 512
+      || typeof password !== 'string' || !password || password.length > 4096
+    ) {
+      return answer('invalid_request', 400);
+    }
+    const server = await resolveDesktopHandoffServer(serverUrl, body?.server_id);
+    if ('refusal' in server) return answer(server.refusal.error, server.refusal.status);
+
+    const clientIp = loginClientAddress(request, server.upstream);
+    const refund = await reserveLoginAttempt(clientIp);
+    if (!refund) {
+      return NextResponse.json(
+        { error: 'too_many_attempts' },
+        { status: 429, headers: { ...NO_STORE, 'Retry-After': String(LOGIN_BUDGET_RETRY_AFTER_SECONDS) } },
+      );
+    }
+    try {
+      await verifyJmapAuth(server.upstream, `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`, { trusted: server.trusted, clientIp });
+      await refund();
+      return NextResponse.json({ ok: true }, { headers: NO_STORE });
+    } catch (error) {
+      const status = error instanceof JmapAuthVerificationError ? error.upstreamStatus : undefined;
+      if (status === 401) return answer('invalid_credentials', 401);
+      await refund();
+      // Stalwart: the right password on an account with a second factor.
+      if (status === 402) return answer('totp_required', 401);
+      return answer('login_failed', 502);
+    }
+  } catch (error) {
+    if (isStoreUnavailable(error)) return storeUnavailableResponse(NO_STORE);
+    logger.error('Desktop hand-off check error', { error: error instanceof Error ? error.message : 'Unknown error' });
+    return answer('Internal server error', 500);
+  }
+}

app/api/auth/desktop-handoff/discard/route.ts

@@ -0,0 +1,31 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { logger } from '@/lib/logger';
+import { revokeParkedTokens } from '@/lib/auth/desktop-handoff-revoke';
+import { discardDesktopHandoff, isHandoffCode } from '@/lib/auth/handoff-store';
+import { isStoreUnavailable, storeUnavailableResponse } from '@/lib/auth/store-unavailable';
+import { rejectCrossOriginRequest } from '@/lib/security/same-origin';
+
+// "Not now" on an SSO sign-in the desktop app asked for, or its tab closed. sso/complete
+// has to park the tokens before the question can be shown, so this is what ends them: gone
+// from the store, and revoked where the provider can. Only the page holding the code knows it.
+
+const NO_STORE = { 'Cache-Control': 'no-store' };
+
+export async function POST(request: NextRequest) {
+  const crossOrigin = rejectCrossOriginRequest(request);
+  if (crossOrigin) return crossOrigin;
+  try {
+    const body = await request.json().catch(() => null);
+    if (!isHandoffCode(body?.code)) return NextResponse.json({ error: 'invalid_code' }, { status: 400, headers: NO_STORE });
+    const parked = await discardDesktopHandoff(body.code);
+    if (parked) {
+      await revokeParkedTokens(parked);
+      logger.info('Desktop hand-off discarded', { flow: parked.flow });
+    }
+    return NextResponse.json({ ok: true }, { headers: NO_STORE });
+  } catch (error) {
+    if (isStoreUnavailable(error)) return storeUnavailableResponse(NO_STORE);
+    logger.error('Desktop hand-off discard error', { error: error instanceof Error ? error.message : 'Unknown error' });
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500, headers: NO_STORE });
+  }
+}

app/api/auth/desktop-handoff/park/route.ts

@@ -0,0 +1,136 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { logger } from '@/lib/logger';
+import { configManager } from '@/lib/admin/config-manager';
+import { loginClientAddress } from '@/lib/auth/client-address';
+import { resolveDesktopHandoffServer } from '@/lib/auth/desktop-handoff-server';
+import { isHandoffCodeChallenge, reserveDesktopHandoffPark, stashHandoff } from '@/lib/auth/handoff-store';
+import { stalwartPasswordLogin } from '@/lib/auth/stalwart-password-login';
+import { isStoreUnavailable, storeUnavailableResponse } from '@/lib/auth/store-unavailable';
+import { LOGIN_BUDGET_RETRY_AFTER_SECONDS, reserveLoginAttempt } from '@/lib/auth/verify-budget';
+import { JmapAuthVerificationError, verifyJmapAuth } from '@/lib/auth/verify-jmap-auth';
+import { DEFAULT_CLIENT_ID } from '@/lib/oauth/token-exchange';
+import { readFileEnv } from '@/lib/read-file-env';
+import { rejectCrossOriginRequest } from '@/lib/security/same-origin';
+
+// The desktop app's "Sign in with your browser", on the browser's side, after the user
+// said yes. /check tested the password; until now it has only been in the page. It goes
+// no further than it has to: Stalwart's login turns it into tokens, and those are what's
+// parked. A password is parked only for a server with no such login, for 60 seconds, for
+// whoever holds the verifier. Nothing here writes a cookie, so this browser gets no session.
+//
+// A two-factor code works once, so it's only spent here, after the yes. Tokens minted here
+// are never dropped for budget reasons: the budget is reserved first, and a success gives
+// it back, so an office behind one address can sign in as often as it likes.
+
+const NO_STORE = { 'Cache-Control': 'no-store' };
+
+function bounded(value: unknown, max: number): value is string {
+  return typeof value === 'string' && value.length > 0 && value.length <= max;
+}
+
+function answer(error: string, status: number, headers: Record<string, string> = NO_STORE) {
+  return NextResponse.json({ error }, { status, headers });
+}
+
+const tooMany = () => answer('too_many_attempts', 429, { ...NO_STORE, 'Retry-After': String(LOGIN_BUDGET_RETRY_AFTER_SECONDS) });
+
+export async function POST(request: NextRequest) {
+  const crossOrigin = rejectCrossOriginRequest(request);
+  if (crossOrigin) return crossOrigin;
+  try {
+    const body = await request.json().catch(() => null);
+    const challenge = body?.code_challenge;
+    const state = typeof body?.state === 'string' ? body.state : '';
+    const totp = typeof body?.totp === 'string' && body.totp ? body.totp : undefined;
+    if (
+      !isHandoffCodeChallenge(challenge)
+      || !state
+      || state.length > 512
+      || !bounded(body?.server_url, 2048)
+      || !bounded(body?.username, 512)
+      || !bounded(body?.password, 4096)
+      || (totp !== undefined && totp.length > 16)
+    ) {
+      return answer('invalid_request', 400);
+    }
+
+    const server = await resolveDesktopHandoffServer(body.server_url, body.server_id);
+    if ('refusal' in server) return answer(server.refusal.error, server.refusal.status);
+    const { entry, resolved, upstream, trusted, custom } = server;
+
+    const clientIp = loginClientAddress(request, upstream);
+    // Before anything goes upstream, so a code is never spent on a sign-in that can't finish.
+    const refundPark = await reserveDesktopHandoffPark(clientIp);
+    if (!refundPark) return tooMany();
+    const refundLogin = await reserveLoginAttempt(clientIp);
+    if (!refundLogin) return tooMany();
+
+    const configuredClientId =
+      entry?.oauth?.clientId || configManager.get<string>('oauthClientId', '') || process.env.OAUTH_CLIENT_ID;
+    const clientSecret =
+      entry?.oauth?.clientSecret
+      || configManager.get<string>('oauthClientSecret', '')
+      || process.env.OAUTH_CLIENT_SECRET
+      || readFileEnv(process.env.OAUTH_CLIENT_SECRET_FILE)
+      || '';
+    const redirectUri = typeof body?.redirect_uri === 'string' && /^https?:\/\//.test(body.redirect_uri) ? body.redirect_uri : upstream;
+    const login = await stalwartPasswordLogin({
+      serverUrl: upstream,
+      username: body.username,
+      password: body.password,
+      totp,
+      clientId: configuredClientId || DEFAULT_CLIENT_ID,
+      clientSecret,
+      redirectUri,
+      trusted,
+      clientIp,
+      registerUnknownClient: !configuredClientId,
+    });
+
+    let parked: Parameters<typeof stashHandoff>[0];
+    if (login.ok) {
+      parked = {
+        flow: 'desktop-tokens',
+        server_url: resolved,
+        server_id: entry?.id ?? null,
+        custom,
+        password_login: true,
+        username: body.username,
+        access_token: login.tokens.access_token,
+        refresh_token: login.tokens.refresh_token,
+        expires_in: login.tokens.expires_in ?? 3600,
+        signed_in_at: Date.now(),
+      };
+      await refundLogin();
+    } else if (login.error === 'invalid_credentials') {
+      return answer('invalid_credentials', 401);
+    } else if (login.error === 'totp_required') {
+      await refundLogin();
+      return answer('totp_required', 401);
+    } else if (totp) {
+      await refundLogin();
+      return answer('login_failed', 502);
+    } else {
+      // The last resort: a server with no token login, or one that won't give this client any.
+      try {
+        await verifyJmapAuth(upstream, `Basic ${Buffer.from(`${body.username}:${body.password}`).toString('base64')}`, { trusted, clientIp });
+        await refundLogin();
+      } catch (error) {
+        const status = error instanceof JmapAuthVerificationError ? error.upstreamStatus : undefined;
+        if (status === 401) return answer('invalid_credentials', 401);
+        await refundLogin();
+        return status === 402 ? answer('totp_required', 401) : answer('login_failed', 502);
+      }
+      parked = { flow: 'desktop-password', server_url: resolved, server_id: entry?.id ?? null, custom, username: body.username, password: body.password };
+    }
+
+    const code = await stashHandoff(parked, { challenge, state });
+    await refundPark();
+    logger.info('Desktop hand-off parked', { flow: parked.flow });
+    return NextResponse.json({ code }, { headers: NO_STORE });
+  } catch (error) {
+    if (isStoreUnavailable(error)) return storeUnavailableResponse(NO_STORE);
+    logger.error('Desktop hand-off park error', { error: error instanceof Error ? error.message : 'Unknown error' });
+    return answer('Internal server error', 500);
+  }
+}

app/api/auth/desktop-handoff/redeem/route.ts

@@ -0,0 +1,114 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { logger } from '@/lib/logger';
+import { MAX_ACCOUNT_SLOTS } from '@/lib/account-utils';
+import { loginClientAddress } from '@/lib/auth/client-address';
+import { desktopHandoffEnabled } from '@/lib/auth/desktop-handoff-server';
+import { revokeParkedTokens } from '@/lib/auth/desktop-handoff-revoke';
+import { configManager } from '@/lib/admin/config-manager';
+import { isHandoffCode, isHandoffCodeVerifier, redeemHandoff, reserveHandoffRedeem } from '@/lib/auth/handoff-store';
+import { writeSignInStamp } from '@/lib/auth/session-age';
+import { isStoreUnavailable, storeUnavailableResponse } from '@/lib/auth/store-unavailable';
+import type { BudgetRefund } from '@/lib/auth/verify-budget';
+import { IS_DESKTOP_BUILD } from '@/lib/desktop/flag';
+import { jmapServerAllowed } from '@/lib/desktop/policy-schema';
+import { getCookieOptions, getSignInCookieOptions } from '@/lib/oauth/cookie-config';
+import { storeIdToken } from '@/lib/oauth/end-session';
+import { refreshTokenCookieName, refreshTokenServerCookieName } from '@/lib/oauth/tokens';
+import { rejectCrossOriginRequest } from '@/lib/security/same-origin';
+
+// The desktop app's side of "Sign in with your browser", on an instance. The app's own
+// page posts the code its loopback listener received, with the PKCE verifier behind the
+// challenge it opened the browser with. Same origin as the page, so an instance's cookies
+// set here work under SameSite=Strict. Every attempt spends the code.
+//
+// The device's rules are the page's to send: only it knows the OS policy, and the browser
+// the user signed in with knows nothing of it. That's its list of servers, and whether it
+// may use a server of the user's own. A refused server gets nothing written, and a token
+// minted for it is revoked.
+
+const NO_STORE = { 'Cache-Control': 'no-store' };
+
+function answer(error: string, status: number, extra: Record<string, unknown> = {}) {
+  return NextResponse.json({ error, ...extra }, { status, headers: NO_STORE });
+}
+
+export async function POST(request: NextRequest) {
+  if (IS_DESKTOP_BUILD) return answer('Not found', 404);
+  const crossOrigin = rejectCrossOriginRequest(request);
+  if (crossOrigin) return crossOrigin;
+  await configManager.ensureLoaded();
+  if (!desktopHandoffEnabled()) return answer('disabled', 403);
+  let refund: BudgetRefund | null = null;
+  try {
+    refund = await reserveHandoffRedeem(loginClientAddress(request));
+    if (!refund) return answer('too_many_requests', 429);
+
+    const body = await request.json().catch(() => null);
+    const code = body?.code;
+    const verifier = body?.code_verifier;
+    if (!isHandoffCode(code)) return answer('invalid_request', 400);
+    if (!isHandoffCodeVerifier(verifier)) {
+      await redeemHandoff(code, '');
+      return answer('invalid_verifier', 400);
+    }
+    const slot = typeof body?.slot === 'number' && Number.isInteger(body.slot) && body.slot >= 0 && body.slot < MAX_ACCOUNT_SLOTS ? body.slot : 0;
+    const remember = body?.remember !== false;
+    const allowedServers = Array.isArray(body?.allowed_servers) ? (body.allowed_servers as string[]) : null;
+
+    const result = await redeemHandoff(code, verifier);
+    if (!result.ok) {
+      logger.warn('Desktop hand-off redeem refused', { reason: result.reason });
+      return answer(result.reason === 'verifier_mismatch' ? 'invalid_verifier' : `${result.reason}_code`, 400);
+    }
+    const parked = result.bundle;
+    // A code the mobile path parked isn't one of ours.
+    if (parked.flow !== 'desktop-password' && parked.flow !== 'desktop-tokens') return answer('invalid_code', 400);
+    if (!jmapServerAllowed(allowedServers, parked.server_url) || (parked.custom && body?.custom_servers_allowed !== true)) {
+      await revokeParkedTokens(parked);
+      return answer('blocked_by_policy', 403, { code: 'blocked_by_policy' });
+    }
+
+    await refund();
+    logger.info('Desktop hand-off redeemed', { flow: parked.flow });
+
+    if (parked.flow === 'desktop-password') {
+      // Down the app's normal login path, from the page, like a typed password.
+      return NextResponse.json(
+        { flow: 'password', server_url: parked.server_url, username: parked.username, password: parked.password },
+        { headers: NO_STORE },
+      );
+    }
+
+    const cookieStore = await cookies();
+    if (parked.refresh_token) {
+      const options = getSignInCookieOptions(remember);
+      cookieStore.set(refreshTokenCookieName(slot), parked.refresh_token, options);
+      writeSignInStamp(cookieStore, slot, { signedInAt: parked.signed_in_at, refreshToken: parked.refresh_token }, options);
+    }
+    const serverCookie = refreshTokenServerCookieName(slot);
+    if (parked.server_id) cookieStore.set(serverCookie, parked.server_id, getCookieOptions());
+    else cookieStore.delete(serverCookie);
+    storeIdToken(cookieStore, slot, parked.id_token, request.nextUrl.basePath, [parked.refresh_token, parked.server_id], remember);
+
+    return NextResponse.json(
+      {
+        flow: 'tokens',
+        server_url: parked.server_url,
+        ...(parked.password_login && parked.username ? { password_login: true, username: parked.username } : {}),
+        access_token: parked.access_token,
+        expires_in: parked.expires_in,
+        signed_in_at: parked.signed_in_at,
+        remember,
+      },
+      { headers: NO_STORE },
+    );
+  } catch (error) {
+    if (isStoreUnavailable(error)) {
+      if (refund) await refund();
+      return storeUnavailableResponse(NO_STORE);
+    }
+    logger.error('Desktop hand-off redeem error', { error: error instanceof Error ? error.message : 'Unknown error' });
+    return answer('Internal server error', 500);
+  }
+}

app/api/auth/desktop-oauth/route.ts

@@ -10,6 +10,8 @@ import { rejectCrossOriginRequest } from '@/lib/security/same-origin';
 /** The client id on a server that won't register one: 0.16 accepts any id. */
 const FALLBACK_CLIENT_ID = 'bulwark-desktop';
 const REGISTERED_REDIRECT = 'http://127.0.0.1/bulwark-desktop/callback';
+/** Only tried when the server says no to loopback. Neither Stalwart line takes this one. */
+const SCHEME_REDIRECT = 'bulwark://sign-in/callback';
 const REGISTER_TIMEOUT_MS = 5000;
 
 function isLoopbackRedirect(value: unknown): boolean {
@@ -27,29 +29,42 @@ function isLoopbackRedirect(value: unknown): boolean {
  * ids are stateless, so the same metadata gives the same id and nothing is
  * stored. It accepts a loopback redirect and ignores the port when matching.
  */
-async function registerClient(base: string, scope: string): Promise<string> {
+async function postRegistration(endpoint: string, redirectUri: string, scope: string): Promise<Response> {
+  return fetch(endpoint, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      client_name: 'Bulwark',
+      redirect_uris: [redirectUri],
+      token_endpoint_auth_method: 'none',
+      grant_types: ['authorization_code', 'refresh_token'],
+      response_types: ['code'],
+      scope,
+    }),
+    redirect: 'error',
+    signal: AbortSignal.timeout(REGISTER_TIMEOUT_MS),
+  });
+}
+
+async function clientIdOf(response: Response): Promise<string | null> {
+  const body = (await response.json().catch(() => null)) as { client_id?: unknown } | null;
+  return typeof body?.client_id === 'string' && body.client_id ? body.client_id : null;
+}
+
+async function registerClient(endpoint: string, scope: string): Promise<{ clientId: string; useScheme: boolean }> {
   try {
-    const response = await fetch(`${base}/auth/register`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        client_name: 'Bulwark',
-        redirect_uris: [REGISTERED_REDIRECT],
-        token_endpoint_auth_method: 'none',
-        grant_types: ['authorization_code', 'refresh_token'],
-        response_types: ['code'],
-        scope,
-      }),
-      redirect: 'error',
-      signal: AbortSignal.timeout(REGISTER_TIMEOUT_MS),
-    });
-    if (!response.ok) return FALLBACK_CLIENT_ID;
-    const body = (await response.json()) as { client_id?: unknown };
-    return typeof body.client_id === 'string' && body.client_id ? body.client_id : FALLBACK_CLIENT_ID;
+    const response = await postRegistration(endpoint, REGISTERED_REDIRECT, scope);
+    if (response.ok) return { clientId: (await clientIdOf(response)) ?? FALLBACK_CLIENT_ID, useScheme: false };
+    const refusal = (await response.json().catch(() => null)) as { error?: unknown } | null;
+    if (refusal?.error === 'invalid_redirect_uri') {
+      const second = await postRegistration(endpoint, SCHEME_REDIRECT, scope);
+      const clientId = second.ok ? await clientIdOf(second) : null;
+      if (clientId) return { clientId, useScheme: true };
+    }
   } catch (error) {
     logger.warn('Desktop OAuth: client registration failed', { error: error instanceof Error ? error.message : String(error) });
-    return FALLBACK_CLIENT_ID;
   }
+  return { clientId: FALLBACK_CLIENT_ID, useScheme: false };
 }
 
 /**
@@ -74,10 +89,17 @@ export async function POST(request: NextRequest) {
     if (!metadata) return NextResponse.json({ error: 'no_oauth' }, { status: 404 });
 
     const scope = withProviderDataScopes(DEFAULT_OAUTH_SCOPES, metadata.scopes_supported);
+    // RFC 8414 says where. Without it, Stalwart's path: 0.16's documents don't always name it.
+    const validate = getDiscoveryValidator(upstream.serverUrl);
+    const named = metadata.registration_endpoint;
+    const endpoint = named && (!validate || (await validate(named))) ? named : `${upstream.serverUrl}/auth/register`;
+    const { clientId, useScheme } = await registerClient(endpoint, scope);
     return NextResponse.json({
       authorization_endpoint: metadata.authorization_endpoint,
-      client_id: await registerClient(upstream.serverUrl, scope),
+      client_id: clientId,
       scope,
+      issuer: metadata.issuer,
+      ...(useScheme ? { use_scheme: true } : {}),
     });
   } catch (error) {
     logger.error('Desktop OAuth discovery failed', { error: error instanceof Error ? error.message : 'Unknown error' });

app/api/auth/handoff/redeem/route.ts

@@ -53,6 +53,11 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error }, { status: 400, headers: NO_STORE });
     }
 
+    // The desktop app's sign-in has its own redeem, which writes cookies from these fields.
+    if (result.bundle.flow === 'desktop-password' || result.bundle.flow === 'desktop-tokens') {
+      return NextResponse.json({ error: 'invalid_code' }, { status: 400, headers: NO_STORE });
+    }
+
     await refund();
     logger.info('Mobile hand-off redeemed', { flow: result.bundle.flow });
     return NextResponse.json({ ...result.bundle, state: result.state }, { headers: NO_STORE });

app/api/auth/sso/complete/route.ts

@@ -10,6 +10,7 @@ import {
 } from '@/lib/oauth/token-exchange';
 import { buildRedeemBundle } from '@/lib/auth/pair-bundle';
 import { isHandoffCodeChallenge, stashHandoff } from '@/lib/auth/handoff-store';
+import { desktopHandoffTarget } from '@/lib/auth/mobile-handoff';
 import { isStoreUnavailable, storeUnavailableResponse } from '@/lib/auth/store-unavailable';
 import { refreshTokenCookieName, refreshTokenServerCookieName } from '@/lib/oauth/tokens';
 import { getCookieOptions, getSignInCookieOptions } from '@/lib/oauth/cookie-config';
@@ -35,6 +36,32 @@ function webmailBaseFromCallback(redirectUri: string): string | null {
   }
 }
 
+/**
+ * Who just signed in, for the question the desktop app's hand-off asks: the id token says, as
+ * it came straight from the provider, and otherwise the mail server's session does.
+ */
+async function accountName(serverUrl: string, accessToken: string, idToken: string | undefined): Promise<string> {
+  try {
+    const claims = JSON.parse(Buffer.from((idToken ?? '').split('.')[1] ?? '', 'base64url').toString('utf8')) as Record<string, unknown>;
+    for (const claim of ['email', 'preferred_username', 'name']) {
+      if (typeof claims[claim] === 'string' && claims[claim]) return claims[claim] as string;
+    }
+  } catch {
+    // Not a JWT, or none: the server can say.
+  }
+  try {
+    const session = await fetch(`${serverUrl.replace(/\/+$/, '')}/.well-known/jmap`, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+      redirect: 'error',
+      signal: AbortSignal.timeout(5000),
+    });
+    const body = (await session.json()) as { username?: unknown };
+    return typeof body.username === 'string' ? body.username : '';
+  } catch {
+    return '';
+  }
+}
+
 export async function POST(request: NextRequest) {
   // CSRF gate (GHSA-qvr9-m8cq-7wvg): cookies written here are SameSite=Lax,
   // so a cross-site top-level POST would otherwise reach this handler.
@@ -149,6 +176,30 @@ export async function POST(request: NextRequest) {
       // builds refuse a provider on another host, so those renew through
       // this webmail - the same bundle a paired phone gets.
       const { clientId, serverUrl } = getRequiredConfig(pendingServerId);
+      if (mobileRedirectUri && desktopHandoffTarget(mobileRedirectUri)) {
+        // The desktop app on this instance: its redeem writes its own cookies, the way
+        // the code below would have for this browser. sso/start made sure of a challenge.
+        if (!mobileCodeChallenge) throw new Error('desktop hand-off without a challenge');
+        const handoffCode = await stashHandoff({
+          flow: 'desktop-tokens',
+          server_url: serverUrl,
+          server_id: pendingServerId,
+          custom: false,
+          access_token: tokens.access_token,
+          refresh_token: tokens.refresh_token,
+          id_token: tokens.id_token,
+          expires_in: tokens.expires_in ?? 3600,
+          signed_in_at: signedInAt,
+        }, { challenge: mobileCodeChallenge, state: mobileState ?? '', awaitConfirm: true });
+        logger.info('Desktop hand-off parked', { flow: 'desktop-tokens' });
+        return NextResponse.json({
+          mobile_handoff_code: handoffCode,
+          server_url: serverUrl,
+          account: await accountName(serverUrl, tokens.access_token, tokens.id_token),
+          mobile_redirect_uri: mobileRedirectUri,
+          mobile_state: mobileState,
+        });
+      }
       const bundle = buildRedeemBundle({
         flow: 'oauth',
         serverUrl,

app/api/auth/sso/start/route.ts

@@ -12,7 +12,8 @@ import { getCookieOptions } from '@/lib/oauth/cookie-config';
 import { hasSessionSecret } from '@/lib/auth/session-secret';
 import { configManager } from '@/lib/admin/config-manager';
 import { rejectCrossOriginRequest } from '@/lib/security/same-origin';
-import { isMobileCodeChallenge, mobileHandoffTarget } from '@/lib/auth/mobile-handoff';
+import { desktopHandoffTarget, isMobileCodeChallenge, mobileHandoffTarget } from '@/lib/auth/mobile-handoff';
+import { desktopHandoffEnabled } from '@/lib/auth/desktop-handoff-server';
 
 const SSO_PENDING_COOKIE = 'sso_pending';
 const SSO_PENDING_MAX_AGE = 300; // 5 minutes
@@ -73,9 +74,18 @@ export async function POST(request: NextRequest) {
         : null;
     const mobileState =
       typeof rawMobileState === 'string' && rawMobileState ? rawMobileState : null;
-    if (mobileRedirectUri && !mobileHandoffTarget(mobileRedirectUri)) {
+    if (mobileRedirectUri && !mobileHandoffTarget(mobileRedirectUri) && !desktopHandoffTarget(mobileRedirectUri)) {
       return NextResponse.json({ error: 'Invalid mobile_redirect_uri' }, { status: 400 });
     }
+    // The desktop app's listener only ever gets a code. Without a challenge there'd be
+    // tokens in the answer, on the way to a link.
+    if (mobileRedirectUri && desktopHandoffTarget(mobileRedirectUri) && !isMobileCodeChallenge(rawMobileCodeChallenge)) {
+      return NextResponse.json({ error: 'Invalid mobile_code_challenge' }, { status: 400 });
+    }
+    // The admin turned the desktop app's sign-in off here (a terminal server, say).
+    if (mobileRedirectUri && desktopHandoffTarget(mobileRedirectUri) && !desktopHandoffEnabled()) {
+      return NextResponse.json({ error: 'disabled' }, { status: 403 });
+    }
     // An app build that sends a PKCE challenge gets a one-time code instead
     // of the tokens (lib/auth/handoff-store.ts). A malformed one is refused
     // rather than ignored, which would hand the tokens over in the link.

app/api/config/route.ts

@@ -89,6 +89,7 @@ export async function GET(request: NextRequest) {
       loginShowSubtitle: configManager.get<boolean>('loginShowSubtitle', true),
       loginShowTotp: configManager.get<boolean>('loginShowTotp', true),
       loginShowTokenLogin: configManager.get<boolean>('loginShowTokenLogin', false),
+      desktopBrowserSignIn: configManager.get<boolean>('desktopBrowserSignIn', true),
       loginShowRememberMe: configManager.get<boolean>('loginShowRememberMe', false),
       loginShowVersion: configManager.get<boolean>('loginShowVersion', true),
       demoMode: configManager.get<boolean>('demoMode', false),

app/api/plugin-secrets/__tests__/wipe.test.ts

@@ -16,8 +16,16 @@ vi.mock('@/lib/stalwart/credentials', () => ({
 vi.mock('@/lib/admin/config-manager', () => ({
   configManager: { ensureLoaded: async () => {}, get: () => undefined, getPolicy: () => ({ features: { pluginsEnabled: true } }) },
 }));
+vi.mock('@/lib/plugin-secrets/known-plugins', () => ({
+  declaredUserCredential: async () => ({ inject: { type: 'bearer' } }),
+}));
+vi.mock('@/lib/plugin-secrets/proxy', () => ({
+  adminCredentialOrigins: async () => [],
+  adminCredentialStatus: async () => [],
+}));
 vi.mock('@/lib/plugin-secrets/vault', () => ({
   VaultFullError: class extends Error {},
+  userKey: (user: { username: string; serverUrl: string }) => `${Buffer.from(`${user.username}:${user.serverUrl}`).toString('hex')}0000000000000000`.slice(0, 64),
   deleteAllUserCredentials: vi.fn(async (user: unknown) => { deleted.push(user); }),
   deleteUserCredentials: vi.fn(async () => {}),
   listUserCredentials: vi.fn(async () => []),
@@ -31,10 +39,23 @@ async function remove(query: string, headers: Record<string, string> = { 'sec-fe
 }
 
 const EVICTED = 'all=true&username=alice&server=https%3A%2F%2Fmail.example.org';
+const SAME_ORIGIN = { 'sec-fetch-site': 'same-origin' };
+
+/** The proof cookie an account gets while signed in, as `name=value`. */
+async function proofFor(username: string): Promise<string> {
+  vi.resetModules();
+  const { setWipeProof } = await import('@/lib/plugin-secrets/wipe-proof');
+  const { NextResponse } = await import('next/server');
+  const answer = NextResponse.json({});
+  setWipeProof(answer, { username, serverUrl: 'https://mail.example.org' });
+  const cookie = answer.cookies.getAll()[0];
+  return `${cookie.name}=${cookie.value}`;
+}
 
 beforeEach(() => {
   deleted.length = 0;
   session.signedIn = false;
+  vi.stubEnv('SESSION_SECRET', 'wipe-test-session-secret-wipe-test-session-secret');
 });
 
 afterEach(() => {
@@ -42,23 +63,58 @@ afterEach(() => {
 });
 
 describe('DELETE /api/plugin-secrets?all=true', () => {
-  it('in the desktop app takes a dropped account by who it was, with no cookie', async () => {
+  it('in the desktop app takes a dropped account by who it was, with the proof it got while signed in', async () => {
     vi.stubEnv('NEXT_PUBLIC_BULWARK_DESKTOP', '1');
-    expect((await remove(EVICTED)).status).toBe(200);
+    const answer = await remove(EVICTED, { ...SAME_ORIGIN, cookie: await proofFor('alice') });
+    expect(answer.status).toBe(200);
     expect(deleted).toEqual([{ username: 'alice', serverUrl: 'https://mail.example.org' }]);
+    expect(answer.headers.get('set-cookie')).toMatch(/Max-Age=0/i);
+  });
+
+  it('in the desktop app won\'t take any name on its own', async () => {
+    vi.stubEnv('NEXT_PUBLIC_BULWARK_DESKTOP', '1');
+    expect((await remove(EVICTED)).status).toBe(401);
+    expect(deleted).toEqual([]);
+  });
+
+  it('in the desktop app won\'t take another account\'s proof, or the signed-in account\'s session, for that name', async () => {
+    vi.stubEnv('NEXT_PUBLIC_BULWARK_DESKTOP', '1');
+    session.signedIn = true;
+    const bob = await proofFor('bob');
+    const aliceName = (await proofFor('alice')).split('=')[0];
+    expect((await remove(EVICTED, { ...SAME_ORIGIN, cookie: `${aliceName}=${bob.split('=').slice(1).join('=')}` })).status).toBe(401);
+    expect((await remove(EVICTED, { ...SAME_ORIGIN, cookie: `${aliceName}=forged` })).status).toBe(401);
+    expect(deleted).toEqual([]);
   });
 
   it('won\'t take it from another site', async () => {
     vi.stubEnv('NEXT_PUBLIC_BULWARK_DESKTOP', '1');
-    expect((await remove(EVICTED, { 'sec-fetch-site': 'cross-site' })).status).toBe(403);
+    const cookie = await proofFor('alice');
+    expect((await remove(EVICTED, { 'sec-fetch-site': 'cross-site', cookie })).status).toBe(403);
     expect(deleted).toEqual([]);
   });
 
+  it('gives the proof when an account lists what it has, in the desktop app only', async () => {
+    session.signedIn = true;
+    const list = async () => {
+      vi.resetModules();
+      const vault = await import('@/lib/plugin-secrets/vault');
+      vi.mocked(vault.listUserCredentials).mockResolvedValueOnce([{ pluginId: 'p' } as never]);
+      const { GET } = await import('../route');
+      return GET(new NextRequest('https://app.local/api/plugin-secrets', { headers: SAME_ORIGIN }));
+    };
+    expect((await list()).headers.get('set-cookie')).toBeNull();
+    vi.stubEnv('NEXT_PUBLIC_BULWARK_DESKTOP', '1');
+    expect((await list()).headers.get('set-cookie')).toMatch(/^jmap_psp_/);
+  });
+
   it('on an instance deletes nobody\'s, with a cookie or without', async () => {
     expect((await remove(EVICTED)).status).toBe(401);
     session.signedIn = true;
     await remove(EVICTED);
     expect(deleted).toEqual([]);
+    await remove(EVICTED, { ...SAME_ORIGIN, cookie: await proofFor('alice') });
+    expect(deleted).toEqual([]);
   });
 
   it('in the desktop app with a cookie and no name takes the signed-in account', async () => {

app/api/plugin-secrets/route.ts

@@ -15,6 +15,7 @@ import {
 } from '@/lib/plugin-secrets/vault';
 import { storedDataUnavailableResponse } from '@/lib/stored-data-errors';
 import { IS_DESKTOP_BUILD } from '@/lib/desktop/flag';
+import { clearWipeProof, hasWipeProof, setWipeProof } from '@/lib/plugin-secrets/wipe-proof';
 
 const PLUGIN_ID_RE = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 const MAX_SECRET_LENGTH = 4096;
@@ -52,7 +53,9 @@ export async function GET(request: NextRequest) {
   const [admin, adminOrigins] = pluginId
     ? await Promise.all([adminCredentialStatus(pluginId), adminCredentialOrigins(pluginId)])
     : [[], []];
-  return NextResponse.json({ credentials, admin, adminOrigins }, { headers: NO_STORE });
+  const answer = NextResponse.json({ credentials, admin, adminOrigins }, { headers: NO_STORE });
+  if (IS_DESKTOP_BUILD && credentials.length > 0) setWipeProof(answer, user);
+  return answer;
 }
 
 /**
@@ -107,21 +110,28 @@ export async function POST(request: NextRequest) {
     if (unavailable) return unavailable;
     throw error;
   }
-  return NextResponse.json({ ok: true }, { headers: NO_STORE });
+  const answer = NextResponse.json({ ok: true }, { headers: NO_STORE });
+  if (IS_DESKTOP_BUILD) setWipeProof(answer, user);
+  return answer;
 }
 
 /** DELETE /api/plugin-secrets?plugin=<id>[&credential=<id>] - disconnect. */
 export async function DELETE(request: NextRequest) {
   const crossOrigin = rejectCrossOriginRequest(request);
   if (crossOrigin) return crossOrigin;
-  // An account dropped earlier, in the desktop app: no cookie left, and this server serves this device alone.
+  // An account dropped earlier, in the desktop app: no session cookie left, so it
+  // takes the proof that account got while it had one (lib/plugin-secrets/wipe-proof.ts).
   const { searchParams } = request.nextUrl;
   const owner = searchParams.get('username');
   const server = searchParams.get('server');
   if (IS_DESKTOP_BUILD && searchParams.get('all') === 'true' && owner && server) {
+    const named = { username: owner, serverUrl: server };
+    if (!hasWipeProof(request, named)) return NextResponse.json({ error: 'Not authenticated' }, { status: 401, headers: NO_STORE });
     try {
-      await deleteAllUserCredentials({ username: owner, serverUrl: server });
-      return NextResponse.json({ ok: true }, { headers: NO_STORE });
+      await deleteAllUserCredentials(named);
+      const answer = NextResponse.json({ ok: true }, { headers: NO_STORE });
+      clearWipeProof(answer, named);
+      return answer;
     } catch (error) {
       const unavailable = storedDataUnavailableResponse(error, NO_STORE);
       if (unavailable) return unavailable;
@@ -135,7 +145,9 @@ export async function DELETE(request: NextRequest) {
   if (IS_DESKTOP_BUILD && request.nextUrl.searchParams.get('all') === 'true') {
     try {
       await deleteAllUserCredentials(user);
-      return NextResponse.json({ ok: true }, { headers: NO_STORE });
+      const answer = NextResponse.json({ ok: true }, { headers: NO_STORE });
+      clearWipeProof(answer, user);
+      return answer;
     } catch (error) {
       const unavailable = storedDataUnavailableResponse(error, NO_STORE);
       if (unavailable) return unavailable;

app/api/push/action/route.ts

@@ -10,7 +10,8 @@ import { loginFingerprint } from '@/lib/pwa-notify/login-fingerprint';
 import { UPSTREAM_JSON_MAX_BYTES, UpstreamBodyTooLargeError, readBodyCapped, readJsonCapped } from '@/lib/security/capped-body';
 import { rejectCrossOriginRequest } from '@/lib/security/same-origin';
 import { DisallowedUrlError } from '@/lib/security/url-guard';
-import { readStalwartAuthContextFromStore, type StalwartAuthContext } from '@/lib/stalwart/auth-context';
+import type { StalwartAuthContext } from '@/lib/stalwart/auth-context';
+import { readPushAuthContext } from '@/lib/stalwart/push-auth-context';
 import { rebaseApiUrl } from '@/lib/stalwart/jmap-api';
 import type { SettingsPolicy } from '@/lib/admin/types';
 import { fetchJmapServer, isTrustedJmapServerUrl } from '@/lib/stalwart/server-fetch';
@@ -98,7 +99,7 @@ async function loginsNamed(login: string): Promise<StalwartAuthContext[]> {
   const cookieStore = await cookies();
   const found: StalwartAuthContext[] = [];
   for (let slot = 0; slot < MAX_ACCOUNT_SLOTS; slot++) {
-    const ctx = readStalwartAuthContextFromStore(cookieStore, slot);
+    const ctx = await readPushAuthContext(cookieStore, slot);
     if (ctx && (await loginFingerprint(ctx.serverUrl, ctx.username)) === login) found.push(ctx);
   }
   return found;

app/api/push/preview/route.ts

@@ -3,7 +3,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { logger } from '@/lib/logger';
 import { cleanPreview } from '@/lib/utils';
 import { MAX_ACCOUNT_SLOTS } from '@/lib/account-utils';
-import { readStalwartAuthContextFromStore } from '@/lib/stalwart/auth-context';
+import { readPushAuthContext } from '@/lib/stalwart/push-auth-context';
 import {
   getStalwartCredentials,
   type StalwartCredentials,
@@ -45,15 +45,18 @@ interface ResolvedTarget {
 // session of everyone it is shared with, who sees only that folder - not its
 // Inbox, nor the message that just arrived there.
 //
-// The push names nothing but the account id, and ids repeat across servers
-// (and a group account is listed by each member). When that leaves more than
-// one login, answer 'ambiguous' rather than guess: a wrong guess previews
-// another login's mail and opens it there.
-async function resolveTargetForAccount(accountId: string, forwarded: Record<string, string>): Promise<ResolvedTarget | 'ambiguous' | null> {
+// Ids repeat across servers (and a group account is listed by each member), so
+// the account id alone can leave several logins. On one server, the push's label
+// names the login that registered it and settles it. Not across servers: logins
+// with the same account id share one relay record in this browser (lib/web-push.ts
+// keys it by account id), so the label is only whoever registered last. Whatever
+// doesn't fit answers 'ambiguous' rather than guess: a wrong guess previews another
+// login's mail and opens it there.
+async function resolveTargetForAccount(accountId: string, login: string | null, forwarded: Record<string, string>): Promise<ResolvedTarget | 'ambiguous' | null> {
   const cookieStore = await cookies();
   const probes: Promise<{ target: ResolvedTarget; own: boolean } | null>[] = [];
   for (let slot = 0; slot < MAX_ACCOUNT_SLOTS; slot++) {
-    const ctx = readStalwartAuthContextFromStore(cookieStore, slot);
+    const ctx = await readPushAuthContext(cookieStore, slot);
     if (!ctx) continue;
     const serverUrl = ctx.serverUrl.replace(/\/+$/, '');
     probes.push(
@@ -91,6 +94,13 @@ async function resolveTargetForAccount(accountId: string, forwarded: Record<stri
     );
   }
   const results = (await Promise.all(probes)).filter((r) => r !== null);
+  if (login && results.length > 0) {
+    const name = login.toLowerCase();
+    const named = results.filter((r) => r.target.username.toLowerCase() === name || r.target.accountName?.toLowerCase() === name);
+    const servers = new Set(results.map((r) => r.target.serverUrl));
+    if (named.length !== 1 || servers.size > 1) return 'ambiguous';
+    return named[0].target;
+  }
   const owners = results.filter((r) => r.own);
   if (owners.length === 1) return owners[0].target;
   if (results.length === 1) return results[0].target;
@@ -141,7 +151,7 @@ export async function GET(request: NextRequest) {
     let target: ResolvedTarget | null = null;
     let authHeader: string;
     if (requestedAccountId) {
-      const resolved = await resolveTargetForAccount(requestedAccountId, forwarded);
+      const resolved = await resolveTargetForAccount(requestedAccountId, request.nextUrl.searchParams.get('login'), forwarded);
       if (!resolved) {
         return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
       }

components/admin/org/sections/offline-section.tsx

@@ -117,8 +117,10 @@ export function OfflineSection({ draft }: { draft: OrgPolicyDraft }) {
       </SettingItem>
       <p className="pt-2 text-xs text-muted-foreground">
         What a device keeps: mail in every folder from the window the person picks (30 days, 90 days, a year or everything),
-        with calendar, contacts and files, encrypted on the device. That protects against someone copying its files, not
-        against someone using the unlocked browser or app. The limits above can only lower what people pick: where several
+        with calendar, contacts and files, encrypted on the device. In a browser the key sits in the same profile, so this doesn&apos;t stop someone
+        who copies its files: use full-disk encryption. In the desktop app the key also takes that person&apos;s login on
+        that computer. Neither stops someone using the unlocked browser or app. An app lock adds a PIN, which someone with
+        a copy can guess at their own speed, so ask for a long one. The limits above can only lower what people pick: where several
         scopes apply, the lowest value counts, so a scope can&apos;t raise what another one lowered. The app holds itself to
         them when it fetches the policy; the server can&apos;t check what is on a device. A sign-out someone asks for deletes everything.
         One that nobody asked for hides it, as the switch above says. With several accounts signed in, each account follows its own settings.

components/auth/mobile-handoff-consent.tsx

@@ -19,6 +19,8 @@ interface MobileHandoffConsentProps {
   onCancel: () => void;
   /** `resolveUrl` returned null: nothing was handed over. */
   onError?: () => void;
+  /** The desktop app, not the phone's: the port its listener asked from. */
+  desktopPort?: string;
 }
 
 /**
@@ -29,8 +31,10 @@ interface MobileHandoffConsentProps {
  * `bulwarkmobile` scheme on the device receives whatever is handed over
  * (lib/auth/mobile-handoff.ts). Nothing leaves without this confirmation.
  */
-export function MobileHandoffConsent({ url, resolveUrl, username, onCancel, onError }: MobileHandoffConsentProps) {
+export function MobileHandoffConsent({ url, resolveUrl, username, onCancel, onError, desktopPort }: MobileHandoffConsentProps) {
+  const desktop = Boolean(desktopPort);
   const t = useTranslations("login");
+  const tDesktop = useTranslations("desktop_browser_sign_in");
   // The dialog closes itself right after confirming; while the code is being
   // made live, that close must not count as declining.
   const resolving = useRef(false);
@@ -51,16 +55,18 @@ export function MobileHandoffConsent({ url, resolveUrl, username, onCancel, onEr
               return;
             }
             window.location.replace(resolved);
-            onCancel();
+            // A custom scheme leaves this page where it is. The desktop app's listener is
+            // a page of its own, and going anywhere now could overtake it.
+            if (!desktop) onCancel();
           });
           return;
         }
         if (url) window.location.replace(url);
       }}
-      title={t("mobile_handoff.title")}
-      message={t("mobile_handoff.description", { username })}
-      confirmText={t("mobile_handoff.confirm")}
-      cancelText={t("mobile_handoff.cancel")}
+      title={desktop ? tDesktop("consent_title") : t("mobile_handoff.title")}
+      message={desktop ? tDesktop("consent_description", { username, port: desktopPort ?? "" }) : t("mobile_handoff.description", { username })}
+      confirmText={desktop ? tDesktop("consent_confirm") : t("mobile_handoff.confirm")}
+      cancelText={desktop ? tDesktop("consent_cancel") : t("mobile_handoff.cancel")}
     />
   );
 }

components/desktop/__tests__/edited-files-host.test.tsx

@@ -0,0 +1,334 @@
+import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const policy = vi.hoisted(() => ({ decided: true, allowed: true }));
+const toast = vi.hoisted(() => ({ error: vi.fn(), success: vi.fn() }));
+const openMailLink = vi.hoisted(() => vi.fn());
+const handOffDraft = vi.hoisted(() => vi.fn());
+const openDraftWindow = vi.hoisted(() => vi.fn());
+const saveBlobAs = vi.hoisted(() => vi.fn(() => true));
+const signOutGates = vi.hoisted(() => [] as ((account: string) => Promise<boolean>)[]);
+const accounts = vi.hoisted(() => ({ list: [{ id: 'acct', cookieSlot: 2 }] as { id: string; cookieSlot: number; label?: string }[], active: 'acct' as string | null }));
+const contentHidden = vi.hoisted(() => ({ value: false }));
+const switchAccount = vi.hoisted(() => vi.fn(async () => {}));
+
+vi.mock('next-intl', () => ({ useTranslations: () => (key: string) => key }));
+vi.mock('@/i18n/navigation', () => ({ useRouter: () => ({ push: vi.fn() }) }));
+vi.mock('@/stores/toast-store', () => ({ toast }));
+vi.mock('@/lib/device-policy', () => ({ canDownload: () => policy.allowed, canExport: () => true }));
+vi.mock('@/lib/offline/offline-mode', () => ({ scopeDecided: () => policy.decided }));
+vi.mock('@/lib/desktop/mail-links', () => ({ openMailLink }));
+vi.mock('@/lib/desktop/mail-notifications', () => ({ contentHiddenFor: () => contentHidden.value }));
+vi.mock('@/lib/launch-handoff', () => ({ handOffDraft }));
+vi.mock('@/lib/popout/open', () => ({ openDraftWindow }));
+vi.mock('@/lib/download-guard', () => ({ saveBlobAs }));
+vi.mock('@/lib/org/account-subjects', () => ({ useAccountSubjects: { subscribe: () => () => {} } }));
+vi.mock('@/stores/policy-store', () => ({ usePolicyStore: { subscribe: () => () => {} } }));
+vi.mock('@/lib/sign-out-cleanup', () => ({
+  addSignOutGate: (gate: (account: string) => Promise<boolean>) => {
+    signOutGates.push(gate);
+    return () => {};
+  },
+  onBeforeSignOut: () => () => {},
+  onFullSignOut: () => {},
+}));
+vi.mock('@/stores/account-store', () => {
+  const useAccountStore = (select: (s: { accounts: typeof accounts.list }) => unknown) => select({ accounts: accounts.list });
+  useAccountStore.getState = () => ({ accounts: accounts.list });
+  return { useAccountStore };
+});
+vi.mock('@/stores/auth-store', () => {
+  const useAuthStore = (select: (s: { activeAccountId: string | null }) => unknown) => select({ activeAccountId: accounts.active });
+  useAuthStore.getState = () => ({ activeAccountId: accounts.active, switchAccount });
+  return { useAuthStore };
+});
+
+import { EditedFilesHost } from '../edited-files-host';
+import { resetEditSessions, takeFilesForReply, useEditSessions } from '@/lib/desktop/edit-attachments';
+
+const session = (over: Record<string, unknown> = {}) => ({
+  id: 's1', name: 'a.docx', type: 'x/y', account: 'acct', source: '{"kind":"mail","emailId":"e1","ownerAccountId":"owner"}', changed: true, version: 1, hash: 'h', claimed: false, held: false, savedAs: false, lastChance: false, ...over,
+});
+
+let bridge: { edit: Record<string, ReturnType<typeof vi.fn>>; dialogs: { confirm: ReturnType<typeof vi.fn> }; os: { notify: ReturnType<typeof vi.fn> } };
+
+function show(...sessions: ReturnType<typeof session>[]) {
+  bridge.edit.list.mockResolvedValue(sessions);
+  useEditSessions.setState({ sessions });
+  return render(<EditedFilesHost />);
+}
+
+beforeEach(() => {
+  policy.decided = true;
+  policy.allowed = true;
+  contentHidden.value = false;
+  accounts.list = [{ id: 'acct', cookieSlot: 2 }];
+  accounts.active = 'acct';
+  signOutGates.length = 0;
+  vi.clearAllMocks();
+  saveBlobAs.mockReturnValue(true);
+  bridge = {
+    edit: {
+      canEdit: vi.fn(() => true),
+      begin: vi.fn(),
+      open: vi.fn(),
+      reopen: vi.fn(),
+      list: vi.fn(async () => []),
+      settle: vi.fn(async () => []),
+      read: vi.fn(async () => ({ ok: true, name: 'a.docx', type: 'x/y', data: new Uint8Array([1]), hash: 'h' })),
+      taken: vi.fn(async () => {}),
+      release: vi.fn(async () => {}),
+      discard: vi.fn(async () => ({ held: [] })),
+      forceDiscard: vi.fn(async () => ({ held: [] })),
+      askClear: vi.fn(async () => true),
+      clear: vi.fn(async () => ({ held: [] })),
+      wipe: vi.fn(async () => ({ held: [] })),
+      shown: vi.fn(),
+      setSource: vi.fn(),
+      claim: vi.fn(),
+      onChange: vi.fn(() => () => {}),
+    },
+    dialogs: { confirm: vi.fn(async () => 0) },
+    os: { notify: vi.fn(async () => ({ shown: true, playSound: false })) },
+  };
+  (window as unknown as { bulwarkDesktop?: unknown }).bulwarkDesktop = { version: 1, ...bridge };
+  resetEditSessions();
+});
+
+afterEach(() => {
+  cleanup();
+  delete (window as unknown as { bulwarkDesktop?: unknown }).bulwarkDesktop;
+});
+
+describe('which offers show', () => {
+  it('a saved file nobody holds', () => {
+    show(session());
+    expect(screen.getByTestId('edited-file')).toBeTruthy();
+  });
+
+  it('nothing for an unchanged file or one a composer holds', () => {
+    show(session({ changed: false }), session({ id: 's2', claimed: true }));
+    expect(screen.queryByTestId('edited-file')).toBeNull();
+  });
+
+  it('nothing for an account that is not signed in here', () => {
+    show(session({ account: 'someone-else' }));
+    expect(screen.queryByTestId('edited-file')).toBeNull();
+    expect(bridge.os.notify).not.toHaveBeenCalled();
+  });
+
+  it('nothing in a browser', () => {
+    delete (window as unknown as { bulwarkDesktop?: unknown }).bulwarkDesktop;
+    useEditSessions.setState({ sessions: [session()] });
+    render(<EditedFilesHost />);
+    expect(screen.queryByTestId('edited-file')).toBeNull();
+  });
+
+  it('says it once per file on the OS, whatever the number of saves', async () => {
+    const { rerender } = show(session());
+    await waitFor(() => expect(bridge.os.notify).toHaveBeenCalledTimes(1));
+    act(() => useEditSessions.setState({ sessions: [session({ version: 2 })] }));
+    rerender(<EditedFilesHost />);
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    expect(bridge.os.notify).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('a message\'s attachment', () => {
+  it('attaches to a reply on that message, with that login', async () => {
+    show(session());
+    fireEvent.click(screen.getByText('reply'));
+    await waitFor(() => expect(openMailLink).toHaveBeenCalled());
+    const [link, options] = openMailLink.mock.calls[0];
+    expect(link).toEqual({ kind: 'message', id: 'e1', slot: 2, ownerAccountId: 'owner', reply: true });
+    expect(options).toEqual({ replyText: '' });
+    const parked = takeFilesForReply('e1');
+    expect(parked.map((f) => f.name)).toEqual(['a.docx']);
+    // Only the composer's having it makes it taken.
+    expect(bridge.edit.taken).not.toHaveBeenCalled();
+  });
+
+  it('saves a copy through the guard, and only a saved copy counts as taken', async () => {
+    show(session());
+    fireEvent.click(screen.getByText('save_copy'));
+    await waitFor(() => expect(saveBlobAs).toHaveBeenCalled());
+    expect(saveBlobAs.mock.calls[0]).toEqual([expect.any(File), 'a.docx', { kind: 'attachment', subject: 'acct' }]);
+    expect(bridge.edit.taken).toHaveBeenCalledWith('s1', 'h');
+  });
+
+  it('a save the guard refuses stays an offer', async () => {
+    saveBlobAs.mockReturnValue(false);
+    show(session());
+    fireEvent.click(screen.getByText('save_copy'));
+    await waitFor(() => expect(saveBlobAs).toHaveBeenCalled());
+    expect(bridge.edit.taken).not.toHaveBeenCalled();
+  });
+});
+
+describe('other sources', () => {
+  it('a closed draft opens in its window, where its chip offers the update', () => {
+    show(session({ source: '{"kind":"draft","draftId":"d1","ownerAccountId":"owner"}' }));
+    expect(screen.queryByText('reply')).toBeNull();
+    fireEvent.click(screen.getByText('open_draft'));
+    expect(openDraftWindow).toHaveBeenCalledWith({ draftId: 'd1', localAccountId: 'acct', ownerAccountId: 'owner' });
+  });
+
+  it('a file whose message went can start a new one', async () => {
+    show(session({ source: '{"kind":"file"}' }));
+    expect(screen.queryByText('reply')).toBeNull();
+    expect(screen.queryByText('open_draft')).toBeNull();
+    fireEvent.click(screen.getByText('new_message'));
+    await waitFor(() => expect(handOffDraft).toHaveBeenCalled());
+    expect(handOffDraft.mock.calls[0][0].files[0].name).toBe('a.docx');
+  });
+});
+
+describe('discarding', () => {
+  it('goes to main, which asks natively about edits', async () => {
+    show(session());
+    fireEvent.click(screen.getByRole('button', { name: 'discard a.docx' }));
+    await waitFor(() => expect(bridge.edit.discard).toHaveBeenCalledWith('s1'));
+    expect(bridge.dialogs.confirm).not.toHaveBeenCalled();
+  });
+});
+
+describe('the organisation', () => {
+  it('saying no ends a session with no question, says so on the OS, and stays until read', async () => {
+    policy.allowed = false;
+    show(session());
+    await waitFor(() => expect(bridge.edit.forceDiscard).toHaveBeenCalledWith('s1'));
+    await waitFor(() => expect(toast.error).toHaveBeenCalledWith('removed_policy', { duration: 0 }));
+    expect(bridge.edit.discard).not.toHaveBeenCalled();
+    await waitFor(() => expect(bridge.os.notify).toHaveBeenCalledWith(expect.objectContaining({ id: 'edit-policy-s1', title: 'removed_policy', body: 'outside_note' })));
+  });
+
+  it('says when a program still has the file', async () => {
+    policy.allowed = false;
+    bridge.edit.forceDiscard.mockResolvedValue({ held: ['a.docx'] });
+    show(session());
+    await waitFor(() => expect(toast.error).toHaveBeenCalledWith('removed_policy_held', { duration: 0 }));
+  });
+
+  it('names no file on the OS where that account hides content', async () => {
+    policy.allowed = false;
+    contentHidden.value = true;
+    show(session());
+    await waitFor(() => expect(bridge.os.notify).toHaveBeenCalledWith(expect.objectContaining({ title: 'removed_policy_hidden' })));
+  });
+
+  it('does not end a session twice while a program holds it', async () => {
+    policy.allowed = false;
+    show(session({ held: true }));
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    expect(bridge.edit.forceDiscard).not.toHaveBeenCalled();
+  });
+
+  it('not having said yet deletes nothing, and reads nothing either', async () => {
+    policy.decided = false;
+    show(session());
+    fireEvent.click(screen.getByText('save_copy'));
+    await waitFor(() => expect(toast.error).toHaveBeenCalledWith('blocked_policy'));
+    expect(bridge.edit.forceDiscard).not.toHaveBeenCalled();
+    expect(bridge.edit.read).not.toHaveBeenCalled();
+  });
+});
+
+describe('signing out', () => {
+  it('leaves the question to main, whose yes covers the deleting', async () => {
+    show(session());
+    expect(signOutGates).toHaveLength(1);
+    bridge.edit.askClear.mockResolvedValueOnce(false);
+    await expect(signOutGates[0]('acct')).resolves.toBe(false);
+    expect(bridge.edit.askClear).toHaveBeenCalledWith('acct');
+  });
+});
+
+describe('what a program still holds', () => {
+  it('names the file, for an account signed in here, and what the app can\'t reach', () => {
+    show(session({ held: true, changed: false }));
+    expect(screen.getByTestId('edited-file-held').textContent).toContain('held_named');
+    expect(screen.getByTestId('edited-file-held').textContent).toContain('outside_note');
+    expect(screen.queryByTestId('edited-file')).toBeNull();
+  });
+
+  it('names nothing for anyone else, and still says it', () => {
+    show(session({ held: true, changed: false, account: 'someone-else' }));
+    const notice = screen.getByTestId('edited-file-held').textContent ?? '';
+    expect(notice).toContain('held_unnamed');
+    expect(notice).not.toContain('held_named');
+  });
+
+  it('a held file with edits nobody wanted is not offered', () => {
+    show(session({ held: true, changed: true }));
+    expect(screen.queryByTestId('edited-file')).toBeNull();
+  });
+});
+
+describe('the name on the OS', () => {
+  it('stays off where that account hides content', async () => {
+    contentHidden.value = true;
+    show(session());
+    await waitFor(() => expect(bridge.os.notify).toHaveBeenCalledWith(expect.objectContaining({ title: 'changed_title_hidden' })));
+  });
+
+  it('shows where it does not', async () => {
+    show(session());
+    await waitFor(() => expect(bridge.os.notify).toHaveBeenCalledWith(expect.objectContaining({ title: 'changed_title' })));
+  });
+});
+
+describe('more than one account', () => {
+  it('says which one a file belongs to', () => {
+    accounts.list = [{ id: 'acct', cookieSlot: 2, label: 'work@example.org' }, { id: 'home', cookieSlot: 3, label: 'home@example.org' }];
+    show(session());
+    expect(screen.getByTestId('edited-file-account').textContent).toBe('work@example.org');
+  });
+
+  it('with one, there is nothing to say', () => {
+    show(session());
+    expect(screen.queryByTestId('edited-file-account')).toBeNull();
+  });
+
+  it('a new message starts from the file\'s own account', async () => {
+    accounts.list = [{ id: 'acct', cookieSlot: 2 }, { id: 'home', cookieSlot: 3 }];
+    accounts.active = 'home';
+    const order: string[] = [];
+    switchAccount.mockImplementationOnce(async () => { order.push('switch'); });
+    handOffDraft.mockImplementationOnce(() => { order.push('handoff'); });
+    show(session({ source: '{"kind":"file"}' }));
+    fireEvent.click(screen.getByText('new_message'));
+    await waitFor(() => expect(handOffDraft).toHaveBeenCalled());
+    expect(switchAccount).toHaveBeenCalledWith('acct');
+    expect(order).toEqual(['switch', 'handoff']);
+  });
+
+  it('already on it, nothing switches', async () => {
+    show(session({ source: '{"kind":"file"}' }));
+    fireEvent.click(screen.getByText('new_message'));
+    await waitFor(() => expect(handOffDraft).toHaveBeenCalled());
+    expect(switchAccount).not.toHaveBeenCalled();
+  });
+});
+
+describe('the last offer', () => {
+  it('says so, and tells main it was seen', async () => {
+    show(session({ lastChance: true }));
+    expect(screen.getByTestId('edited-file-last-chance')).toBeTruthy();
+    await waitFor(() => expect(bridge.edit.shown).toHaveBeenCalledWith('s1'));
+  });
+
+  it('an ordinary offer says nothing of it', async () => {
+    show(session());
+    expect(screen.queryByTestId('edited-file-last-chance')).toBeNull();
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    expect(bridge.edit.shown).not.toHaveBeenCalled();
+  });
+});
+
+describe('a file saved under a new name from a draft', () => {
+  it('has no draft to open: its own message is what it can go on', () => {
+    show(session({ source: '{"kind":"draft","draftId":"d1"}', savedAs: true }));
+    expect(screen.queryByText('open_draft')).toBeNull();
+    expect(screen.getByText('new_message')).toBeTruthy();
+  });
+});

components/desktop/edited-files-host.tsx

@@ -0,0 +1,212 @@
+"use client";
+
+import { useEffect, useMemo, useRef, useState } from "react";
+import { useTranslations } from "next-intl";
+import { FilePen, X } from "@/components/icons";
+import { Button } from "@/components/ui/button";
+import { useRouter } from "@/i18n/navigation";
+import { getDesktopBridge } from "@/lib/desktop/bridge";
+import { editForbidden, followEditSessions, getEditBridge, parkFilesForReply, parseEditSource, readEditedFile, useEditSessions } from "@/lib/desktop/edit-attachments";
+import { openMailLink } from "@/lib/desktop/mail-links";
+import { contentHiddenFor } from "@/lib/desktop/mail-notifications";
+import type { DesktopEditSession } from "@/lib/desktop/types";
+import { saveBlobAs } from "@/lib/download-guard";
+import { handOffDraft } from "@/lib/launch-handoff";
+import { useAccountSubjects } from "@/lib/org/account-subjects";
+import { openDraftWindow } from "@/lib/popout/open";
+import { addSignOutGate } from "@/lib/sign-out-cleanup";
+import { useAccountStore } from "@/stores/account-store";
+import { useAuthStore } from "@/stores/auth-store";
+import { usePolicyStore } from "@/stores/policy-store";
+import { toast } from "@/stores/toast-store";
+
+function useSignedInAccounts(): Set<string> {
+  const accounts = useAccountStore((s) => s.accounts);
+  const active = useAuthStore((s) => s.activeAccountId);
+  return useMemo(() => new Set([...accounts.map((a) => a.id), ...(active ? [active] : [])]), [accounts, active]);
+}
+
+/**
+ * Attachments opened with Edit and saved in their program, with what can be done with them.
+ * A composer offers its own files on the chip, so this has what no composer holds. It stays
+ * until the user has decided: a save may come at any time, also while the app was closed.
+ * Names only for accounts signed in here: someone else signing in doesn't see these, and
+ * hears only that a copy is still held somewhere. Main window only, nothing in a browser.
+ */
+export function EditedFilesHost() {
+  const t = useTranslations("desktopEdit");
+  const router = useRouter();
+  const tRef = useRef(t);
+  tRef.current = t;
+  const sessions = useEditSessions((s) => s.sessions);
+  const accounts = useSignedInAccounts();
+  const accountList = useAccountStore((s) => s.accounts);
+  const [busy, setBusy] = useState<string | null>(null);
+  const available = !!getEditBridge();
+
+  useEffect(() => {
+    if (available) followEditSessions();
+  }, [available]);
+
+  const offers = useMemo(() => sessions.filter((s) => s.changed && !s.claimed && !s.held && accounts.has(s.account)), [sessions, accounts]);
+  const held = useMemo(() => sessions.filter((s) => s.held), [sessions]);
+  const heldNames = held.filter((s) => accounts.has(s.account)).map((s) => s.name);
+  const heldOthers = held.length - heldNames.length;
+
+  // Whoever is in the other program sees this. Once per file, not at every save. A file's
+  // name can say as much as a subject, so the same rule as for new mail.
+  const toldRef = useRef(new Set<string>());
+  useEffect(() => {
+    const os = getDesktopBridge()?.os;
+    for (const session of offers) {
+      if (toldRef.current.has(session.id)) continue;
+      toldRef.current.add(session.id);
+      void os?.notify({
+        id: `edit-${session.id}`,
+        title: contentHiddenFor(session.account) ? tRef.current("changed_title_hidden") : tRef.current("changed_title", { name: session.name }),
+        body: tRef.current("changed_body"),
+        context: JSON.stringify({ editedFile: true }),
+      }).catch(() => {});
+    }
+  }, [offers]);
+
+  // Seen once, so a copy past its 30 days can go a day later.
+  useEffect(() => {
+    for (const session of offers) if (session.lastChance) getEditBridge()?.shown(session.id);
+  }, [offers]);
+
+  // The organisation's no ends a session, also one with a file open and edits in it. Someone
+  // may be in the other program, so the OS says it as well, and the toast stays until read.
+  useEffect(() => {
+    const bridge = getEditBridge();
+    if (!bridge) return;
+    const enforce = () => {
+      for (const session of useEditSessions.getState().sessions) {
+        if (session.held || !editForbidden(session.account)) continue;
+        void bridge.forceDiscard(session.id).then((result) => {
+          if (result.refused) return;
+          const message = tRef.current(result.held.length > 0 ? "removed_policy_held" : "removed_policy", { name: session.name });
+          toast.error(message, { duration: 0 });
+          void getDesktopBridge()?.os?.notify({
+            id: `edit-policy-${session.id}`,
+            title: contentHiddenFor(session.account) ? tRef.current("removed_policy_hidden") : message,
+            body: tRef.current("outside_note"),
+            context: JSON.stringify({ editedFile: true }),
+          }).catch(() => {});
+        });
+      }
+    };
+    enforce();
+    const stops = [usePolicyStore.subscribe(enforce), useAccountSubjects.subscribe(enforce), useEditSessions.subscribe(enforce)];
+    return () => stops.forEach((stop) => stop());
+  }, []);
+
+  // Before a sign-out the user started. Main asks, as it's what would delete, and names what a
+  // program still has open. A wipe doesn't ask.
+  useEffect(() => {
+    const bridge = getEditBridge();
+    if (!bridge) return;
+    return addSignOutGate((accountId) => bridge.askClear(accountId));
+  }, []);
+
+  if (!available || (offers.length === 0 && held.length === 0)) return null;
+
+  const withFile = async (session: DesktopEditSession, then: (file: File, hash: string) => void | Promise<void>) => {
+    setBusy(session.id);
+    try {
+      const outcome = await readEditedFile(session);
+      if (outcome.ok) await then(outcome.file, outcome.hash);
+      else if (outcome.reason === "policy") toast.error(t("blocked_policy"));
+      else if (outcome.reason === "busy") toast.error(t("read_busy", { name: session.name }));
+      else if (outcome.reason !== "locked") toast.error(t("read_failed", { name: session.name }));
+    } catch (error) {
+      console.error("Could not read an edited file:", error);
+      toast.error(t("read_failed", { name: session.name }));
+    } finally {
+      setBusy(null);
+    }
+  };
+
+  const attachToReply = (session: DesktopEditSession, emailId: string, ownerAccountId: string | undefined) => withFile(session, (file) => {
+    parkFilesForReply(emailId, [file]);
+    const slot = useAccountStore.getState().accounts.find((a) => a.id === session.account)?.cookieSlot;
+    openMailLink(
+      { kind: "message", id: emailId, ...(slot !== undefined ? { slot } : {}), ownerAccountId, reply: true },
+      { replyText: "" },
+      (path) => router.push(path),
+    );
+  });
+
+  /** From the account the file belongs to, whichever one is on screen. */
+  const attachToNew = (session: DesktopEditSession) => withFile(session, async (file) => {
+    const auth = useAuthStore.getState();
+    if (auth.activeAccountId !== session.account) await auth.switchAccount(session.account);
+    handOffDraft({ files: [file] });
+  });
+
+  const saveCopy = (session: DesktopEditSession) => withFile(session, (file, hash) => {
+    if (saveBlobAs(file, file.name, { kind: "attachment", subject: session.account })) void getEditBridge()?.taken(session.id, hash);
+  });
+
+  const accountLabel = (session: DesktopEditSession) => {
+    if (accountList.length < 2) return null;
+    const entry = accountList.find((a) => a.id === session.account);
+    return entry?.label || entry?.username || null;
+  };
+
+  return (
+    <section
+      aria-label={t("offers_label")}
+      data-testid="edited-files"
+      // Toasts have one corner and the account menu the other, and both have to stay reachable: over the mail columns, under any menu or dialog.
+      className="fixed inset-x-0 bottom-4 z-40 mx-auto flex max-h-[60vh] w-[22rem] max-w-[calc(100vw-2rem)] flex-col gap-2 overflow-y-auto"
+    >
+      {held.length > 0 && (
+        <div data-testid="edited-file-held" role="status" className="flex flex-col gap-1 rounded-lg border border-border bg-background p-3 text-xs shadow-lg">
+          {heldNames.length > 0 && <p className="break-words text-foreground" dir="auto">{t("held_named", { names: heldNames.join(", ") })}</p>}
+          {heldOthers > 0 && <p className="text-foreground">{t("held_unnamed")}</p>}
+          <p className="text-muted-foreground">{t("outside_note")}</p>
+        </div>
+      )}
+      {offers.map((session) => {
+        const source = parseEditSource(session.source);
+        const draftId = source.kind === "draft" && !session.savedAs ? source.draftId : null;
+        const account = accountLabel(session);
+        return (
+          <div key={session.id} data-testid="edited-file" className="flex flex-col gap-2 rounded-lg border border-border bg-background p-3 shadow-lg">
+            <div className="flex items-start gap-2">
+              <FilePen className="mt-0.5 h-4 w-4 shrink-0 text-muted-foreground" aria-hidden="true" />
+              <div className="min-w-0 flex-1">
+                <p className="break-words text-sm font-medium text-foreground" dir="auto">{t("changed_title", { name: session.name })}</p>
+                {account && <p className="truncate text-xs text-muted-foreground" data-testid="edited-file-account">{account}</p>}
+                <p className="text-xs text-muted-foreground">{t("changed_body")}</p>
+                {session.lastChance && <p className="text-xs font-medium text-foreground" data-testid="edited-file-last-chance">{t("last_chance")}</p>}
+              </div>
+              <button
+                type="button"
+                onClick={() => void getEditBridge()?.discard(session.id)}
+                title={t("discard")}
+                aria-label={`${t("discard")} ${session.name}`}
+                className="shrink-0 text-muted-foreground hover:text-foreground"
+              >
+                <X className="h-4 w-4" />
+              </button>
+            </div>
+            <div className="flex flex-wrap gap-2">
+              {source.kind === "mail" && (
+                <Button size="sm" disabled={busy === session.id} onClick={() => void attachToReply(session, source.emailId, source.ownerAccountId)}>{t("reply")}</Button>
+              )}
+              {draftId && (
+                <Button size="sm" onClick={() => openDraftWindow({ draftId, localAccountId: session.account, ownerAccountId: source.kind === "draft" ? source.ownerAccountId : undefined })}>{t("open_draft")}</Button>
+              )}
+              {source.kind !== "mail" && !draftId && (
+                <Button size="sm" disabled={busy === session.id} onClick={() => void attachToNew(session)}>{t("new_message")}</Button>
+              )}
+              <Button size="sm" variant="outline" disabled={busy === session.id} onClick={() => void saveCopy(session)}>{t("save_copy")}</Button>
+            </div>
+          </div>
+        );
+      })}
+    </section>
+  );
+}

components/email/__tests__/composer-edit-attachments.test.tsx

@@ -0,0 +1,316 @@
+// The composer's end of the desktop app's Edit, on the real composer.
+import { act, render, screen, fireEvent, waitFor } from '@testing-library/react';
+import { afterEach, describe, it, expect, vi, beforeEach } from 'vitest';
+import React from 'react';
+import { EmailComposer } from '../email-composer';
+import { resetEditSessions, useEditSessions } from '@/lib/desktop/edit-attachments';
+import { useAuthStore } from '@/stores/auth-store';
+
+// ─── Heavy component mocks (mirrors reply-addressing.test.tsx) ────────────────
+
+const editorKeyDown = vi.hoisted(() => vi.fn());
+const toastError = vi.hoisted(() => vi.fn());
+
+vi.mock('@/lib/offline/offline-mode', async (original) => ({
+  ...(await original<typeof import('@/lib/offline/offline-mode')>()),
+  scopeDecided: () => true,
+}));
+
+vi.mock('@/components/email/rich-text-editor', () => ({
+  RichTextEditor: () => React.createElement('div', {
+    'data-testid': 'rich-text-editor',
+    onKeyDown: (event: React.KeyboardEvent) => {
+      if (!event.defaultPrevented) editorKeyDown();
+    },
+  }),
+}));
+
+vi.mock('@/components/plugins/plugin-slot', () => ({ PluginSlot: () => null }));
+vi.mock('@/components/ui/avatar', () => ({ Avatar: () => null }));
+vi.mock('@/components/identity/sub-address-helper', () => ({ SubAddressHelper: () => null }));
+vi.mock('@/components/templates/template-picker', () => ({ TemplatePicker: () => null }));
+vi.mock('@/components/templates/template-form', () => ({ TemplateForm: () => null }));
+vi.mock('@/components/files/file-preview-modal', () => ({ FilePreviewModal: () => null }));
+vi.mock('@/hooks/use-focus-trap', () => ({
+  useFocusTrap: () => ({ current: null }),
+}));
+vi.mock('@/hooks/use-pro-multi-account-identities', () => ({
+  useProMultiAccountIdentities: () => ({ enabled: false, groups: [], allIdentities: [] }),
+  stripCrossAccountIdentityPrefix: (id: string) => ({ localAccountId: null, rawId: id }),
+}));
+
+// ─── Store mocks ──────────────────────────────────────────────────────────────
+
+vi.mock('@/stores/auth-store', () => {
+  const state = {
+    client: null,
+    identities: [],
+    primaryIdentity: null,
+    isAuthenticated: false,
+    isDemoMode: false,
+    activeAccountId: null,
+    connectionLost: false,
+    getClientForAccount: () => undefined,
+    getAllConnectedClients: () => new Map(),
+    syncIdentities: () => {},
+    refreshIdentities: async () => {},
+  };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useAuthStore: hook };
+});
+
+vi.mock('@/stores/identity-store', () => {
+  const state = {
+    identities: [{ id: 'id-me', email: 'me@example.com', name: 'Me' }],
+    defaultIdentityId: 'id-me',
+  };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useIdentityStore: hook };
+});
+
+vi.mock('@/stores/account-store', () => {
+  const state = { accounts: [], getAccountById: () => undefined };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useAccountStore: hook };
+});
+
+vi.mock('@/stores/email-store', () => {
+  const state = {
+    draftSaveEnabled: false,
+    sendRawEmail: async () => ({ sent: true }),
+  };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useEmailStore: hook };
+});
+
+const updateSetting = vi.fn();
+
+vi.mock('@/stores/settings-store', () => {
+  const state = {
+    timeFormat: '24h',
+    plainTextMode: false,
+    subAddressDelimiter: '+',
+    autoSelectReplyIdentity: true,
+    attachmentReminderEnabled: false,
+    attachmentReminderKeywords: [],
+    emptySubjectWarningEnabled: true,
+    sendDelaySeconds: 0,
+    signaturePosition: 'above_quote',
+    signatureSeparatorEnabled: false,
+    requestReadReceiptDefault: false,
+    addTrustedSender: () => {},
+    trustedSendersAddressBook: null,
+    updateSetting: (...args: unknown[]) => updateSetting(...args),
+  };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useSettingsStore: hook };
+});
+
+vi.mock('@/stores/contact-store', () => {
+  const state = {
+    contacts: [],
+    getAutocomplete: async () => [],
+    addToTrustedSendersBook: async () => {},
+  };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useContactStore: hook };
+});
+
+vi.mock('@/stores/template-store', () => {
+  const state = { templates: [], addTemplate: async () => {} };
+  const hook = (sel?: (s: typeof state) => unknown) =>
+    typeof sel === 'function' ? sel(state) : state;
+  hook.getState = () => state;
+  hook.setState = (p: Partial<typeof state>) => Object.assign(state, p);
+  return { useTemplateStore: hook };
+});
+
+// ─── Misc dependency mocks ────────────────────────────────────────────────────
+
+vi.mock('@/stores/toast-store', () => ({
+  toast: { info: () => {}, error: toastError, success: () => {} },
+}));
+
+vi.mock('@/lib/plugin-hooks', () => ({
+  identityHooks: {
+    onSignatureRender: { size: 0, transform: async (value: unknown) => value },
+    onIdentitySelect: { size: 0, emit: async () => {} },
+  },
+  templateHooks: {
+    onTemplateRender: { size: 0, transform: async (value: unknown) => value },
+    onTemplateApply: { size: 0, emit: async () => {} },
+  },
+  emailHooks: {
+    onComposerOpen: { call: async () => [] },
+    onRecipientChange: { call: async () => [] },
+    getRecipientSuggestions: { call: async () => [] },
+    onRecipientChipsChange: { transform: async (chips: unknown) => chips },
+    onDraftChange: { emit: () => {} },
+    onBeforeDraftAutoSave: { transform: async (draft: unknown) => draft },
+    onBeforeEmailSend: { intercept: async () => true, interceptOutcome: async () => 'allowed' },
+    onComposeSend: { takeOver: async () => 'default' },
+    onTransformOutgoingEmail: { transform: async (email: unknown) => email },
+  },
+  contactHooks: {
+    search: { call: async () => [] },
+    onProvideRecipientSuggestions: { transform: async (initial: unknown) => initial },
+  },
+}));
+
+vi.mock('@/lib/email-sanitization', () => ({
+  sanitizeSignatureHtml: (v: string) => v,
+  sanitizeEmailHtml: (v: string) => v,
+  parseHtmlSafely: (html: string) => new DOMParser().parseFromString(html, 'text/html'),
+}));
+
+vi.mock('@/lib/email-threading', () => ({
+  computeReplyThreadingHeaders: () => ({ inReplyTo: [], references: [] }),
+}));
+vi.mock('@/lib/signature-utils', () => ({
+  appendPlainTextSignature: (body: string) => body,
+  getPlainTextSignature: () => '',
+}));
+vi.mock('@/lib/sub-addressing', () => ({ generateSubAddress: () => '' }));
+vi.mock('@/lib/debug', () => ({ debug: { log: () => {}, warn: () => {}, error: () => {} } }));
+vi.mock('@/components/email/quoted-html', () => ({
+  buildQuotedHtmlBlock: () => '',
+  serializeEditorContent: () => '',
+}));
+vi.mock('@/lib/template-utils', () => ({ substitutePlaceholders: (s: string) => s }));
+
+// ─── Tests ────────────────────────────────────────────────────────────────────
+
+// Discard used to share the X button's path: without unsaved changes it just
+// closed, so a draft reopened via "Cancel and edit" stayed in Drafts.
+
+const REOPENED_DRAFT = {
+  to: 'bob@example.com',
+  cc: '',
+  bcc: '',
+  subject: 'Lunch',
+  body: '<p>Hello there</p>',
+  showCc: false,
+  showBcc: false,
+  selectedIdentityId: 'id-me',
+  subAddressTag: '',
+  mode: 'compose' as const,
+  draftId: 'draft-1',
+};
+
+const session = (over: Record<string, unknown> = {}) => ({
+  id: 's1', name: 'a.txt', type: 'text/plain', account: 'acct', source: '{"kind":"draft","draftId":"draft-1"}',
+  changed: false, version: 0, hash: 'h', claimed: false, held: false, savedAs: false, lastChance: false, ...over,
+});
+
+function fakeEdit() {
+  return {
+    canEdit: () => true,
+    begin: vi.fn(),
+    open: vi.fn(),
+    reopen: vi.fn(),
+    list: vi.fn(async () => useEditSessions.getState().sessions),
+    settle: vi.fn(async () => useEditSessions.getState().sessions),
+    read: vi.fn(),
+    taken: vi.fn(async () => {}),
+    release: vi.fn(async () => {}),
+    discard: vi.fn(async () => ({ held: [] })),
+    forceDiscard: vi.fn(async () => ({ held: [] })),
+    askClear: vi.fn(async () => true),
+    clear: vi.fn(async () => ({ held: [] })),
+    wipe: vi.fn(async () => ({ held: [] })),
+    shown: vi.fn(),
+    setSource: vi.fn(),
+    claim: vi.fn(),
+    onChange: vi.fn(() => () => {}),
+  };
+}
+
+const DRAFT_WITH_FILE = { ...REOPENED_DRAFT, attachments: [{ blobId: 'b1', name: 'a.txt', type: 'text/plain', size: 3 }] };
+
+describe('the composer with a file open for editing', () => {
+  let edit: ReturnType<typeof fakeEdit>;
+
+  beforeEach(() => {
+    edit = fakeEdit();
+    window.bulwarkDesktop = { version: 1, platform: 'win32', edit, dialogs: { confirm: vi.fn(async () => 0) } } as never;
+    resetEditSessions();
+    useAuthStore.setState({ activeAccountId: 'acct' } as never);
+  });
+
+  afterEach(() => {
+    window.bulwarkDesktop = undefined;
+    useAuthStore.setState({ activeAccountId: null } as never);
+  });
+
+  it('a double click on Send, while it looks at the file, sends once', async () => {
+    useEditSessions.setState({ sessions: [session({ changed: true })] });
+    // Both clicks wait on the same answer, so both would go on.
+    let answer: (value: unknown) => void = () => {};
+    const looking = new Promise((resolve) => { answer = resolve; });
+    edit.settle.mockImplementation(() => looking as never);
+    const onSend = vi.fn(async () => {});
+    render(<EmailComposer initialData={DRAFT_WITH_FILE} onSend={onSend as never} onClose={vi.fn()} />);
+    await screen.findAllByTestId('composer-edit-update');
+
+    const send = screen.getAllByTestId('composer-send')[0];
+    fireEvent.click(send);
+    fireEvent.click(send);
+    await act(async () => { answer([session({ changed: true })]); });
+    await waitFor(() => expect(onSend).toHaveBeenCalled());
+    await act(async () => { await new Promise((resolve) => setTimeout(resolve, 50)); });
+    expect(onSend).toHaveBeenCalledTimes(1);
+    // One question, too: each click would otherwise put up its own.
+    expect((window.bulwarkDesktop as unknown as { dialogs: { confirm: ReturnType<typeof vi.fn> } }).dialogs.confirm).toHaveBeenCalledTimes(1);
+  });
+
+  it('with nothing open for editing, Send looks at nothing', async () => {
+    const onSend = vi.fn(async () => {});
+    render(<EmailComposer initialData={REOPENED_DRAFT} onSend={onSend as never} onClose={vi.fn()} />);
+    fireEvent.click(screen.getAllByTestId('composer-send')[0]);
+    await waitFor(() => expect(onSend).toHaveBeenCalled());
+    expect(edit.settle).not.toHaveBeenCalled();
+  });
+
+  const forward = (phishingMarked: boolean) => (
+    <EmailComposer
+      mode="forward"
+      replyTo={{ subject: 'Original', phishingMarked, attachments: [{ blobId: 'b1', name: 'a.txt', type: 'text/plain', size: 3 }] }}
+      onClose={vi.fn()}
+    />
+  );
+
+  it('a part forwarded from an ordinary message has Edit', async () => {
+    render(forward(false));
+    expect(await screen.findByTestId('composer-edit')).toBeTruthy();
+  });
+
+  it('a part forwarded from a message marked as phishing has none', async () => {
+    render(forward(true));
+    await screen.findByText('a.txt');
+    expect(screen.queryByTestId('composer-edit')).toBeNull();
+  });
+
+  it('the mark stays on the part through a hand-over to another window', async () => {
+    render(<EmailComposer initialData={{ ...REOPENED_DRAFT, draftId: null, attachments: [{ blobId: 'b1', name: 'a.txt', type: 'text/plain', size: 3, editBlocked: true }] }} onClose={vi.fn()} />);
+    await screen.findByText('a.txt');
+    expect(screen.queryByTestId('composer-edit')).toBeNull();
+  });
+});

components/email/__tests__/edit-attachment-gates.test.tsx

@@ -0,0 +1,141 @@
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { Email, Mailbox } from '@/lib/jmap/types';
+import { PHISHING_KEYWORD } from '@/lib/phishing-report';
+
+// Where a message's attachment gets Edit, on the real components with the real check. Only
+// the organisation's answer is stood in for: whether it has spoken, which needs a server.
+
+vi.mock('@/lib/offline/offline-mode', async (original) => ({
+  ...(await original<typeof import('@/lib/offline/offline-mode')>()),
+  scopeDecided: () => true,
+}));
+vi.mock('@/hooks/use-media-query', () => ({
+  useDeviceDetection: () => ({ isMobile: false, isTablet: false, isDesktop: true }),
+  useMediaQuery: () => false,
+}));
+vi.mock('@/components/tour/tour-provider', () => ({
+  useTour: () => ({ activeTour: null, startTour: vi.fn(), endTour: vi.fn(), registerStep: vi.fn() }),
+}));
+vi.mock('@/components/plugins/plugin-slot', () => ({ PluginSlot: () => null }));
+vi.mock('@/hooks/use-plugin-slot-offers', () => ({ usePluginSlotOffers: () => [] }));
+vi.mock('@/hooks/use-wopi-status', () => ({ useWopiStatus: () => ({ enabled: false }), canWopiOpen: () => false }));
+vi.mock('@/hooks/use-own-domain-address', () => ({ useOwnDomainAddress: () => () => false }));
+
+class NoopResizeObserver {
+  observe() {}
+  unobserve() {}
+  disconnect() {}
+}
+vi.stubGlobal('ResizeObserver', NoopResizeObserver);
+
+const { EmailViewer } = await import('../email-viewer');
+const { ThreadConversationView } = await import('../thread-conversation-view');
+const { useAuthStore } = await import('@/stores/auth-store');
+
+const mailboxes = [{ id: 'inbox', name: 'Inbox', role: 'inbox', parentId: null, myRights: { mayAddItems: true } }] as unknown as Mailbox[];
+
+const part = (over: Record<string, unknown> = {}) => ({ partId: '2', blobId: 'blob-1', name: 'report.docx', type: 'application/octet-stream', size: 10, disposition: 'attachment', ...over });
+
+function makeEmail(attachment: Record<string, unknown>, keywords: Record<string, boolean> = { $seen: true }): Email {
+  return {
+    id: 'e1', blobId: 'b1', threadId: 't1', mailboxIds: { inbox: true }, keywords,
+    from: [{ name: 'Alice', email: 'alice@example.com' }], to: [{ name: 'Bob', email: 'bob@example.com' }],
+    subject: 'Hello', receivedAt: '2026-01-01T00:00:00Z', preview: 'Hello', hasAttachment: true, size: 100,
+    textBody: [{ partId: '1', type: 'text/plain' }], htmlBody: [{ partId: '1', type: 'text/plain' }],
+    attachments: [attachment], bodyValues: { 1: { value: 'Hello' } },
+  } as unknown as Email;
+}
+
+/** Answers anything the views ask of a client with nothing. */
+const fakeClient = new Proxy({}, { get: (_target, name) => (name === 'then' ? undefined : () => undefined) });
+
+let popup: ReturnType<typeof vi.fn>;
+
+beforeEach(() => {
+  popup = vi.fn(async () => null);
+  window.bulwarkDesktop = {
+    version: 1,
+    platform: 'win32',
+    menu: { setState: () => {}, popup },
+    // The shell's list, for the ones used here.
+    edit: { canEdit: (name: string) => /\.(docx|txt)$/.test(name), list: async () => [], onChange: () => () => {} },
+  } as never;
+  useAuthStore.setState({ activeAccountId: 'acct', client: fakeClient } as never);
+});
+
+afterEach(() => {
+  cleanup();
+  window.bulwarkDesktop = undefined;
+  useAuthStore.setState({ activeAccountId: null, client: null } as never);
+});
+
+async function viewerMenu(email: Email): Promise<(string | undefined)[]> {
+  render(<EmailViewer email={email} mailboxes={mailboxes} selectedMailbox="inbox" currentMailboxRole="inbox" onArchive={vi.fn()} onDelete={vi.fn()} />);
+  const tile = await screen.findByTestId('attachment');
+  fireEvent.contextMenu(tile.parentElement ?? tile, { clientX: 5, clientY: 5 });
+  await waitFor(() => expect(popup).toHaveBeenCalled());
+  return (popup.mock.calls[0][0] as { label?: string }[]).map((item) => item.label);
+}
+
+describe('the reader', () => {
+  it('offers Edit on a part with a blob', async () => {
+    expect(await viewerMenu(makeEmail(part()))).toContain('edit');
+  });
+
+  it('has none on a message marked as phishing', async () => {
+    expect(await viewerMenu(makeEmail(part(), { $seen: true, [PHISHING_KEYWORD]: true }))).not.toContain('edit');
+  });
+
+  it('has none on a part with no blob, which is how a decrypted part reaches it', async () => {
+    expect(await viewerMenu(makeEmail(part({ blobId: '', tnefData: new Uint8Array([1]) })))).not.toContain('edit');
+  });
+
+  it('has none for a file the shell keeps out', async () => {
+    expect(await viewerMenu(makeEmail(part({ name: 'run.bat' })))).not.toContain('edit');
+  });
+});
+
+function conversation(email: Email) {
+  render(
+    <ThreadConversationView
+      thread={{ threadId: 't1', emails: [email], latestEmail: email } as never}
+      emails={[email] as never}
+      onBack={() => {}}
+    />,
+  );
+}
+
+describe('the conversation view', () => {
+  const edit = () => screen.queryByRole('button', { name: 'desktopEdit.edit_named' });
+
+  it('offers Edit on a part with a blob', async () => {
+    conversation(makeEmail(part()));
+    await waitFor(() => expect(edit()).not.toBeNull());
+  });
+
+  it('has none on a message marked as phishing', async () => {
+    conversation(makeEmail(part(), { $seen: true, [PHISHING_KEYWORD]: true }));
+    await screen.findByText(/report\.docx/);
+    expect(edit()).toBeNull();
+  });
+
+  it('has none on a part with no blob', async () => {
+    conversation(makeEmail(part({ blobId: '' })));
+    await screen.findByText(/report\.docx/);
+    expect(edit()).toBeNull();
+  });
+
+  it('has none for a file the shell keeps out', async () => {
+    conversation(makeEmail(part({ name: 'run.bat' })));
+    await screen.findByText(/run\.bat/);
+    expect(edit()).toBeNull();
+  });
+
+  it('has none in a browser', async () => {
+    window.bulwarkDesktop = undefined;
+    conversation(makeEmail(part()));
+    await screen.findByText(/report\.docx/);
+    expect(edit()).toBeNull();
+  });
+});

components/email/__tests__/reader-attachments.test.tsx

@@ -55,6 +55,24 @@ describe('the right-click menu in the desktop app', () => {
     expect(popup.mock.calls[0][0].map((item) => item.label)).toEqual(['open']);
   });
 
+  it('Edit shows when the file can be edited and runs the action', async () => {
+    const onEdit = vi.fn();
+    const { props, popup } = await openMenu((items) => items.find((i) => i.label === 'edit')?.id ?? null, { onEdit, canEdit: () => true });
+    const labels = popup.mock.calls[0][0].flatMap((i: { label?: string }) => (i.label ? [i.label] : []));
+    expect(labels).toEqual(['open', 'save_as', 'edit', 'copy']);
+    await waitFor(() => expect(onEdit).toHaveBeenCalledWith(props.attachments[0]));
+  });
+
+  it('Edit stays out for a file it cannot take', async () => {
+    const { popup } = await openMenu(() => null, { onEdit: vi.fn(), canEdit: () => false });
+    expect(popup.mock.calls[0][0].map((i: { label?: string }) => i.label)).not.toContain('edit');
+  });
+
+  it('Edit stays out with downloads off, whatever else says yes', async () => {
+    const { popup } = await openMenu(() => null, { onEdit: vi.fn(), canEdit: () => true, downloadsOff: true });
+    expect(popup.mock.calls[0][0].map((i: { label?: string }) => i.label)).not.toContain('edit');
+  });
+
   it('a browser keeps its own menu', async () => {
     window.bulwarkDesktop = undefined;
     renderBar([file('1', 'report.pdf')], { onCopyFile: vi.fn() });

components/email/__tests__/rich-text-editor-quote-caret.test.tsx

@@ -0,0 +1,72 @@
+import { act, render, waitFor } from '@testing-library/react';
+import { describe, expect, it } from 'vitest';
+import React from 'react';
+import type { Editor } from '@tiptap/core';
+
+import { RichTextEditor } from '../rich-text-editor';
+import { serializeEditorContent } from '../quoted-html';
+
+// A reply's quoted inline images load while the caret already waits in the
+// body, and swapping them in re-sets the editor's content. That threw the caret
+// onto the quote as a node, where the first key typed replaced the whole quote
+// and the reply went out without the original or its images, or below the quote.
+
+const PLACEHOLDER = 'data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7';
+const IMAGE = 'data:image/png;base64,iVBORw0KGgo=';
+const body = (src: string, below: string) => `<p></p><p data-reply-quote-start="true">On Tuesday, C wrote:</p><div data-quoted-html=""><p>Original text</p><img src="${src}" alt="logo" data-cid="logo@x"></div>${below}`;
+
+async function openReply(below: string) {
+  let editor: Editor | null = null;
+  const element = (content: string) => (
+    <RichTextEditor content={content} onChange={() => {}} onEditorReady={(ed) => { editor = ed as unknown as Editor; }} />
+  );
+  const view = render(element(body(PLACEHOLDER, below)));
+  await waitFor(() => expect(editor).not.toBeNull());
+  const ed = editor as unknown as Editor;
+  // Where focus('start') puts it; focus itself waits for a frame.
+  act(() => { ed.commands.setTextSelection(1); });
+  return { editor: ed, setContent: (content: string) => view.rerender(element(content)) };
+}
+
+const type = (editor: Editor, text: string) => act(() => { editor.view.dispatch(editor.state.tr.insertText(text)); });
+
+describe.each([
+  ['with a line below the quote', '<p></p>'],
+  ['with the quote at the very end', ''],
+])('typing in a reply once its inline images have loaded, %s', (_name, below) => {
+  it('goes above the quote and keeps it and its image', async () => {
+    const { editor, setContent } = await openReply(below);
+
+    setContent(body(IMAGE, below));
+    type(editor, 'My answer');
+
+    const sent = serializeEditorContent(editor);
+    expect(editor.state.doc.child(0).textContent).toBe('My answer');
+    expect(sent).toContain('Original text');
+    expect(sent).toContain(IMAGE);
+  });
+
+  it('carries on where the user was already typing', async () => {
+    const { editor, setContent } = await openReply(below);
+    type(editor, 'Hel');
+
+    setContent(body(IMAGE, `${below}`).replace('<p></p>', '<p>Hel</p>'));
+    type(editor, 'lo');
+
+    expect(editor.state.doc.child(0).textContent).toBe('Hello');
+    expect(serializeEditorContent(editor)).toContain('Original text');
+  });
+});
+
+describe('a body replaced by a shorter one', () => {
+  it('leaves the caret inside it', async () => {
+    const { editor, setContent } = await openReply('<p>A long line below the quote</p>');
+    act(() => { editor.commands.setTextSelection(editor.state.doc.content.size - 2); });
+
+    setContent('<p>Short</p>');
+    type(editor, '!');
+
+    expect(editor.state.doc.textContent).toContain('Short');
+    expect(editor.state.doc.textContent).toContain('!');
+  });
+});

components/email/email-composer.tsx

@@ -15,6 +15,7 @@ import { Input } from "@/components/ui/input";
 import {
   X,
   Paperclip,
+  FilePen,
   Send,
   Save,
   Check,
@@ -178,6 +179,7 @@ import { noteOpenDraft } from "@/lib/desktop/window-restore";
 import type { RescuedDraft } from "@/lib/popout/channel";
 import { toUnicodeEmail } from "@/lib/idn";
 import { setComposerFileTarget } from "@/lib/desktop/window-files";
+import { useComposerEdits } from "@/hooks/use-composer-edits";
 
 // A Pro tab, message or folder dragged across a composer tab is on its way to
 // the pane or the split edge: those drags belong to the shell. There is no shell
@@ -276,7 +278,7 @@ export interface ComposerDraftData {
    * File). Without these the composer starts with zero attachments and the
    * next save/send rebuilds the draft without them - silent data loss (#849).
    */
-  attachments?: Array<{ blobId: string; name?: string; type?: string; size: number; cid?: string; disposition?: string; sourceAccountId?: string }>;
+  attachments?: Array<{ blobId: string; name?: string; type?: string; size: number; cid?: string; disposition?: string; sourceAccountId?: string; editBlocked?: boolean }>;
   /** The send options picked so far; absent, the defaults. Carried to another window. */
   requestReadReceipt?: boolean;
   requestDsn?: boolean;
@@ -481,6 +483,8 @@ interface EmailComposerProps {
     quoteWrapInBlockquote?: boolean;
     /** The original's headers: a reply or forward starts with its classification label. */
     headers?: Record<string, string | string[]>;
+    /** The original carries the phishing mark: its forwarded parts stay out of the desktop app's Edit. */
+    phishingMarked?: boolean;
     /** The original's From, when `from` is left out (a forward as attachment): whether its label counts. */
     originalFrom?: { email?: string; name?: string }[];
   };
@@ -488,10 +492,14 @@ interface EmailComposerProps {
 
 type ComposerAttachment = {
   file?: File;
+  // The desktop app's Edit: which session's file this is. See useComposerEdits.
+  editSessionId?: string;
   // Login whose server holds `blobId`, set for parts of the original message
   // on a forward - the message may go out through another account, which
   // cannot resolve them. See rehomeForeignBlobs.
   sourceAccountId?: string;
+  // From a message marked as phishing: stays out of the desktop app's Edit.
+  editBlocked?: boolean;
   name: string;
   type: string;
   size: number;
@@ -589,6 +597,7 @@ export function EmailComposer({
   const tQuote = useTranslations('quote_header');
   const tViewer = useTranslations('email_viewer');
   const tClassification = useTranslations('classification');
+  const tEdit = useTranslations('desktopEdit');
   const tProofreading = useTranslations('proofreading');
   const tOfflineDrafts = useTranslations('offlineDrafts');
   const tOffline = useTranslations('offline');
@@ -1122,6 +1131,7 @@ export function EmailComposer({
           // A forward stashed before its first save still holds the original
           // account's blobs: keep the tag so they are copied before saving.
           ...(att.sourceAccountId ? { sourceAccountId: att.sourceAccountId } : {}),
+          ...(att.editBlocked ? { editBlocked: true } : {}),
           fromDraftPart: true,
         }));
     }
@@ -1150,6 +1160,7 @@ export function EmailComposer({
           size: att.size,
           blobId: att.blobId,
           sourceAccountId: att.sourceAccountId ?? sourceAccountId ?? undefined,
+          ...(replyTo.phishingMarked ? { editBlocked: true } : {}),
         }));
     }
     return [];
@@ -2754,6 +2765,26 @@ export function EmailComposer({
   const [composerRootEl, setComposerRootEl] = useState<HTMLDivElement | null>(null);
 
   // The desktop app: files dropped or pasted anywhere on the window come here, if this one's on screen.
+  const loadAttachmentForEdit = useCallback(async (att: ComposerAttachment): Promise<Blob> => {
+    if (att.file) return att.file;
+    // A forwarded part lives in its own login until the draft is saved through another.
+    const owner = att.sourceAccountId && att.sourceAccountId !== composerAccountId
+      ? useAuthStore.getState().getClientForAccount(att.sourceAccountId)
+      : composerClient;
+    if (!owner || !att.blobId) throw new Error('No content for this attachment');
+    return owner.fetchBlob(att.blobId, att.name, att.type);
+  }, [composerClient, composerAccountId]);
+  const composerEdits = useComposerEdits<ComposerAttachment>({
+    attachments,
+    setAttachments,
+    addFiles,
+    load: loadAttachmentForEdit,
+    account: composerAccountId ?? '',
+    draftId,
+    ownerAccountId: draftAccountId,
+    repliesTo: mode === 'reply' || mode === 'replyAll' ? sourceEmailId : undefined,
+    ready: !!client,
+  });
   useEffect(() => setComposerFileTarget(
     (files) => void addFiles(files),
     () => !!composerRootEl?.isConnected && composerRootEl.getClientRects().length > 0,
@@ -3663,6 +3694,7 @@ export function EmailComposer({
   }, [attachments]);
   const [isWaitingForUploads, setIsWaitingForUploads] = useState(false);
   const sendCancelledRef = useRef(false);
+  const confirmingSendRef = useRef(false);
   // The user confirmed sending without a subject for this message.
   const emptySubjectConfirmedRef = useRef(false);
   // Placeholders the user chose to send as they are. The warning comes back
@@ -3716,6 +3748,19 @@ export function EmailComposer({
   } = {}) => {
     if (isSendingRef.current) return;
 
+    // Saved in another program and not on this message yet: not silently the older one.
+    // The wait lets a second click in, so that one goes no further.
+    if (composerEdits.holdsEdits()) {
+      if (confirmingSendRef.current) return;
+      confirmingSendRef.current = true;
+      try {
+        if (!(await composerEdits.confirmSend())) return;
+      } finally {
+        confirmingSendRef.current = false;
+      }
+      if (isSendingRef.current) return;
+    }
+
     if (attachmentsRef.current.some(att => att.uploading)) {
       isSendingRef.current = true;
       setIsSending(true);
@@ -4251,6 +4296,7 @@ export function EmailComposer({
         }
       }
 
+      composerEdits.finish();
       setTo([]);
       setCc([]);
       setBcc([]);
@@ -4492,6 +4538,7 @@ export function EmailComposer({
       attachment.abortController?.abort();
     }
     setShowCloseDialog(false);
+    composerEdits.finish();
     if (saveTimeoutRef.current) {
       clearTimeout(saveTimeoutRef.current);
     }
@@ -5400,6 +5447,28 @@ export function EmailComposer({
                     ) : (
                       <div className="flex items-center gap-2 min-w-0">{label}</div>
                     )}
+                    {composerEdits.hasUpdate(att) && !att.uploading && (
+                      <button
+                        type="button"
+                        onClick={() => void composerEdits.update(att)}
+                        className="-my-0.5 whitespace-nowrap text-xs font-medium text-primary hover:underline"
+                        data-testid="composer-edit-update"
+                      >
+                        {tEdit('update')}
+                      </button>
+                    )}
+                    {!att.uploading && !att.error && composerEdits.canEditChip(att) && (
+                      <button
+                        type="button"
+                        onClick={() => void composerEdits.startEdit(att)}
+                        className={cn("-my-0.5 hover:text-foreground text-muted-foreground min-w-6 min-h-6 flex items-center justify-center", TOUCH_HIT_AREA)}
+                        title={tEdit('edit')}
+                        aria-label={tEdit('edit_named', { name: att.name })}
+                        data-testid="composer-edit"
+                      >
+                        <FilePen className="w-3 h-3" />
+                      </button>
+                    )}
                     <button
                       onClick={() => removeAttachment(index)}
                       className={cn("ms-0.5 -my-0.5 hover:text-destructive min-w-6 min-h-6 flex items-center justify-center", TOUCH_HIT_AREA)}

components/email/email-viewer.tsx

@@ -14,6 +14,7 @@ import { useMailReading } from "@/hooks/use-mail-reading";
 import { useReadAloud } from "@/hooks/use-read-aloud";
 import { ReadAloudBar } from "./read-aloud-bar";
 import { ReaderAttachments, type AttachmentDragProps } from "./reader-attachments";
+import { editAccountOf, useEditAttachment } from "@/hooks/use-edit-attachment";
 import { ReaderViewDialog } from "./reader-view-dialog";
 import { MessagePrint, type MessagePrintFields } from "./message-print";
 import { usePrintListener, usePrinting } from "@/components/print/print-root";
@@ -3171,6 +3172,8 @@ export function EmailViewer({
   const attachmentCardsRef = useRef<HTMLDivElement>(null);
   const desktopClipboard = getDesktopBridge()?.clipboard;
   const tDesktopUi = useTranslations('desktopUi.attachment');
+  const editAccount = editAccountOf(email);
+  const { canEdit: canEditAttachment, edit: editAttachment } = useEditAttachment(editAccount);
   const readerAttachmentProps = {
     attachments: effectiveAttachments,
     thumbUrls: imageThumbUrls,
@@ -3179,6 +3182,20 @@ export function EmailViewer({
     onDownload: handleEffectiveAttachmentDownload,
     onDownloadAll: handleDownloadAllAttachments,
     onSaveAllToFolder: canPickFolder() ? () => void handleSaveAllToFolder() : undefined,
+    onEdit: (attachment: EffectiveAttachment) => {
+      if (!attachment.blobId || !blobClient || !email) return;
+      const { blobId } = attachment;
+      void editAttachment({
+        key: `mail:${editAccount}:${email.id}:${blobId}`,
+        name: resolveAttachmentName(attachment),
+        type: attachment.type,
+        account: editAccount,
+        source: { kind: 'mail', emailId: email.id, ownerAccountId: blobAccountId },
+        load: () => blobClient.fetchBlobArrayBuffer(blobId, undefined, undefined, blobAccountId),
+      });
+    },
+    // Decrypted parts have no blob: they never go on disk this way. A message marked as phishing doesn't get opened in other programs.
+    canEdit: (attachment: EffectiveAttachment) => !!attachment.blobId && !!blobClient && !phishingMarked && canEditAttachment(resolveAttachmentName(attachment)),
     onCopyFile: desktopClipboard && blobClient ? (attachment: EffectiveAttachment) => {
       if (!attachment.blobId || !downloadAllowed('attachment', email)) return;
       void blobClient.fetchBlobArrayBuffer(attachment.blobId, undefined, undefined, blobAccountId)

components/email/quoted-html.ts

@@ -23,6 +23,22 @@ const QUOTED_REMOTE_ALLOWED_ATTR = "data-quoted-remote";
 // Atom blocks typing must never replace just because they were left selected.
 const ATOM_BLOCKS = new Set(["quotedHtml", "signatureBlock"]);
 
+/**
+ * Replacing the editor's content throws the caret to where the old selection
+ * maps to: the quote as a node, where the next key typed replaces the whole
+ * quote, or the line below it. There is no focus event for the guard below to
+ * catch: a reply's inline images finish loading while the caret already waits
+ * in the body. It goes back to where it was, or to the start if that is gone.
+ */
+export function restoreCaretAfterContentSync(editor: Editor, caret: number): void {
+  const { doc } = editor.state;
+  const near = Selection.near(doc.resolve(Math.min(caret, doc.content.size)));
+  const target = near instanceof TextSelection ? near : Selection.atStart(doc);
+  if (target instanceof TextSelection && !target.eq(editor.state.selection)) {
+    editor.view.dispatch(editor.state.tr.setSelection(target));
+  }
+}
+
 // Reusable style for the quote bar when quoting email text (like in a reply).
 const QUOTE_BAR_STYLE =
   "border-left:2px solid #c5c5c5;padding-left:12px;margin-top:8px;";

components/email/reader-attachments.tsx

@@ -58,6 +58,12 @@ interface ReaderAttachmentsProps<T extends ReaderAttachmentItem> {
    * has on an attachment; a browser has its own menu there and never gets this one.
    */
   onCopyFile?: (attachment: T) => void;
+  /**
+   * The desktop app's Edit: opens the file in its program. `canEdit` says no where the file
+   * type or the organisation's rules keep it out.
+   */
+  onEdit?: (attachment: T) => void;
+  canEdit?: (attachment: T) => boolean;
   /** Whether a click on the attachment previews it instead of downloading it. */
   opensPreview: (attachment: T) => boolean;
   onOpen: (attachment: T) => void;
@@ -106,6 +112,8 @@ export function ReaderAttachments<T extends ReaderAttachmentItem>({
   onDownloadAll,
   onSaveAllToFolder,
   onCopyFile,
+  onEdit,
+  canEdit,
   downloadingAll,
   downloadsOff = false,
   onSaveToFiles,
@@ -118,6 +126,7 @@ export function ReaderAttachments<T extends ReaderAttachmentItem>({
   const tDevice = useTranslations("device_policy");
   const tWindows = useTranslations("pwaWindows");
   const tDesktop = useTranslations("desktopUi.attachment");
+  const tEdit = useTranslations("desktopEdit");
   const menu = useContextMenu<T>();
   const [desktopMenu, setDesktopMenu] = useState(false);
   useEffect(() => setDesktopMenu(nativeMenusAvailable()), []);
@@ -351,6 +360,9 @@ export function ReaderAttachments<T extends ReaderAttachmentItem>({
           {!downloadsOff && (
             <ContextMenuItem label={tDesktop("save_as")} onClick={() => { menu.closeContextMenu(); onDownload(menuTarget); }} />
           )}
+          {!downloadsOff && onEdit && canEdit?.(menuTarget) && (
+            <ContextMenuItem label={tEdit("edit")} onClick={() => { menu.closeContextMenu(); onEdit(menuTarget); }} />
+          )}
           {!downloadsOff && onCopyFile && (
             <ContextMenuItem label={tDesktop("copy")} onClick={() => { menu.closeContextMenu(); onCopyFile(menuTarget); }} />
           )}

components/email/rich-text-editor.tsx

@@ -24,7 +24,7 @@ import { TableRow } from "@tiptap/extension-table-row";
 import { TableHeader } from "@tiptap/extension-table-header";
 import { TableCell } from "@tiptap/extension-table-cell";
 import { ReplyQuoteCollapse } from "@/components/email/reply-quote-collapse";
-import { QuotedHtml, serializeEditorContent } from "@/components/email/quoted-html";
+import { QuotedHtml, restoreCaretAfterContentSync, serializeEditorContent } from "@/components/email/quoted-html";
 import { keepLoadedParagraphSpacing, paragraphStyleWithoutSpacing, trailingParagraphBreakRule } from "@/components/email/paragraph-breaks";
 import { SignatureBlock } from "@/components/email/signature-block";
 import { styledBlockAttributes } from "@/components/email/styled-block-attributes";
@@ -614,7 +614,9 @@ export function RichTextEditor({
     if (!editor) return;
     const loaded = keepLoadedParagraphSpacing(content);
     if (loaded !== serializeEditorContent(editor)) {
+      const caret = editor.state.selection.from;
       editor.commands.setContent(loaded, { emitUpdate: false });
+      restoreCaretAfterContentSync(editor, caret);
     }
   }, [content, editor]);
 

components/email/thread-conversation-view.tsx

@@ -51,6 +51,8 @@ import {
 } from "@/components/icons";
 import { formatScheduledSendAt } from "@/lib/scheduled-send-label";
 import { useTranslations } from "next-intl";
+import { FilePen } from "@/components/icons";
+import { editAccountOf, useEditAttachment } from "@/hooks/use-edit-attachment";
 import { useSettingsStore } from "@/stores/settings-store";
 import { useContactStore } from "@/stores/contact-store";
 import { useEmailStore, resolveEmailBlobContext, type EmailBlobContext } from "@/stores/email-store";
@@ -589,6 +591,8 @@ export function ConversationEmailBody({
   const fallbackSource = useEmailStore(useShallow(() => resolveEmailBlobContext(email, client)));
   const source = blobSource ?? fallbackSource;
   const { client: blobClient, accountId } = source;
+  const editAccount = source.clientAccountId ?? editAccountOf(email);
+  const { canEdit: canEditAttachment, edit: editAttachment } = useEditAttachment(editAccount);
   // Reported as phishing: a banner, links off, no cards (as in the reader).
   const phishingMarked = usePhishingMarked(email);
   const tPhishing = useTranslations('phishing_report');
@@ -1072,6 +1076,28 @@ export function ConversationEmailBody({
                     <Download className="w-4 h-4 text-muted-foreground" />
                   )}
                 </button>
+                {blobClient && attachment.blobId && !phishingMarked && canEditAttachment(attachment.name) && (
+                  <button
+                    type="button"
+                    title={t('desktopEdit.edit')}
+                    aria-label={t('desktopEdit.edit_named', { name: stripBidiControls(attachment.name ?? '') })}
+                    className="-ms-1.5 self-center rounded-lg p-2 text-muted-foreground hover:text-foreground"
+                    onClick={(e) => {
+                      e.stopPropagation();
+                      const { blobId } = attachment;
+                      void editAttachment({
+                        key: `mail:${editAccount}:${email.id}:${blobId}`,
+                        name: attachment.name ?? 'attachment',
+                        type: attachment.type,
+                        account: editAccount,
+                        source: { kind: 'mail', emailId: email.id, ownerAccountId: accountId },
+                        load: () => blobClient.fetchBlobArrayBuffer(blobId, undefined, undefined, accountId),
+                      });
+                    }}
+                  >
+                    <FilePen className="h-4 w-4" />
+                  </button>
+                )}
                 <AttachmentPluginMenu emailId={email.id} attachment={attachment} className="-ms-1.5 self-center p-2 rounded-lg" />
                 </React.Fragment>
               );

components/files/__tests__/wopi-base-path.test.tsx

@@ -2,6 +2,7 @@ import { render, renderHook, waitFor, cleanup } from '@testing-library/react';
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { useWopiStatus } from '@/hooks/use-wopi-status';
 import { WopiEditor } from '@/components/files/wopi-editor';
+import { useAuthStore } from '@/stores/auth-store';
 
 // Behind a reverse proxy at a sub-path (e.g. /webmail) a bare
 // fetch('/api/...') reaches the mail server instead of the webmail and comes
@@ -26,9 +27,9 @@ afterEach(() => {
 
 describe('WOPI requests under a sub-path mount', () => {
   it('probes the editor status under the mount prefix', async () => {
+    useAuthStore.setState({ isAuthenticated: true, client: {} as never });
     renderHook(() => useWopiStatus(true));
-    await waitFor(() => expect(fetchMock).toHaveBeenCalled());
-    expect(fetchMock.mock.calls[0][0]).toBe('/webmail/api/wopi/status');
+    await waitFor(() => expect(fetchMock).toHaveBeenCalledWith('/webmail/api/wopi/status', undefined));
   });
 
   it('launches the editor under the mount prefix', async () => {

components/icons/index.ts

@@ -87,6 +87,7 @@ export {
   IconDatabase as Database,
   IconDownload as Download,
   IconEdit as EditIcon,
+  IconFilePencil as FilePen,
   IconDots as Ellipsis,
   IconEraser as Eraser,
   IconExternalLink as ExternalLink,

components/layout/window-controls-host.tsx

@@ -2,6 +2,7 @@
 
 import { useEffect, useState } from "react";
 import { applyControlsArea, watchTitlebarArea, watchWindowRows, type TitlebarArea } from "@/lib/window-controls-overlay";
+import { claimBrowserSignIn } from "@/lib/desktop/browser-sign-in";
 
 /**
  * The window's controls over the app, with no title bar row: see
@@ -10,6 +11,9 @@ import { applyControlsArea, watchTitlebarArea, watchWindowRows, type TitlebarAre
  * (admin, setup) get it too; there are no messages up there.
  */
 export function WindowControlsHost() {
+  // In the first render of every page, before any frame exists: a frame can reach the
+  // bridge, and whoever comes after this gets nothing.
+  if (typeof window !== "undefined") claimBrowserSignIn();
   const [area, setArea] = useState<TitlebarArea | null>(null);
 
   useEffect(() => watchTitlebarArea((next) => {

components/mail/mail-app.tsx

@@ -129,6 +129,7 @@ import { isFilePreviewable } from "@/lib/file-preview";
 import { prepareQuickReply, type QuickReplyQuestion } from "@/lib/outgoing/quick-reply";
 import { composerSendOptions } from "@/lib/outgoing/composer-send-options";
 import { isPhishingMarked } from "@/lib/phishing-links";
+import { phishingMarkedNow } from "@/hooks/use-phishing-report";
 import { automaticLabel, classifyOutgoing, labelSourceHeaders, reopenedLabelChoice } from "@/lib/outgoing/classification";
 import enMessages from "@/locales/en/common.json";
 import { computeReplyThreadingHeaders } from "@/lib/email-threading";
@@ -1481,6 +1482,7 @@ export function MailApp({ linkSegments: routeSegments }: MailAppProps = {}) {
       bcc: selectedEmail.bcc,
       deliveredTo: deliveryAddresses(selectedEmail.headers),
       subject: selectedEmail.subject,
+      phishingMarked: phishingMarkedNow(selectedEmail),
       ...getQuoteBodies(selectedEmail),
       receivedAt: selectedEmail.receivedAt,
       // The login that holds the message, so the reply defaults to that
@@ -3214,6 +3216,8 @@ export function MailApp({ linkSegments: routeSegments }: MailAppProps = {}) {
         attachments: [payload.attachment],
         headers: labelSourceHeaders(email.headers),
         originalFrom: email.from,
+        // The login holding the message, whose blob this attachment is.
+        accountId: email.sourceClientAccountId ?? viewingAccountId ?? undefined,
       },
     });
     setComposerMode('forward');
@@ -5188,6 +5192,7 @@ export function MailApp({ linkSegments: routeSegments }: MailAppProps = {}) {
           bcc: composerSourceEmail.bcc,
           deliveredTo: deliveryAddresses(composerSourceEmail.headers),
           subject: composerSourceEmail.subject,
+          phishingMarked: phishingMarkedNow(composerSourceEmail),
           ...getQuoteBodies(composerSourceEmail),
           receivedAt: composerSourceEmail.receivedAt,
           // The login that holds the message, so the reply

components/offline/__tests__/key-protection-notes.test.tsx

@@ -0,0 +1,50 @@
+import { act, render, screen } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { useOfflineStore } from '@/lib/offline/state';
+import { KeyProtectionNotes } from '../key-protection-notes';
+
+vi.mock('next-intl', () => ({
+  useTranslations: () => (key: string, values?: Record<string, unknown>) => (values ? `${key}:${JSON.stringify(values)}` : key),
+}));
+
+function withShell(wrap: boolean): void {
+  (window as unknown as { bulwarkDesktop: unknown }).bulwarkDesktop = {
+    version: 1,
+    platform: 'linux',
+    appLock: { status: async () => ({ wrap }) },
+  };
+}
+
+describe('what settings say about the key', () => {
+  beforeEach(() => useOfflineStore.setState({ keyUnprotected: false, rekey: {} }));
+  afterEach(() => {
+    delete (window as unknown as { bulwarkDesktop?: unknown }).bulwarkDesktop;
+  });
+
+  it('a browser says it has no layer of the OS', async () => {
+    await act(async () => { render(<KeyProtectionNotes browser />); });
+    expect(screen.getByText('browser_note')).toBeTruthy();
+  });
+
+  it('the desktop app with a real key store says nothing', async () => {
+    withShell(true);
+    await act(async () => { render(<KeyProtectionNotes browser />); });
+    expect(screen.queryByTestId('key-protection-notes')).toBeNull();
+  });
+
+  it('Linux with no secret service says secrets are only obfuscated', async () => {
+    withShell(false);
+    await act(async () => { render(<KeyProtectionNotes browser />); });
+    expect(screen.getByText('no_secure_storage')).toBeTruthy();
+    expect(screen.queryByText('browser_note')).toBeNull();
+  });
+
+  it('says out loud when the key store refused, and how a re-encryption goes', async () => {
+    withShell(true);
+    useOfflineStore.setState({ keyUnprotected: true, rekey: { a: 40, b: 'failed' } });
+    await act(async () => { render(<KeyProtectionNotes />); });
+    expect(screen.getByText('wrap_failed')).toBeTruthy();
+    expect(screen.getByText('rekey_failed')).toBeTruthy();
+    expect(screen.getByText('rekey_progress:{"percent":40}')).toBeTruthy();
+  });
+});

components/offline/key-protection-notes.tsx

@@ -0,0 +1,49 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { useTranslations } from 'next-intl';
+import { getDesktopBridge } from '@/lib/desktop/bridge';
+import { useOfflineStore } from '@/lib/offline/state';
+
+/**
+ * What protects the key to the mail on this device, where that's less than one would think, and
+ * how a re-encryption is getting on. `browser`: also says what a browser can't do. The app lock's
+ * own settings have said that already.
+ */
+export function KeyProtectionNotes({ browser = false }: { browser?: boolean }) {
+  const t = useTranslations('keyProtection');
+  const keyUnprotected = useOfflineStore((state) => state.keyUnprotected);
+  const rekey = useOfflineStore((state) => state.rekey);
+  const [bridge, setBridge] = useState<'none' | 'wraps' | 'obfuscates'>('wraps');
+
+  useEffect(() => {
+    const member = getDesktopBridge()?.appLock;
+    if (!member) {
+      setBridge('none');
+      return;
+    }
+    let live = true;
+    void member.status().then((status) => {
+      if (live) setBridge(status.wrap ? 'wraps' : 'obfuscates');
+    }).catch(() => {});
+    return () => {
+      live = false;
+    };
+  }, []);
+
+  const states = Object.values(rekey);
+  const running = states.filter((state): state is number => typeof state === 'number');
+  const lines = [
+    bridge === 'obfuscates' ? t('no_secure_storage') : null,
+    bridge === 'none' && browser ? t('browser_note') : null,
+    keyUnprotected ? t('wrap_failed') : null,
+    states.includes('failed') ? t('rekey_failed') : null,
+    running.length > 0 ? t('rekey_progress', { percent: Math.min(...running) }) : null,
+  ].filter((line): line is string => line !== null);
+  if (lines.length === 0) return null;
+  return (
+    <div className="space-y-1 rounded-md border border-border bg-muted px-3 py-2 text-xs text-foreground" data-testid="key-protection-notes">
+      {lines.map((line) => <p key={line}>{line}</p>)}
+    </div>
+  );
+}

components/offline/offline-host.tsx

@@ -27,6 +27,9 @@ export function OfflineHost() {
   const tStorage = useTranslations('offlineStorage');
   const tStorageRef = useRef(tStorage);
   tStorageRef.current = tStorage;
+  const tKey = useTranslations('keyProtection');
+  const tKeyRef = useRef(tKey);
+  tKeyRef.current = tKey;
   const router = useRouter();
   const routerRef = useRef(router);
   routerRef.current = router;
@@ -89,6 +92,12 @@ export function OfflineHost() {
         case 'store-unavailable':
           toast.warning(tConflictsRef.current('store_unavailable'), { duration: 0 });
           break;
+        case 'key-unprotected':
+          toast.warning(tKeyRef.current('wrap_failed'), { duration: 0 });
+          break;
+        case 'rekey-failed':
+          toast.warning(tKeyRef.current('rekey_failed'), { duration: 0 });
+          break;
         case 'refused-delete':
           toast.warning(tr('toast.refused_delete'));
           break;

components/offline/offline-settings.tsx

@@ -15,6 +15,7 @@ import { useAccountStore } from '@/stores/account-store';
 import { useAuthStore } from '@/stores/auth-store';
 import { AccountStorage } from './account-storage';
 import { OutboxList } from './outbox-list';
+import { KeyProtectionNotes } from './key-protection-notes';
 import { WipeDeviceSection } from './wipe-device-section';
 
 /**
@@ -65,6 +66,7 @@ export function OfflineSettings() {
             <AlertTriangle className="mt-0.5 h-3.5 w-3.5 shrink-0" aria-hidden="true" />
             <p data-testid="offline-warning">{isDesktopApp() ? tStorage('warning_desktop') : t('warning')}</p>
           </div>
+          <KeyProtectionNotes browser />
           {enabledCount > 0 && persist === 'refused' && (
             <div className="flex flex-col gap-2 rounded-md border border-amber-500/40 bg-amber-500/10 px-3 py-2 text-xs text-amber-900 dark:text-amber-200 sm:flex-row sm:items-center sm:justify-between" role="status" data-testid="offline-persist-refused">
               <p className="min-w-0">{tStorage('persist_refused')}</p>

components/pro/__tests__/pro-email-reply-account.test.tsx

@@ -0,0 +1,137 @@
+import { render, waitFor } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import React from 'react';
+
+/**
+ * A reply, forward or forward-as-attachment from a Pro message view names the
+ * login holding the message. The composer defaults its From to that account and
+ * copies the original's parts from it; without the login it takes the message
+ * for the active account's, so the reply goes out from the wrong account, or
+ * fails on a blobId that account doesn't have (#1511).
+ */
+
+const viewerProps = vi.hoisted(() => ({ current: null as Record<string, unknown> | null }));
+
+vi.mock('@/components/email/email-viewer', () => ({
+  EmailViewer: (props: Record<string, unknown>) => {
+    viewerProps.current = props;
+    return null;
+  },
+}));
+vi.mock('@/components/error', () => ({
+  ErrorBoundary: ({ children }: { children: React.ReactNode }) => React.createElement(React.Fragment, null, children),
+  EmailViewerErrorFallback: () => null,
+}));
+vi.mock('next-intl', () => ({ useTranslations: () => (key: string) => key }));
+vi.mock('@/stores/toast-store', () => ({ toast: { error: () => {}, success: () => {} } }));
+vi.mock('@/hooks/use-pro-multi-account-identities', async (importOriginal) => ({
+  ...await importOriginal<typeof import('@/hooks/use-pro-multi-account-identities')>(),
+  useProMultiAccountIdentities: () => ({ enabled: true, groups: [], allIdentities: [] }),
+}));
+
+const { openComposeTab } = vi.hoisted(() => ({ openComposeTab: vi.fn() }));
+
+function selectorStore<T extends object>(state: T) {
+  const hook = (sel?: (s: T) => unknown) => (typeof sel === 'function' ? sel(state) : state);
+  hook.getState = () => state;
+  return hook;
+}
+
+const auth = vi.hoisted(() => ({
+  state: { client: null as unknown, activeAccountId: 'login-a', getClientForAccount: () => undefined },
+}));
+vi.mock('@/stores/auth-store', () => ({ useAuthStore: selectorStore(auth.state) }));
+
+const MESSAGE = vi.hoisted(() => ({
+  id: 'eaaaaab',
+  blobId: 'blob-of-message',
+  threadId: 't1',
+  mailboxIds: { inbox: true },
+  keywords: { $seen: true },
+  from: [{ email: 'sender@example.com', name: 'Sender' }],
+  to: [{ email: 'b@example.org' }],
+  subject: 'Hello',
+  receivedAt: '2026-01-01T00:00:00Z',
+  bodyValues: { '1': { value: '<img src="cid:logo">' } },
+  textBody: [],
+  htmlBody: [{ partId: '1', type: 'text/html' }],
+  attachments: [{ blobId: 'blob-of-logo', name: 'logo.png', type: 'image/png', size: 10, cid: 'logo', disposition: 'inline' }],
+}));
+
+vi.mock('@/stores/email-store', () => ({
+  resolveEmailBlobContext: (_email: unknown, client: unknown) => ({ client, clientAccountId: auth.state.activeAccountId }),
+  useEmailStore: selectorStore({
+    fetchEmailContent: async () => MESSAGE,
+    deleteEmail: async () => {},
+    markAsRead: async () => {},
+    toggleStar: async () => {},
+    moveToMailbox: async () => {},
+    setEmailKeywordsLocal: () => {},
+    mailboxes: [],
+    emails: [],
+    selectedEmail: null,
+  }),
+}));
+vi.mock('@/stores/identity-store', () => ({ useIdentityStore: selectorStore({ identities: [] }) }));
+vi.mock('@/stores/settings-store', () => ({ useSettingsStore: selectorStore({ emailDownloadTemplate: '' }) }));
+vi.mock('@/stores/pro-tab-store', () => ({
+  useProTabStore: selectorStore({ openComposeTab, closeTab: () => {}, updateTabTitle: () => {} }),
+}));
+
+import { ProEmailView } from '../pro-email-tab-body';
+
+const ACTIONS = ['onReply', 'onReplyAll', 'onForward', 'onForwardAsAttachment'] as const;
+
+async function open(props: { clientAccountId?: string; accountId?: string; override?: boolean }) {
+  const client = { getEmail: vi.fn().mockResolvedValue(MESSAGE), getUsername: () => 'b@example.org', getAccountId: () => 'jmap-b' };
+  const { override = true, ...rest } = props;
+  if (!override) auth.state.client = client;
+  const view = render(<ProEmailView emailId="eaaaaab" client={override ? client as never : undefined} {...rest} onClose={vi.fn()} />);
+  await waitFor(() => expect(viewerProps.current?.email).toBeTruthy());
+  return { ...view, client };
+}
+
+function composeFrom(action: typeof ACTIONS[number]) {
+  openComposeTab.mockClear();
+  (viewerProps.current![action] as () => void)();
+  expect(openComposeTab).toHaveBeenCalledTimes(1);
+  return openComposeTab.mock.calls[0][0].replyTo as Record<string, unknown>;
+}
+
+describe('compose actions of a Pro message view', () => {
+  beforeEach(() => {
+    viewerProps.current = null;
+    openComposeTab.mockClear();
+    auth.state.activeAccountId = 'login-a';
+    auth.state.client = null;
+  });
+
+  it.each(ACTIONS)('%s of another login names that login', async (action) => {
+    await open({ clientAccountId: 'login-b' });
+
+    expect(composeFrom(action).accountId).toBe('login-b');
+  });
+
+  it.each(ACTIONS)('%s of a shared folder of another login names the login, not the owner', async (action) => {
+    await open({ clientAccountId: 'login-b', accountId: 'jmap-team' });
+
+    expect(composeFrom(action).accountId).toBe('login-b');
+  });
+
+  it.each(ACTIONS)('%s of the active login names the active login', async (action) => {
+    await open({ override: false });
+
+    expect(composeFrom(action).accountId).toBe('login-a');
+  });
+
+  it('keeps naming the login the message was read in after the active account changes', async () => {
+    // A message of b isn't foreign while b is active, so it carries no stamp.
+    auth.state.activeAccountId = 'login-b';
+    const { rerender, client } = await open({ clientAccountId: 'login-b' });
+
+    auth.state.activeAccountId = 'login-a';
+    rerender(<ProEmailView emailId="eaaaaab" client={client as never} clientAccountId="login-b" onClose={vi.fn()} />);
+
+    expect(composeFrom('onReply').accountId).toBe('login-b');
+  });
+});

components/pro/pro-email-tab-body.tsx

@@ -34,6 +34,7 @@ import { takeTabReply, useNotificationTabReply } from '@/lib/pwa-notify/tab-repl
 import { ConfirmDialog } from '@/components/ui/confirm-dialog';
 import { saveQuickReplyDraft } from '@/lib/outgoing/quick-reply-envelope';
 import { canDownload } from '@/lib/device-policy';
+import { phishingMarkedNow } from '@/hooks/use-phishing-report';
 import { useOpenEmailInWindow } from '@/hooks/use-popouts-available';
 import { isFilePreviewable } from '@/lib/file-preview';
 import { useDesktopCommands } from '@/lib/desktop/commands';
@@ -111,8 +112,19 @@ export function stampProSource(email: Email, source: EmailBlobContext, loginId:
   return { ...email, sourceClientAccountId: login, sourceAccountId: account };
 }
 
-function buildReplyContext(email: Email): ProReplyContext {
+/**
+ * The login holding the message, for ProReplyContext.accountId: the composer
+ * defaults its From to that account and copies the original's parts from it
+ * (#1104, #1511). email.accountId can't say: it is for display, and a message
+ * read through client.getEmail() has none.
+ */
+function replyLogin(email: Email, source: EmailWriteSource): string | undefined {
+  return email.sourceClientAccountId ?? source.clientAccountId;
+}
+
+function buildReplyContext(email: Email, source: EmailWriteSource): ProReplyContext {
   return {
+    phishingMarked: phishingMarkedNow(email),
     from: email.from,
     replyToAddresses: email.replyTo,
     to: email.to,
@@ -122,7 +134,7 @@ function buildReplyContext(email: Email): ProReplyContext {
     subject: email.subject,
     ...getQuoteBodies(email),
     receivedAt: email.receivedAt,
-    accountId: email.accountId,
+    accountId: replyLogin(email, source),
     attachments: email.attachments,
     messageId: email.messageId,
     inReplyTo: email.inReplyTo,
@@ -285,7 +297,7 @@ export function ProEmailView({ emailId, client: clientOverride, clientAccountId,
     if (!email) return;
     openComposeTab({
       mode: 'reply',
-      replyTo: buildReplyContext(email),
+      replyTo: buildReplyContext(email, writeSource),
       sourceEmailId: email.id,
       sourceEmailSource: writeSource,
       initialDraftText: draftText,
@@ -305,7 +317,7 @@ export function ProEmailView({ emailId, client: clientOverride, clientAccountId,
     if (!email) return;
     openComposeTab({
       mode: 'replyAll',
-      replyTo: buildReplyContext(email),
+      replyTo: buildReplyContext(email, writeSource),
       sourceEmailId: email.id,
       sourceEmailSource: writeSource,
       title: buildReplySubject(email.subject || t('email_composer.new_message'), t('email_composer.prefix.reply')),
@@ -316,7 +328,7 @@ export function ProEmailView({ emailId, client: clientOverride, clientAccountId,
     if (!email) return;
     openComposeTab({
       mode: 'forward',
-      replyTo: buildReplyContext(email),
+      replyTo: buildReplyContext(email, writeSource),
       sourceEmailId: email.id,
       sourceEmailSource: writeSource,
       title: buildForwardSubject(email.subject || t('email_composer.new_message'), t('email_composer.prefix.forward')),
@@ -355,6 +367,7 @@ export function ProEmailView({ emailId, client: clientOverride, clientAccountId,
         attachments: [payload.attachment],
         headers: labelSourceHeaders(email.headers),
         originalFrom: email.from,
+        accountId: replyLogin(email, writeSource),
       },
       sourceEmailId: email.id,
       sourceEmailSource: writeSource,

components/providers/__tests__/notification-actions-host-quiet.test.tsx

@@ -0,0 +1,58 @@
+import { render } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { NotificationActionsHost } from '../notification-actions-host';
+
+// The worker shows nothing for a login with email notifications off or do not
+// disturb on. Each login has its own settings, so the answer goes per login.
+
+const writeLoginQuiet = vi.fn(async (..._args: unknown[]) => {});
+let state = { isAuthenticated: true, username: 'me@example.org' as string | null, emailNotificationsEnabled: true, doNotDisturb: false };
+
+vi.mock('@/lib/push-preferences', () => ({ writeLoginQuiet: (...args: unknown[]) => writeLoginQuiet(...args), PUSH_STATE_CACHE: 'x' }));
+vi.mock('@/lib/pwa-notify/worker-state', () => ({ writeNotificationActionPrefs: async () => {} }));
+vi.mock('@/lib/pwa-notify/page-actions', () => ({ isNotificationActionRequest: () => false, runNotificationAction: async () => {} }));
+vi.mock('@/lib/pwa-notify/plugin-veto', () => ({ pluginsMayVeto: () => false }));
+vi.mock('@/lib/offline/offline-mode', () => ({ scheduleFlushAll: () => {} }));
+vi.mock('@/lib/archive-gate', () => ({ useArchiveActionEnabled: () => false }));
+vi.mock('next-intl', () => ({ useTranslations: () => (key: string) => key }));
+vi.mock('@/stores/auth-store', () => ({ useAuthStore: (select: (s: typeof state) => unknown) => select(state) }));
+vi.mock('@/stores/settings-store', () => ({
+  useSettingsStore: (select: (s: typeof state & { archiveMode: string }) => unknown) => select({ ...state, archiveMode: 'single' }),
+}));
+vi.mock('@/stores/plugin-store', () => ({ usePluginStore: (select: (s: { plugins: unknown[] }) => unknown) => select({ plugins: [] }) }));
+vi.mock('@/stores/account-store', () => {
+  const useAccountStore = (select: (s: { accounts: unknown[] }) => unknown) => select({ accounts: [] });
+  useAccountStore.getState = () => ({ accounts: [] });
+  return { useAccountStore };
+});
+
+beforeEach(() => {
+  writeLoginQuiet.mockClear();
+  state = { isAuthenticated: true, username: 'me@example.org', emailNotificationsEnabled: true, doNotDisturb: false };
+});
+
+describe('what the page tells the worker about a login', () => {
+  it('not quiet with everything on', () => {
+    render(<NotificationActionsHost />);
+    expect(writeLoginQuiet).toHaveBeenCalledWith('me@example.org', false);
+  });
+
+  it('quiet with email notifications off', () => {
+    state.emailNotificationsEnabled = false;
+    render(<NotificationActionsHost />);
+    expect(writeLoginQuiet).toHaveBeenCalledWith('me@example.org', true);
+  });
+
+  it('quiet with do not disturb on', () => {
+    state.doNotDisturb = true;
+    render(<NotificationActionsHost />);
+    expect(writeLoginQuiet).toHaveBeenCalledWith('me@example.org', true);
+  });
+
+  it('nothing while signed out', () => {
+    state.isAuthenticated = false;
+    state.username = null;
+    render(<NotificationActionsHost />);
+    expect(writeLoginQuiet).not.toHaveBeenCalled();
+  });
+});

components/providers/notification-actions-host.tsx

@@ -5,6 +5,7 @@ import { useTranslations } from 'next-intl';
 import { useArchiveActionEnabled } from '@/lib/archive-gate';
 import { scheduleFlushAll } from '@/lib/offline/offline-mode';
 import { loginFingerprint } from '@/lib/pwa-notify/login-fingerprint';
+import { writeLoginQuiet } from '@/lib/push-preferences';
 import { isNotificationActionRequest, runNotificationAction } from '@/lib/pwa-notify/page-actions';
 import { pluginsMayVeto } from '@/lib/pwa-notify/plugin-veto';
 import { writeNotificationActionPrefs } from '@/lib/pwa-notify/worker-state';
@@ -42,6 +43,16 @@ export function NotificationActionsHost() {
     });
   }, [isAuthenticated, archiveEnabled, archiveMode, mayVeto, archive, markRead, reply, replyPlaceholder]);
 
+  // Email notifications off or do not disturb on, for the login on screen: the
+  // worker shows nothing for that login's mail. The label a push carries is this
+  // name (lib/web-push.ts), and each login has its own settings.
+  const username = useAuthStore((s) => s.username);
+  const quiet = useSettingsStore((s) => !s.emailNotificationsEnabled || s.doNotDisturb);
+  useEffect(() => {
+    if (!isAuthenticated || !username) return;
+    void writeLoginQuiet(username, quiet);
+  }, [isAuthenticated, username, quiet]);
+
   // Which logins this tab holds: if it stays silent on a click for one of them,
   // the worker opens the message rather than go round its plugins.
   const loginKey = useMemo(() => accounts.map((a) => `${a.serverUrl}\n${a.username}`).join('\n\n'), [accounts]);

components/push-notification-prompt.tsx

@@ -19,8 +19,8 @@ import {
   resyncWebPush,
   waitForWebPushResync,
 } from "@/lib/web-push";
+import { webPushErrorKey } from "@/lib/web-push-errors";
 import { resolveActiveRelayUrl } from "@/lib/push-relays";
-import { jmapErrorType } from "@/lib/jmap/jmap-error";
 import {
   isPWAInstallPromptVisible,
   PWA_INSTALL_PROMPT_VISIBILITY_EVENT,
@@ -310,11 +310,9 @@ export function PushNotificationPrompt() {
       });
       setShowPrompt(false);
     } catch (err) {
-      // Readable text for the server refusals a user can act on.
-      const type = jmapErrorType(err);
-      if (type === "forbidden") setError(tPush("error_forbidden"));
-      else if (type === "overQuota") setError(tPush("error_over_quota"));
-      else setError(err instanceof Error ? err.message : "Failed to enable push");
+      // Readable text for what a user can act on.
+      const key = webPushErrorKey(err);
+      setError(key ? tPush(key) : err instanceof Error ? err.message : "Failed to enable push");
     } finally {
       setIsEnabling(false);
     }

components/settings/__tests__/notification-settings.test.tsx

@@ -1,6 +1,6 @@
 import { fireEvent, render, waitFor } from '@testing-library/react';
 import { act } from 'react';
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { afterEach, describe, it, expect, vi, beforeEach } from 'vitest';
 import { NotificationSettings } from '../notification-settings';
 import { useSettingsStore } from '@/stores/settings-store';
 import { useAuthStore } from '@/stores/auth-store';
@@ -137,6 +137,25 @@ describe('NotificationSettings - pushNotifyInboxOnly', () => {
   });
 });
 
+describe('NotificationSettings - demo mode', () => {
+  beforeEach(() => {
+    useAuthStore.setState({ client: fakeClient, username: 'me@example.com', isDemoMode: true });
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    useAuthStore.setState({ isDemoMode: false });
+  });
+
+  it('says push is not available and offers no switch that would call the relay', async () => {
+    const { findByText, getAllByRole } = render(<NotificationSettings />);
+    await findByText('push.status_demo');
+    const pushSwitch = getAllByRole('switch').find((el) => (el as HTMLButtonElement).disabled);
+    expect(pushSwitch).toBeTruthy();
+    expect(webPush.enableWebPush).not.toHaveBeenCalled();
+  });
+});
+
 describe('NotificationSettings - mailboxes shared by ACL', () => {
   const mailbox = (id: string, accountId: string, isShared: boolean) =>
     ({ id, originalId: id, name: id, accountId, isShared }) as unknown as Mailbox;

components/settings/app-lock-settings.tsx

@@ -24,6 +24,7 @@ import { getDesktopBridge } from "@/lib/desktop/bridge";
 import type { DesktopOsUnlockKind } from "@/lib/desktop/types";
 import { IS_LITE } from "@/lib/lite";
 import { toast } from "@/stores/toast-store";
+import { KeyProtectionNotes } from "@/components/offline/key-protection-notes";
 import { SettingItem, SettingsSection, ToggleSwitch } from "./settings-section";
 
 type Pending = "enable" | "disable" | "change" | "passkey" | "os" | null;
@@ -39,6 +40,8 @@ function useLockFacts() {
 /** The app lock's section on the General page: it has to exist on any server. */
 export function AppLockSettings() {
   const t = useTranslations("appLock");
+  const tKey = useTranslations("keyProtection");
+  const tEdit = useTranslations("desktopEdit");
   const { appName } = useConfig();
   const { on, required, timeout, update } = useLockFacts();
   const [pending, setPending] = useState<Pending>(null);
@@ -94,7 +97,12 @@ export function AppLockSettings() {
     event.preventDefault();
     if (busy) return;
     if (pending === "enable" && newPinReady(pin, repeat)) void run(() => enableAppLock(pin));
-    if (pending === "change" && current && newPinReady(pin, repeat)) void run(() => changeAppLockPin(current, pin));
+    if (pending === "change" && current && newPinReady(pin, repeat)) {
+      void run(async () => {
+        const { reenroll } = await changeAppLockPin(current, pin);
+        if (reenroll) toast.info(tKey("reenroll_note"), { duration: 0 });
+      });
+    }
     if (pending === "disable" && current) void run(() => disableAppLock(current));
     if (pending === "passkey" && current) {
       void run(async () => {
@@ -129,6 +137,7 @@ export function AppLockSettings() {
         <ToggleSwitch checked={on || required} onChange={(next) => setPending(next ? "enable" : "disable")} testId="app-lock-switch" />
       </SettingItem>
       <p className="text-xs text-muted-foreground" data-testid="app-lock-protects">{t("protects_desc")}</p>
+      <KeyProtectionNotes />
 
       {on && (
         <>
@@ -178,6 +187,10 @@ export function AppLockSettings() {
         </>
       )}
 
+      {on && getDesktopBridge()?.edit && (
+        <p className="text-xs text-muted-foreground" data-testid="app-lock-edit-note">{tEdit("lock_note")}</p>
+      )}
+
       <Dialog
         isOpen={pending !== null}
         onClose={close}

components/settings/multi-account-push.tsx

@@ -9,6 +9,7 @@ import { useAccountStore } from '@/stores/account-store';
 import { useAuthStore } from '@/stores/auth-store';
 import { useSettingsStore } from '@/stores/settings-store';
 import { disableWebPush, enableWebPushForAccounts, isWebPushEnabled, isWebPushSupported } from '@/lib/web-push';
+import { webPushErrorKey } from '@/lib/web-push-errors';
 
 interface FailedAccount {
   id: string;
@@ -17,11 +18,6 @@ interface FailedAccount {
   reason: string;
 }
 
-function failureReason(error: unknown): string {
-  if (error instanceof Error && error.message) return error.message;
-  return String(error);
-}
-
 /**
  * Turn push on or off for several accounts at once.
  *
@@ -32,9 +28,22 @@ function failureReason(error: unknown): string {
  */
 export function MultiAccountPushSettings({ relayBaseUrl }: { relayBaseUrl?: string }) {
   const t = useTranslations('settings.notifications.push_all');
+  const tPush = useTranslations('settings.notifications.push');
+  const failureReason = (error: unknown): string => {
+    const key = webPushErrorKey(error);
+    if (key) return tPush(key);
+    return error instanceof Error && error.message ? error.message : String(error);
+  };
+  const failureOf = (account: (typeof accounts)[number], error: unknown): FailedAccount => ({
+    id: account.id,
+    name: account.displayName || account.label || account.username,
+    email: account.email || account.username,
+    reason: failureReason(error),
+  });
   const accounts = useAccountStore(s => s.accounts);
   // Re-read the client map whenever a connection appears or drops.
   const revision = useAuthStore(s => s.connectedAccountsRevision);
+  const isDemoMode = useAuthStore(s => s.isDemoMode);
   const [enabled, setEnabled] = useState<Record<string, boolean>>({});
   const [chosen, setChosen] = useState<Set<string>>(new Set());
   const [busy, setBusy] = useState(false);
@@ -59,7 +68,7 @@ export function MultiAccountPushSettings({ relayBaseUrl }: { relayBaseUrl?: stri
 
   useEffect(() => { void refresh(); }, [refresh, revision]);
 
-  if (!isWebPushSupported() || connected.length < 2) return null;
+  if (!isWebPushSupported() || isDemoMode || connected.length < 2) return null;
 
   const toggle = (id: string, on: boolean) => setChosen(prev => {
     const next = new Set(prev);
@@ -95,11 +104,15 @@ export function MultiAccountPushSettings({ relayBaseUrl }: { relayBaseUrl?: stri
           };
         }));
       } else {
-        // Teardown swallows its own failures, so every account ends up local-off.
+        // Every account ends up off here; one the server or relay couldn't be
+        // told about is named, since it may keep getting notifications for days.
+        const failed: FailedAccount[] = [];
         for (const account of targets) {
-          await disableWebPush({ client: auth.getClientForAccount(account.id)!, relayBaseUrl });
+          await disableWebPush({ client: auth.getClientForAccount(account.id)!, relayBaseUrl })
+            .catch((error: unknown) => { failed.push(failureOf(account, error)); });
         }
         setNotice(t('result_disabled', { count: targets.length }));
+        setFailures(failed);
       }
       setChosen(new Set());
     } finally {

components/settings/notification-settings.tsx

@@ -5,7 +5,6 @@ import { useTranslations } from 'next-intl';
 import { useSettingsStore } from '@/stores/settings-store';
 import { useEmailStore } from '@/stores/email-store';
 import { useIdentityStore } from '@/stores/identity-store';
-import { jmapErrorType } from '@/lib/jmap/jmap-error';
 import { SettingsSection, SettingItem, ToggleSwitch, Select } from './settings-section';
 import { playNotificationSound, NOTIFICATION_SOUNDS } from '@/lib/notification-sound';
 import type { NotificationSoundChoice } from '@/lib/notification-sound';
@@ -27,6 +26,7 @@ import {
   revokePushDevice,
   serverSupportsEmailPush,
 } from '@/lib/web-push';
+import { webPushErrorKey } from '@/lib/web-push-errors';
 import type { PushDevice } from '@/lib/web-push';
 import { IS_LITE } from '@/lib/lite';
 import { useNoThirdPartyTraffic } from '@/hooks/use-third-party-mode';
@@ -72,7 +72,10 @@ export function NotificationSettings() {
   const username = useAuthStore((s) => s.username);
   const { dialogProps: confirmDialogProps, confirm: confirmDialog } = useConfirmDialog();
 
-  const supported = typeof window !== 'undefined' && isWebPushSupported();
+  // The demo client has no mail server to subscribe with. Enabling would get as
+  // far as a relay record and a browser subscription, then fail.
+  const isDemoMode = useAuthStore((s) => s.isDemoMode);
+  const supported = typeof window !== 'undefined' && isWebPushSupported() && !isDemoMode;
   // "Inbox only" is enforced by the server's emailPush filter; without that
   // capability (Stalwart < 0.16.16) the toggle would do nothing.
   const inboxOnlyAvailable = supported && !!client && serverSupportsEmailPush(client);
@@ -145,7 +148,7 @@ export function NotificationSettings() {
   // In the static Lite build push is off by design (no service worker, see
   // components/service-worker-registration.tsx), not a browser limitation.
   const statusDescription = pushStatus.kind === 'unsupported'
-    ? (IS_LITE ? t('push.status_lite') : `${t('push.status_unsupported')} ${t('push.ios_hint')}`)
+    ? (IS_LITE ? t('push.status_lite') : isDemoMode ? t('push.status_demo') : `${t('push.status_unsupported')} ${t('push.ios_hint')}`)
     : noRelay && !pushEnabled
       ? tThirdParty('push_needs_relay')
     : busy
@@ -171,14 +174,9 @@ export function NotificationSettings() {
   // The refusals a user can do something about get readable text; anything
   // else keeps the error's own message.
   const pushErrorMessage = (err: unknown, fallback: string) => {
-    switch (jmapErrorType(err)) {
-      case 'forbidden':
-        return t('push.error_forbidden');
-      case 'overQuota':
-        return t('push.error_over_quota');
-      default:
-        return err instanceof Error ? err.message : fallback;
-    }
+    const key = webPushErrorKey(err);
+    if (key) return t(`push.${key}`);
+    return err instanceof Error ? err.message : fallback;
   };
 
   // `forceRecreate` is what the Re-register button is for: without it the enable
@@ -265,10 +263,7 @@ export function NotificationSettings() {
       await disableWebPush({ client, relayBaseUrl: activeRelayUrl });
       setPushStatus({ kind: 'idle' });
     } catch (err) {
-      setPushStatus({
-        kind: 'error',
-        message: err instanceof Error ? err.message : 'Failed to disable push',
-      });
+      setPushStatus({ kind: 'error', message: pushErrorMessage(err, 'Failed to disable push') });
     } finally {
       await refreshDevices();
     }
@@ -290,10 +285,7 @@ export function NotificationSettings() {
       await revokePushDevice({ client, device, relayBaseUrl: activeRelayUrl });
       if (device.isThisDevice) setPushStatus({ kind: 'idle' });
     } catch (err) {
-      setPushStatus({
-        kind: 'error',
-        message: err instanceof Error ? err.message : 'Failed to revoke device',
-      });
+      setPushStatus({ kind: 'error', message: pushErrorMessage(err, 'Failed to revoke device') });
     } finally {
       setRevokingId(null);
       await refreshDevices();

desktop-policies/Bulwark.admx

@@ -202,6 +202,12 @@
       <list id="AutoSelectCertificateForUrls_Value" valuePrefix=""/>
     </elements>
   </policy>
+  <policy name="KeystoreEnabled" class="Both" displayName="$(string.KeystoreEnabled)" explainText="$(string.KeystoreEnabled_Explain)" key="Software\Policies\Bulwark\Desktop" valueName="KeystoreEnabled">
+    <parentCategory ref="Bulwark_Desktop_signIn"/>
+    <supportedOn ref="SUPPORTED_Bulwark_Desktop"/>
+    <enabledValue><decimal value="1"/></enabledValue>
+    <disabledValue><decimal value="0"/></disabledValue>
+  </policy>
   <policy name="KeystoreAllowedOrigins" class="Both" displayName="$(string.KeystoreAllowedOrigins)" explainText="$(string.KeystoreAllowedOrigins_Explain)" presentation="$(presentation.KeystoreAllowedOrigins)" key="Software\Policies\Bulwark\Desktop\KeystoreAllowedOrigins">
     <parentCategory ref="Bulwark_Desktop_signIn"/>
     <supportedOn ref="SUPPORTED_Bulwark_Desktop"/>
@@ -209,6 +215,18 @@
       <list id="KeystoreAllowedOrigins_Value" valuePrefix=""/>
     </elements>
   </policy>
+  <policy name="BrowserSignIn" class="Both" displayName="$(string.BrowserSignIn)" explainText="$(string.BrowserSignIn_Explain)" key="Software\Policies\Bulwark\Desktop" valueName="BrowserSignIn">
+    <parentCategory ref="Bulwark_Desktop_signIn"/>
+    <supportedOn ref="SUPPORTED_Bulwark_Desktop"/>
+    <enabledValue><decimal value="1"/></enabledValue>
+    <disabledValue><decimal value="0"/></disabledValue>
+  </policy>
+  <policy name="BrowserSignIn_Recommended" class="Both" displayName="$(string.BrowserSignIn)" explainText="$(string.BrowserSignIn_Explain)" key="Software\Policies\Bulwark\Desktop\Recommended" valueName="BrowserSignIn">
+    <parentCategory ref="Bulwark_Desktop_Recommended"/>
+    <supportedOn ref="SUPPORTED_Bulwark_Desktop"/>
+    <enabledValue><decimal value="1"/></enabledValue>
+    <disabledValue><decimal value="0"/></disabledValue>
+  </policy>
   <policy name="WipeOfflineData" class="Both" displayName="$(string.WipeOfflineData)" explainText="$(string.WipeOfflineData_Explain)" presentation="$(presentation.WipeOfflineData)" key="Software\Policies\Bulwark\Desktop">
     <parentCategory ref="Bulwark_Desktop_security"/>
     <supportedOn ref="SUPPORTED_Bulwark_Desktop"/>

desktop-policies/de-DE/Bulwark.adml

@@ -54,8 +54,12 @@
       <string id="AuthNegotiateDelegateAllowlist_Explain">Die Server, an die die App Kerberos-Anmeldedaten delegieren darf, durch Kommas getrennt. Wird beim Neustart der App wirksam.</string>
       <string id="AutoSelectCertificateForUrls">Clientzertifikate automatisch wählen</string>
       <string id="AutoSelectCertificateForUrls_Explain">Eine JSON-Regel pro Zeile, im Format von Chrome: {&quot;pattern&quot;:&quot;https://[*.]example.com&quot;,&quot;filter&quot;:{&quot;ISSUER&quot;:{&quot;CN&quot;:&quot;Example CA&quot;}}}. Die App wählt dann für diese Website das passende Zertifikat ohne Rückfrage.</string>
+      <string id="KeystoreEnabled">Zertifikatspeicher des Systems erlauben</string>
+      <string id="KeystoreEnabled_Explain">Wenn deaktiviert, kann nichts in der App mit den Zertifikaten und Smartcards im Speicher des Betriebssystems signieren oder entschlüsseln, und niemand wird gefragt. Das hat Vorrang vor der Liste der Websites unten. Es gilt auch, wenn Plugins ausgeschaltet sind. Importierte Schlüssel sind nicht betroffen.</string>
       <string id="KeystoreAllowedOrigins">Websites, die den Zertifikatspeicher des Systems verwenden dürfen</string>
       <string id="KeystoreAllowedOrigins_Explain">Die Bulwark-Server, nach https-Adresse, deren Plugins mit den Zertifikaten im Speicher des Betriebssystems signieren und entschlüsseln dürfen, ohne dass der Benutzer für jede Website gefragt wird. Eine pro Zeile.</string>
+      <string id="BrowserSignIn">Anmeldung über den Browser anbieten</string>
+      <string id="BrowserSignIn_Explain">Wenn aktiviert oder nicht konfiguriert, bietet die Anmeldeseite „Mit Ihrem Browser anmelden“ an, damit Benutzer dort ihren Passwort-Manager, Passkeys und Ihr Single Sign-on verwenden können. Wenn deaktiviert, fehlt die Schaltfläche und die App lehnt den Vorgang ab. Das Formular in der App bleibt, sofern der Server nicht nur OAuth erlaubt.</string>
       <string id="WipeOfflineData">Auf dem Gerät behaltene E-Mails löschen</string>
       <string id="WipeOfflineData_Explain">Setzen Sie dies auf einen neuen Wert, etwa das heutige Datum, um alles zu löschen, was die App für alle Server und Konten auf dem Gerät behält: E-Mails, Schlüssel und Anmeldungen, Benutzer melden sich also neu an. Jeder Wert löscht einmal: Die App merkt sich, welche sie schon ausgeführt hat, ein Wert kann also stehen bleiben. Verwenden Sie einen neuen Wert, um erneut zu löschen.</string>
     </stringTable>

desktop-policies/en-US/Bulwark.adml

@@ -54,8 +54,12 @@
       <string id="AuthNegotiateDelegateAllowlist_Explain">The servers the app may delegate Kerberos credentials to, separated by commas. Takes effect when the app restarts.</string>
       <string id="AutoSelectCertificateForUrls">Choose client certificates automatically</string>
       <string id="AutoSelectCertificateForUrls_Explain">One JSON rule per line, in the format Chrome uses: {&quot;pattern&quot;:&quot;https://[*.]example.com&quot;,&quot;filter&quot;:{&quot;ISSUER&quot;:{&quot;CN&quot;:&quot;Example CA&quot;}}}. The app then picks the matching certificate for that site without asking.</string>
+      <string id="KeystoreEnabled">Allow the system certificate store</string>
+      <string id="KeystoreEnabled_Explain">When disabled, nothing in the app can sign or decrypt with the certificates and smart cards in the operating system&apos;s store, and nobody is asked. This overrides the list of sites below. It also holds when plugins are turned off. Imported keys are not affected.</string>
       <string id="KeystoreAllowedOrigins">Sites that may use the system certificate store</string>
       <string id="KeystoreAllowedOrigins_Explain">The Bulwark servers, by https address, whose plugins may sign and decrypt with the certificates in the operating system&apos;s store, without the user being asked for each site. One per line.</string>
+      <string id="BrowserSignIn">Offer sign-in through the browser</string>
+      <string id="BrowserSignIn_Explain">When enabled or not configured, the login page offers &quot;Sign in with your browser&quot;, so people can use their password manager, passkeys and your single sign-on there. When disabled, the button is gone and the app refuses the flow. The form in the app stays, unless the server only allows OAuth.</string>
       <string id="WipeOfflineData">Delete mail kept on the device</string>
       <string id="WipeOfflineData_Explain">Set this to a new value, such as today&apos;s date, to delete everything the app keeps on the device for every server and account: mail, keys, and sign-ins, so people sign in again. Each value deletes once: the app remembers the ones it has acted on, so it stays safe to leave a value in place. Use a new value to delete again.</string>
     </stringTable>

desktop-policies/org.bulwarkmail.desktop.mobileconfig

@@ -57,10 +57,14 @@
       <array>
         <string>{&quot;pattern&quot;:&quot;https://[*.]example.com&quot;,&quot;filter&quot;:{&quot;ISSUER&quot;:{&quot;CN&quot;:&quot;Example CA&quot;}}}</string>
       </array>
+      <key>KeystoreEnabled</key>
+      <true/>
       <key>KeystoreAllowedOrigins</key>
       <array>
         <string>https://mail.example.com</string>
       </array>
+      <key>BrowserSignIn</key>
+      <true/>
       <key>Recommended</key>
       <dict>
         <key>UpdateChannel</key>

desktop-policies/policies.json

@@ -22,9 +22,11 @@
   "AutoSelectCertificateForUrls": [
     "{\"pattern\":\"https://[*.]example.com\",\"filter\":{\"ISSUER\":{\"CN\":\"Example CA\"}}}"
   ],
+  "KeystoreEnabled": true,
   "KeystoreAllowedOrigins": [
     "https://mail.example.com"
   ],
+  "BrowserSignIn": true,
   "Recommended": {
     "UpdateChannel": "stable"
   }

hooks/__tests__/use-composer-edits.test.tsx

@@ -0,0 +1,334 @@
+import { act, renderHook, waitFor } from '@testing-library/react';
+import { useState } from 'react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const policy = vi.hoisted(() => ({ allowed: true }));
+const toastError = vi.hoisted(() => vi.fn());
+const forbidden = vi.hoisted(() => new Set<string>());
+
+vi.mock('next-intl', () => ({ useTranslations: () => (key: string) => key }));
+vi.mock('@/stores/toast-store', () => ({ toast: { error: toastError, success: vi.fn() } }));
+vi.mock('@/hooks/use-device-policy', () => ({
+  useDevicePolicy: () => ({ noDownloads: !policy.allowed, noExport: false }),
+}));
+vi.mock('@/lib/device-policy', () => ({
+  canDownload: (account?: string) => policy.allowed && !forbidden.has(account ?? ''),
+  canExport: () => true,
+  deviceSubjectOf: () => null,
+}));
+vi.mock('@/lib/offline/offline-mode', () => ({ scopeDecided: () => true }));
+vi.mock('@/stores/auth-store', () => ({ useAuthStore: { getState: () => ({ activeAccountId: 'acct' }) } }));
+
+import { useComposerEdits, type EditableAttachment } from '../use-composer-edits';
+import { parkFilesForReply, readEditedFile, resetEditSessions, useEditSessions } from '@/lib/desktop/edit-attachments';
+
+function fakeBridge() {
+  return {
+    canEdit: vi.fn((name: string) => !name.endsWith('.exe')),
+    begin: vi.fn(async () => ({ ok: true as const, ticket: 't1' })),
+    open: vi.fn(async () => ({ ok: true as const, id: 's1' })),
+    reopen: vi.fn(async () => ({ ok: true as const, id: 's1' })),
+    list: vi.fn(async () => []),
+    settle: vi.fn(async () => useEditSessions.getState().sessions),
+    read: vi.fn(async () => ({ ok: true as const, name: 'a.docx', type: 'x/y', data: new Uint8Array([1, 2]), hash: 'h2' })),
+    taken: vi.fn(async () => {}),
+    release: vi.fn(async () => {}),
+    discard: vi.fn(async () => ({ held: [] })),
+    forceDiscard: vi.fn(async () => ({ held: [] })),
+    askClear: vi.fn(async () => true),
+    clear: vi.fn(async () => ({ held: [] })),
+    wipe: vi.fn(async () => ({ held: [] })),
+    shown: vi.fn(),
+    setSource: vi.fn(),
+    claim: vi.fn(),
+    onChange: vi.fn(() => () => {}),
+  };
+}
+
+let bridge: ReturnType<typeof fakeBridge>;
+let confirm: ReturnType<typeof vi.fn>;
+
+const session = (over: Partial<{ id: string; name: string; source: string; changed: boolean; claimed: boolean; hash: string }> = {}) => ({
+  id: 's1', name: 'a.docx', type: 'x/y', account: 'acct', source: '{"kind":"draft","draftId":"d1"}', changed: false, version: 0, hash: 'current', claimed: true, held: false, savedAs: false, lastChance: false, ...over,
+});
+
+const chipNamed = (name: string): EditableAttachment => ({ name, type: 'x/y', blobId: 'b' });
+
+interface Setup {
+  start: EditableAttachment[];
+  draftId?: string | null;
+  repliesTo?: string;
+  /** What the composer's upload does with a file. */
+  upload?: (file: File) => Partial<EditableAttachment>;
+}
+
+function setup({ start, draftId = 'd1', repliesTo, upload = () => ({ blobId: 'new-blob' }) }: Setup) {
+  const load = vi.fn(async () => new Blob(['x']));
+  bridge.list.mockResolvedValue(useEditSessions.getState().sessions as never);
+  return renderHook(() => {
+    const [attachments, setAttachments] = useState<EditableAttachment[]>(start);
+    const addFiles = async (files: File[]) => {
+      setAttachments((list) => [...list, ...files.map((file) => ({ file, name: file.name, type: file.type, uploading: false, ...upload(file) }))]);
+    };
+    const edits = useComposerEdits<EditableAttachment>({ attachments, setAttachments, addFiles, load, account: 'acct', draftId, repliesTo, ready: true });
+    return { attachments, setAttachments, edits };
+  });
+}
+
+beforeEach(() => {
+  policy.allowed = true;
+  bridge = fakeBridge();
+  confirm = vi.fn(async () => 0);
+  (window as unknown as { bulwarkDesktop?: unknown }).bulwarkDesktop = { version: 1, edit: bridge, dialogs: { confirm } };
+  resetEditSessions();
+  toastError.mockClear();
+});
+
+afterEach(() => {
+  delete (window as unknown as { bulwarkDesktop?: unknown }).bulwarkDesktop;
+});
+
+describe('updating a chip', () => {
+  const chip: EditableAttachment = { name: 'a.docx', type: 'x/y', blobId: 'old-blob', editSessionId: 's1' };
+
+  it('takes the old file off only once the new one is up, and marks that version as taken', async () => {
+    useEditSessions.setState({ sessions: [session({ changed: true })] });
+    const { result } = setup({ start: [chip] });
+    expect(result.current.edits.hasUpdate(result.current.attachments[0])).toBe(true);
+    await act(() => result.current.edits.update(result.current.attachments[0]));
+    await waitFor(() => expect(result.current.attachments).toHaveLength(1));
+    const [only] = result.current.attachments;
+    expect(only.blobId).toBe('new-blob');
+    expect(only.file?.name).toBe('a.docx');
+    await waitFor(() => expect(only.editSessionId ?? result.current.attachments[0].editSessionId).toBe('s1'));
+    await waitFor(() => expect(bridge.taken).toHaveBeenCalledWith('s1', 'h2'));
+    // Stays held by the composer throughout: it's the same session.
+    expect(bridge.discard).not.toHaveBeenCalled();
+  });
+
+  it('keeps the old file and the offer when the upload fails', async () => {
+    useEditSessions.setState({ sessions: [session({ changed: true })] });
+    const { result } = setup({ start: [chip], upload: () => ({ error: true }) });
+    await act(() => result.current.edits.update(result.current.attachments[0]));
+    await waitFor(() => expect(result.current.attachments).toHaveLength(1));
+    expect(result.current.attachments[0].blobId).toBe('old-blob');
+    expect(result.current.edits.hasUpdate(result.current.attachments[0])).toBe(true);
+    expect(bridge.taken).not.toHaveBeenCalled();
+  });
+
+  it('says so when the program still holds the file', async () => {
+    bridge.read.mockResolvedValueOnce({ ok: false, reason: 'busy' } as never);
+    useEditSessions.setState({ sessions: [session({ changed: true })] });
+    const { result } = setup({ start: [chip] });
+    await act(() => result.current.edits.update(result.current.attachments[0]));
+    expect(toastError).toHaveBeenCalledWith('read_busy');
+    expect(result.current.attachments[0].blobId).toBe('old-blob');
+  });
+
+  it('refuses when the organisation has said no since', async () => {
+    policy.allowed = false;
+    useEditSessions.setState({ sessions: [session({ changed: true })] });
+    const { result } = setup({ start: [chip] });
+    await act(() => result.current.edits.update(result.current.attachments[0]));
+    expect(bridge.read).not.toHaveBeenCalled();
+    expect(toastError).toHaveBeenCalledWith('blocked_policy');
+    expect(result.current.attachments).toHaveLength(1);
+  });
+});
+
+describe('starting from a chip', () => {
+  it('fetches a server part, and the chip takes the session on', async () => {
+    const { result } = setup({ start: [{ name: 'a.docx', type: 'x/y', blobId: 'b1' }] });
+    await act(() => result.current.edits.startEdit(result.current.attachments[0]));
+    expect(bridge.begin).toHaveBeenCalledWith('blob:acct:b1');
+    await waitFor(() => expect(result.current.attachments[0].editSessionId).toBe('s1'));
+    expect(bridge.claim).toHaveBeenCalledWith('s1', true);
+    const [, file] = bridge.open.mock.calls[0] as unknown as [string, { source: string }];
+    expect(JSON.parse(file.source)).toEqual({ kind: 'draft', draftId: 'd1' });
+  });
+
+  it('a chip with a session goes back to that session', async () => {
+    const { result } = setup({ start: [{ name: 'a.docx', type: 'x/y', blobId: 'b1', editSessionId: 's1' }] });
+    await act(() => result.current.edits.startEdit(result.current.attachments[0]));
+    expect(bridge.begin).toHaveBeenCalledWith('session:s1');
+  });
+
+  it('offers it only for what the shell and the organisation allow', () => {
+    const { result } = setup({ start: [] });
+    expect(result.current.edits.canEditChip(chipNamed('a.docx'))).toBe(true);
+    expect(result.current.edits.canEditChip(chipNamed('a.exe'))).toBe(false);
+  });
+
+  it('offers nothing under a policy', () => {
+    policy.allowed = false;
+    const { result } = setup({ start: [] });
+    expect(result.current.edits.canEditChip(chipNamed('a.docx'))).toBe(false);
+  });
+});
+
+describe('holding sessions', () => {
+  it('claims what is on a chip, follows the draft id, and lets go when it closes, which is no end', async () => {
+    const { result, rerender, unmount } = setup({ start: [{ name: 'a.docx', type: 'x/y', blobId: 'b', editSessionId: 's1' }] });
+    expect(bridge.claim).toHaveBeenCalledWith('s1', true);
+    expect(bridge.setSource).toHaveBeenCalledWith('s1', JSON.stringify({ kind: 'draft', draftId: 'd1' }));
+    rerender();
+    expect(result.current.attachments).toHaveLength(1);
+    unmount();
+    expect(bridge.claim).toHaveBeenLastCalledWith('s1', false);
+    expect(bridge.discard).not.toHaveBeenCalled();
+  });
+
+  it('a chip taken off leaves the decision to main, which knows about a save from a moment ago', async () => {
+    useEditSessions.setState({ sessions: [session({ id: 's1' }), session({ id: 's2', name: 'b.docx', changed: true })] });
+    const { result } = setup({ start: [
+      { name: 'a.docx', type: 'x/y', blobId: 'b', editSessionId: 's1' },
+      { name: 'b.docx', type: 'x/y', blobId: 'c', editSessionId: 's2' },
+    ] });
+    act(() => result.current.setAttachments([]));
+    await waitFor(() => expect(bridge.release).toHaveBeenCalledWith('s1', JSON.stringify({ kind: 'file' })));
+    expect(bridge.release).toHaveBeenCalledWith('s2', JSON.stringify({ kind: 'file' }));
+    expect(bridge.discard).not.toHaveBeenCalled();
+  });
+
+  it('a draft opened again finds its session by id and name', async () => {
+    useEditSessions.setState({ sessions: [session({ claimed: false, changed: true })] });
+    const { result } = setup({ start: [{ name: 'other.pdf', type: 'x/y', blobId: 'z' }, { name: 'a.docx', type: 'x/y', blobId: 'b' }] });
+    await waitFor(() => expect(result.current.attachments[1].editSessionId).toBe('s1'));
+    expect(result.current.attachments[0].editSessionId).toBeUndefined();
+    expect(result.current.edits.hasUpdate(result.current.attachments[1])).toBe(true);
+  });
+
+  it('another draft leaves it alone', async () => {
+    useEditSessions.setState({ sessions: [session({ claimed: false, source: '{"kind":"draft","draftId":"other"}' })] });
+    const { result } = setup({ start: [{ name: 'a.docx', type: 'x/y', blobId: 'b' }] });
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    expect(result.current.attachments[0].editSessionId).toBeUndefined();
+  });
+});
+
+describe('sending', () => {
+  const chip: EditableAttachment = { name: 'a.docx', type: 'x/y', blobId: 'b', editSessionId: 's1' };
+
+  it('goes on without a question when nothing waits', async () => {
+    useEditSessions.setState({ sessions: [session()] });
+    const { result } = setup({ start: [chip] });
+    await expect(result.current.edits.confirmSend()).resolves.toBe(true);
+    expect(confirm).not.toHaveBeenCalled();
+  });
+
+  it('asks before an older version goes out, with going back as the default', async () => {
+    useEditSessions.setState({ sessions: [session({ changed: true })] });
+    const { result } = setup({ start: [chip] });
+    confirm.mockResolvedValueOnce(1);
+    await expect(result.current.edits.confirmSend()).resolves.toBe(false);
+    expect(confirm.mock.calls[0][0]).toMatchObject({ buttons: ['send_stale_send', 'send_stale_back'], defaultId: 1 });
+    confirm.mockResolvedValueOnce(0);
+    await expect(result.current.edits.confirmSend()).resolves.toBe(true);
+  });
+
+  it('sees a save from a moment ago, which the list has not heard of', async () => {
+    useEditSessions.setState({ sessions: [session()] });
+    const { result } = setup({ start: [chip] });
+    bridge.settle.mockResolvedValueOnce([session({ changed: true })] as never);
+    confirm.mockResolvedValueOnce(1);
+    await expect(result.current.edits.confirmSend()).resolves.toBe(false);
+    expect(confirm).toHaveBeenCalledTimes(1);
+  });
+
+  it('a chip holding the version on disk has nothing to ask about, even before main hears it went up', async () => {
+    const outcome = await readEditedFile({ id: 's1', account: 'acct' });
+    if (!outcome.ok) throw new Error('refused');
+    useEditSessions.setState({ sessions: [session({ changed: true, hash: outcome.hash })] });
+    const { result } = setup({ start: [{ file: outcome.file, name: 'a.docx', type: 'x/y', editSessionId: 's1', uploading: true }] });
+    expect(result.current.edits.hasUpdate(result.current.attachments[0])).toBe(false);
+    await expect(result.current.edits.confirmSend()).resolves.toBe(true);
+    expect(confirm).not.toHaveBeenCalled();
+  });
+
+  it('sent or discarded: main decides, also on a flag this page has wrong', async () => {
+    // The page thinks nothing changed. Main has a save from a moment ago, and keeps it.
+    useEditSessions.setState({ sessions: [session({ id: 's1' }), session({ id: 's2', name: 'b.docx', changed: true })] });
+    const { result } = setup({ start: [chip, { name: 'b.docx', type: 'x/y', blobId: 'c', editSessionId: 's2' }] });
+    act(() => result.current.edits.finish());
+    expect(bridge.release).toHaveBeenCalledWith('s1', JSON.stringify({ kind: 'file' }));
+    expect(bridge.release).toHaveBeenCalledWith('s2', JSON.stringify({ kind: 'file' }));
+    expect(bridge.claim).toHaveBeenCalledWith('s2', false);
+    expect(bridge.discard).not.toHaveBeenCalled();
+  });
+
+  it('says whether a send has anything to ask about', () => {
+    const { result } = setup({ start: [chip] });
+    expect(result.current.edits.holdsEdits()).toBe(true);
+    const { result: other } = setup({ start: [chipNamed('a.docx')] });
+    expect(other.current.edits.holdsEdits()).toBe(false);
+  });
+});
+
+describe('a forwarded part', () => {
+  it('from a message marked as phishing has no Edit', () => {
+    const { result } = setup({ start: [] });
+    expect(result.current.edits.canEditChip({ ...chipNamed('a.docx'), editBlocked: true })).toBe(false);
+  });
+
+  it('from another login follows that login\'s rules, and its session is filed there', async () => {
+    const { result } = setup({ start: [{ ...chipNamed('a.docx'), sourceAccountId: 'other' }] });
+    expect(result.current.edits.canEditChip(result.current.attachments[0])).toBe(true);
+    await act(() => result.current.edits.startEdit(result.current.attachments[0]));
+    expect(bridge.begin).toHaveBeenCalledWith('blob:other:b');
+    const [, file] = bridge.open.mock.calls[0] as unknown as [string, { account: string }];
+    expect(file.account).toBe('other');
+  });
+
+  it('from a login whose organisation says no has no Edit, whatever this one says', () => {
+    const { result } = setup({ start: [] });
+    forbidden.add('other');
+    try {
+      expect(result.current.edits.canEditChip({ ...chipNamed('a.docx'), sourceAccountId: 'other' })).toBe(false);
+      expect(result.current.edits.canEditChip(chipNamed('a.docx'))).toBe(true);
+    } finally {
+      forbidden.clear();
+    }
+  });
+});
+
+describe('a reply from an offer', () => {
+  it('takes the waiting file, and the session comes with it', async () => {
+    const outcome = await readEditedFile({ id: 's1', account: 'acct' });
+    if (!outcome.ok) throw new Error('refused');
+    parkFilesForReply('e1', [outcome.file]);
+    const { result } = setup({ start: [], repliesTo: 'e1', draftId: null });
+    await waitFor(() => expect(result.current.attachments.map((a) => a.name)).toEqual(['a.docx']));
+    await waitFor(() => expect(result.current.attachments[0].editSessionId).toBe('s1'));
+    await waitFor(() => expect(bridge.taken).toHaveBeenCalledWith('s1', 'h2'));
+    expect(bridge.claim).toHaveBeenCalledWith('s1', true);
+  });
+
+  it('a version counts as taken only once it is up', async () => {
+    const outcome = await readEditedFile({ id: 's1', account: 'acct' });
+    if (!outcome.ok) throw new Error('refused');
+    parkFilesForReply('e1', [outcome.file]);
+    const { result } = setup({ start: [], repliesTo: 'e1', draftId: null, upload: () => ({ uploading: true }) });
+    await waitFor(() => expect(result.current.attachments[0]?.editSessionId).toBe('s1'));
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    expect(bridge.taken).not.toHaveBeenCalled();
+    act(() => result.current.setAttachments((list) => list.map((att) => ({ ...att, uploading: false, blobId: 'up' }))));
+    await waitFor(() => expect(bridge.taken).toHaveBeenCalledWith('s1', 'h2'));
+  });
+
+  it('a reply to another message leaves it waiting', async () => {
+    parkFilesForReply('e1', [new File(['x'], 'a.docx')]);
+    const { result } = setup({ start: [], repliesTo: 'e2', draftId: null });
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    expect(result.current.attachments).toEqual([]);
+  });
+});
+
+describe('in a browser', () => {
+  it('nothing happens at all', () => {
+    delete (window as unknown as { bulwarkDesktop?: unknown }).bulwarkDesktop;
+    const { result } = setup({ start: [{ name: 'a.docx', type: 'x/y', blobId: 'b' }] });
+    expect(result.current.edits.canEditChip(chipNamed('a.docx'))).toBe(false);
+    expect(result.current.attachments[0].editSessionId).toBeUndefined();
+    expect(() => result.current.edits.finish()).not.toThrow();
+  });
+});

hooks/__tests__/use-wopi-status.test.ts

@@ -0,0 +1,140 @@
+import { renderHook, waitFor, cleanup } from '@testing-library/react';
+import { describe, it, expect, vi, beforeEach, afterEach, type Mock } from 'vitest';
+
+// /api/wopi/status needs the sign-in context cookie. The mail and files views
+// can mount before it exists, so a 401 there says nothing about the editor and
+// must not leave office editing off until the next page load (#1518).
+
+const ENABLED = { enabled: true, editExtensions: ['docx', 'odt'], viewExtensions: ['pdf'], newExtensions: ['docx'] };
+
+const answer = (status: number, body: unknown = {}) => ({ ok: status >= 200 && status < 300, status, json: async () => body });
+
+let fetchMock: Mock<(url: string, init?: RequestInit) => Promise<unknown>>;
+let useWopiStatus: typeof import('@/hooks/use-wopi-status').useWopiStatus;
+let useAuthStore: typeof import('@/stores/auth-store').useAuthStore;
+
+const signIn = (client: object) => useAuthStore.setState({ isAuthenticated: true, client: client as never });
+
+beforeEach(async () => {
+  fetchMock = vi.fn();
+  // Only the status route counts: the auth store asks for other things on import.
+  vi.stubGlobal('fetch', (url: string, init?: RequestInit) => (
+    url.includes('/api/wopi/status') ? fetchMock(url, init) : Promise.resolve(answer(404))
+  ));
+  // The hook shares its answer through module state, like a page load does.
+  vi.resetModules();
+  ({ useWopiStatus } = await import('@/hooks/use-wopi-status'));
+  ({ useAuthStore } = await import('@/stores/auth-store'));
+  useAuthStore.setState({ isAuthenticated: false, client: null });
+});
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+describe('useWopiStatus', () => {
+  it('asks nothing before sign-in, and asks once sign-in is done', async () => {
+    fetchMock.mockResolvedValue(answer(200, ENABLED));
+    const { result } = renderHook(() => useWopiStatus(true));
+
+    await Promise.resolve();
+    expect(fetchMock).not.toHaveBeenCalled();
+
+    signIn({});
+    await waitFor(() => expect(result.current?.enabled).toBe(true));
+    expect(result.current?.editExtensions).toContain('docx');
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('asks nothing while the persisted flag says signed in but no client is connected yet', async () => {
+    fetchMock.mockResolvedValue(answer(200, ENABLED));
+    useAuthStore.setState({ isAuthenticated: true, client: null });
+    renderHook(() => useWopiStatus(true));
+
+    await Promise.resolve();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('turns editing on when a 401 is followed by the real client taking over', async () => {
+    // A local copy is on screen before the restore writes the context cookie.
+    fetchMock.mockResolvedValueOnce(answer(401)).mockResolvedValue(answer(200, ENABLED));
+    signIn({ kind: 'local copy' });
+    const { result } = renderHook(() => useWopiStatus(true));
+    await waitFor(() => expect(result.current).not.toBeNull());
+    expect(result.current?.enabled).toBe(false);
+
+    signIn({ kind: 'real' });
+    await waitFor(() => expect(result.current?.enabled).toBe(true));
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it('does not share a 401 still in flight with the client that took over', async () => {
+    let finishFirst: (value: unknown) => void = () => {};
+    fetchMock
+      .mockReturnValueOnce(new Promise((resolve) => { finishFirst = resolve; }))
+      .mockResolvedValue(answer(200, ENABLED));
+    signIn({ kind: 'local copy' });
+    const { result } = renderHook(() => useWopiStatus(true));
+    await waitFor(() => expect(fetchMock).toHaveBeenCalledTimes(1));
+
+    signIn({ kind: 'real' });
+    await waitFor(() => expect(result.current?.enabled).toBe(true));
+    finishFirst(answer(401));
+
+    // The late refusal does not take the answer back, for this view or the next.
+    await new Promise((resolve) => setTimeout(resolve));
+    expect(result.current?.enabled).toBe(true);
+    const next = renderHook(() => useWopiStatus(true));
+    await waitFor(() => expect(next.result.current?.enabled).toBe(true));
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it.each([401, 500, 502])('asks again on the next mount after a %i', async (status) => {
+    fetchMock.mockResolvedValueOnce(answer(status)).mockResolvedValue(answer(200, ENABLED));
+    signIn({});
+    const first = renderHook(() => useWopiStatus(true));
+    await waitFor(() => expect(first.result.current).not.toBeNull());
+    expect(first.result.current?.enabled).toBe(false);
+
+    const second = renderHook(() => useWopiStatus(true));
+    await waitFor(() => expect(second.result.current?.enabled).toBe(true));
+  });
+
+  it('keeps a real answer for the page, across views and account switches', async () => {
+    fetchMock.mockResolvedValue(answer(200, ENABLED));
+    signIn({ account: 'a' });
+    const first = renderHook(() => useWopiStatus(true));
+    await waitFor(() => expect(first.result.current?.enabled).toBe(true));
+
+    const second = renderHook(() => useWopiStatus(true));
+    await waitFor(() => expect(second.result.current?.enabled).toBe(true));
+    signIn({ account: 'b' });
+    await waitFor(() => expect(useAuthStore.getState().client).toEqual({ account: 'b' }));
+    await new Promise((resolve) => setTimeout(resolve));
+
+    expect(first.result.current?.enabled).toBe(true);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('keeps a real "no editor" answer too, so mail views do not keep asking', async () => {
+    fetchMock.mockResolvedValue(answer(200, { enabled: false }));
+    signIn({});
+    const first = renderHook(() => useWopiStatus(true));
+    await waitFor(() => expect(first.result.current?.enabled).toBe(false));
+
+    const second = renderHook(() => useWopiStatus(true));
+    await waitFor(() => expect(second.result.current?.enabled).toBe(false));
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('asks nothing while the caller has it switched off', async () => {
+    fetchMock.mockResolvedValue(answer(200, ENABLED));
+    signIn({});
+    const { result } = renderHook(() => useWopiStatus(false));
+
+    await Promise.resolve();
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(result.current).toBeNull();
+  });
+});

hooks/use-composer-edits.ts

@@ -0,0 +1,234 @@
+"use client";
+
+import { useCallback, useEffect, useRef, type Dispatch, type SetStateAction } from "react";
+import { useTranslations } from "next-intl";
+import { editAllowed, editFileInfo, followEditSessions, getEditBridge, parseEditSource, readEditedFile, takeFilesForReply, useEditSessions, type EditSource } from "@/lib/desktop/edit-attachments";
+import { getDesktopBridge } from "@/lib/desktop/bridge";
+import { useEditAttachment } from "@/hooks/use-edit-attachment";
+import { toast } from "@/stores/toast-store";
+
+/** What this needs from a composer's attachment. */
+export interface EditableAttachment {
+  file?: File;
+  name: string;
+  type: string;
+  blobId?: string;
+  uploading?: boolean;
+  error?: boolean;
+  /** The Edit session this chip's file belongs to. Kept through every state change of the chip. */
+  editSessionId?: string;
+  /** The login the part really belongs to, on a forward: its organisation's rules are the ones that count. */
+  sourceAccountId?: string;
+  /** From a message marked as phishing: not opened in other programs here either. */
+  editBlocked?: boolean;
+}
+
+interface Options<A extends EditableAttachment> {
+  attachments: A[];
+  setAttachments: Dispatch<SetStateAction<A[]>>;
+  addFiles: (files: File[]) => Promise<void>;
+  load: (attachment: A) => Promise<Blob>;
+  /** The local account the draft goes through. */
+  account: string;
+  draftId: string | null;
+  ownerAccountId?: string;
+  /** The message a reply answers: a file waiting for that reply lands here. */
+  repliesTo?: string;
+  /** Only once the composer can upload. */
+  ready: boolean;
+}
+
+/**
+ * A composer's part of Edit: its chips start sessions and hold them, so the offer to update
+ * sits on the chip rather than in the main window. A session goes when the draft is sent or
+ * discarded, unless it has edits nobody took: those stay, for the user to decide on.
+ */
+export function useComposerEdits<A extends EditableAttachment>({ attachments, setAttachments, addFiles, load, account, draftId, ownerAccountId, repliesTo, ready }: Options<A>) {
+  const t = useTranslations("desktopEdit");
+  const { canEdit, edit } = useEditAttachment(account);
+  const available = getEditBridge() !== null;
+  const sessions = useEditSessions((s) => s.sessions);
+  const instanceRef = useRef(`${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`);
+  const heldRef = useRef(new Set<string>());
+  const takenRef = useRef(new WeakSet<File>());
+  const latest = useRef({ attachments, sessions });
+  latest.current = { attachments, sessions };
+
+  useEffect(() => {
+    if (available) followEditSessions();
+  }, [available]);
+
+  // A file the user sent into a reply from an offer.
+  const repliedRef = useRef(false);
+  useEffect(() => {
+    if (!available || !ready || repliedRef.current || !repliesTo) return;
+    repliedRef.current = true;
+    const files = takeFilesForReply(repliesTo);
+    if (files.length > 0) void addFiles(files);
+  }, [available, ready, repliesTo, addFiles]);
+
+  // A file read back from a session: its chip takes the session on, and once it's up the
+  // version it holds is no longer a change.
+  useEffect(() => {
+    if (!available) return;
+    const untagged = attachments.some((att) => !att.editSessionId && editFileInfo(att.file));
+    if (untagged) {
+      setAttachments((list) => list.map((att) => {
+        const info = att.editSessionId ? undefined : editFileInfo(att.file);
+        return info ? { ...att, editSessionId: info.id } : att;
+      }));
+    }
+    for (const att of attachments) {
+      const info = editFileInfo(att.file);
+      if (!info || !att.file || !att.blobId || att.uploading || att.error || takenRef.current.has(att.file)) continue;
+      takenRef.current.add(att.file);
+      void getEditBridge()?.taken(info.id, info.hash);
+    }
+  }, [available, attachments, setAttachments]);
+
+  // A draft opened again finds its sessions by the draft's id and the file's name.
+  useEffect(() => {
+    if (!available || !draftId) return;
+    const mine = sessions.filter((session) => {
+      const source = parseEditSource(session.source);
+      return source.kind === "draft" && source.draftId === draftId && !session.claimed;
+    });
+    if (mine.length === 0) return;
+    setAttachments((list) => {
+      let changed = false;
+      const next = list.map((att) => {
+        if (att.editSessionId) return att;
+        const match = mine.find((session) => session.name === att.name && !list.some((other) => other.editSessionId === session.id));
+        if (!match) return att;
+        changed = true;
+        return { ...att, editSessionId: match.id };
+      });
+      return changed ? next : list;
+    });
+  }, [available, draftId, sessions, setAttachments]);
+
+  // Holds what's on a chip. One taken off a chip goes unless it has edits, which stay in the offers.
+  const heldIds = attachments.flatMap((att) => (att.editSessionId ? [att.editSessionId] : []));
+  const heldKey = [...new Set(heldIds)].sort().join("\n");
+  useEffect(() => {
+    const bridge = getEditBridge();
+    if (!bridge) return;
+    const now = new Set(heldKey ? heldKey.split("\n") : []);
+    for (const id of now) {
+      if (!heldRef.current.has(id)) bridge.claim(id, true);
+    }
+    for (const id of heldRef.current) {
+      if (now.has(id)) continue;
+      bridge.claim(id, false);
+      void bridge.release(id, JSON.stringify({ kind: "file" } satisfies EditSource));
+    }
+    heldRef.current = now;
+  }, [heldKey]);
+
+  // Follows the draft's id, which changes with every save.
+  useEffect(() => {
+    const bridge = getEditBridge();
+    if (!bridge || !heldKey) return;
+    const source = JSON.stringify({ kind: "draft", draftId, ownerAccountId } satisfies EditSource);
+    for (const id of heldKey.split("\n")) bridge.setSource(id, source);
+  }, [heldKey, draftId, ownerAccountId]);
+
+  // Closing the composer isn't an end: the draft may be opened again.
+  useEffect(() => () => {
+    const bridge = getEditBridge();
+    for (const id of heldRef.current) bridge?.claim(id, false);
+    heldRef.current = new Set();
+  }, []);
+
+  const sessionOf = useCallback((att: A) => (att.editSessionId ? sessions.find((s) => s.id === att.editSessionId) : undefined), [sessions]);
+
+  /** Whether this chip has saved edits to take. Its own file on its way up isn't one. */
+  const hasUpdate = useCallback((att: A) => {
+    const session = sessionOf(att);
+    return session?.changed === true && editFileInfo(att.file)?.hash !== session.hash;
+  }, [sessionOf]);
+
+  /** The part's own account decides too, on a forward from another login. */
+  const canEditChip = useCallback((att: A) => (
+    !att.editBlocked && canEdit(att.name) && (!att.sourceAccountId || editAllowed(att.sourceAccountId))
+  ), [canEdit]);
+
+  const startEdit = useCallback(async (att: A) => {
+    const owner = att.sourceAccountId ?? account;
+    const key = att.editSessionId
+      ? `session:${att.editSessionId}`
+      : att.blobId ? `blob:${owner}:${att.blobId}` : `composer:${instanceRef.current}:${att.name}`;
+    const result = await edit({
+      key,
+      name: att.name,
+      type: att.type,
+      account: owner,
+      source: { kind: "draft", draftId, ownerAccountId },
+      load: () => load(att),
+    });
+    if (result.ok) {
+      setAttachments((list) => list.map((item) => (
+        (att.file ? item.file === att.file : item.blobId === att.blobId) ? { ...item, editSessionId: result.id } : item
+      )));
+    }
+  }, [account, draftId, edit, load, ownerAccountId, setAttachments]);
+
+  /** The edited file goes up first. Only then does the old one come off, so a failed upload loses nothing. */
+  const update = useCallback(async (att: A) => {
+    const id = att.editSessionId;
+    if (!id) return;
+    const outcome = await readEditedFile({ id, account });
+    if (!outcome.ok) {
+      toast.error(t(outcome.reason === "busy" ? "read_busy" : outcome.reason === "policy" ? "blocked_policy" : "read_failed", { name: att.name }));
+      return;
+    }
+    const { file } = outcome;
+    await addFiles([file]);
+    setAttachments((list) => {
+      const added = list.find((item) => item.file === file);
+      if (added?.blobId && !added.error) return list.filter((item) => item.file === file || item.editSessionId !== id);
+      return list.filter((item) => item.file !== file);
+    });
+  }, [account, addFiles, setAttachments, t]);
+
+  /** Whether a send has anything to ask about. */
+  const holdsEdits = useCallback(() => latest.current.attachments.some((att) => att.editSessionId), []);
+
+  /** Edits on the way out in an older version: asks first. False: don't send. */
+  const confirmSend = useCallback(async (): Promise<boolean> => {
+    const { attachments: list } = latest.current;
+    // Someone who saves and goes straight to Send is the case this is for: the watcher may not have seen it yet.
+    const all = await getEditBridge()?.settle() ?? latest.current.sessions;
+    const stale = list.flatMap((att) => {
+      const session = att.editSessionId ? all.find((s) => s.id === att.editSessionId) : undefined;
+      return session?.changed && editFileInfo(att.file)?.hash !== session.hash ? [session] : [];
+    });
+    const dialogs = getDesktopBridge()?.dialogs;
+    if (stale.length === 0 || !dialogs) return true;
+    const choice = await dialogs.confirm({
+      type: "warning",
+      message: t("send_stale_title", { name: stale[0].name }),
+      detail: t("send_stale_detail"),
+      buttons: [t("send_stale_send"), t("send_stale_back")],
+      defaultId: 1,
+    });
+    return choice === 0;
+  }, [t]);
+
+  /**
+   * The draft was sent or discarded. Main decides what goes, as only it knows about a save from a
+   * moment ago. Reads no state of the component: this can run after it has gone.
+   */
+  const finish = useCallback(() => {
+    const bridge = getEditBridge();
+    if (!bridge) return;
+    const ids = new Set(latest.current.attachments.flatMap((att) => (att.editSessionId ? [att.editSessionId] : [])));
+    for (const id of ids) {
+      heldRef.current.delete(id);
+      bridge.claim(id, false);
+      void bridge.release(id, JSON.stringify({ kind: "file" } satisfies EditSource));
+    }
+  }, []);
+
+  return { canEditChip, startEdit, hasUpdate, update, holdsEdits, confirmSend, finish };
+}

hooks/use-config.ts

@@ -40,6 +40,7 @@ export interface ConfigData {
   loginShowSubtitle: boolean;
   loginShowTotp: boolean;
   loginShowTokenLogin: boolean;
+  desktopBrowserSignIn: boolean;
   loginShowRememberMe: boolean;
   loginShowVersion: boolean;
   demoMode: boolean;
@@ -199,6 +200,7 @@ export function useConfig(): AppConfig {
     loginShowSubtitle: configCache?.loginShowSubtitle ?? true,
     loginShowTotp: configCache?.loginShowTotp ?? true,
     loginShowTokenLogin: configCache?.loginShowTokenLogin ?? false,
+    desktopBrowserSignIn: configCache?.desktopBrowserSignIn ?? true,
     loginShowRememberMe: configCache?.loginShowRememberMe ?? false,
     loginShowVersion: configCache?.loginShowVersion ?? true,
     demoMode: configCache?.demoMode || false,
@@ -252,6 +254,7 @@ export function useConfig(): AppConfig {
         loginShowSubtitle: configCache.loginShowSubtitle,
         loginShowTotp: configCache.loginShowTotp,
         loginShowTokenLogin: configCache.loginShowTokenLogin,
+        desktopBrowserSignIn: configCache.desktopBrowserSignIn,
         loginShowRememberMe: configCache.loginShowRememberMe,
         loginShowVersion: configCache.loginShowVersion,
         demoMode: configCache.demoMode,
@@ -306,6 +309,7 @@ export function useConfig(): AppConfig {
           loginShowSubtitle: data.loginShowSubtitle,
           loginShowTotp: data.loginShowTotp,
           loginShowTokenLogin: data.loginShowTokenLogin,
+          desktopBrowserSignIn: data.desktopBrowserSignIn,
           loginShowRememberMe: data.loginShowRememberMe,
           loginShowVersion: data.loginShowVersion,
           demoMode: data.demoMode,

hooks/use-edit-attachment.ts

@@ -0,0 +1,51 @@
+"use client";
+
+import { useCallback } from "react";
+import { useTranslations } from "next-intl";
+import { canEditFile, editAllowed, startAttachmentEdit, type EditStartResult, type StartEditInput } from "@/lib/desktop/edit-attachments";
+import { deviceSubjectOf } from "@/lib/device-policy";
+import { useDevicePolicy } from "@/hooks/use-device-policy";
+import { useAuthStore } from "@/stores/auth-store";
+import { toast } from "@/stores/toast-store";
+
+const FAILURE_KEYS: Partial<Record<Exclude<EditStartResult, { ok: true }>["reason"], string>> = {
+  policy: "blocked_policy",
+  "no-app": "no_app",
+  type: "blocked_type",
+  "too-large": "too_large",
+  full: "too_many",
+};
+
+/** The local account a message or a draft belongs to, where a copy of its file is filed. */
+export function editAccountOf(email: { sourceClientAccountId?: string | null } | null | undefined): string {
+  return deviceSubjectOf(email) ?? useAuthStore.getState().activeAccountId ?? "";
+}
+
+/**
+ * Edit, for whatever shows an attachment: whether to offer it, and starting it with the app's
+ * words for how it went. `account` is the local account the attachment belongs to; the
+ * hook follows that account's policy, so the item goes as soon as the answer turns to no.
+ */
+export function useEditAttachment(account: string) {
+  const t = useTranslations("desktopEdit");
+  const devices = useDevicePolicy(account || null);
+  const offered = !devices.noDownloads && !devices.noExport;
+  const canEdit = useCallback((name: string | null | undefined) => (
+    offered && !!account && canEditFile(name) && editAllowed(account)
+  ), [offered, account]);
+  const edit = useCallback(async (input: StartEditInput): Promise<EditStartResult> => {
+    let result: EditStartResult;
+    try {
+      result = await startAttachmentEdit(input);
+    } catch (error) {
+      console.error("Could not open an attachment for editing:", error);
+      result = { ok: false, reason: "failed" };
+    }
+    if (result.ok) toast.success(t("opened", { name: input.name }));
+    // Locked: the lock screen is what's saying it.
+    // Ticket: a newer click took over, and that one speaks.
+    else if (result.reason !== "locked" && result.reason !== "ticket") toast.error(t(FAILURE_KEYS[result.reason] ?? "failed"));
+    return result;
+  }, [t]);
+  return { canEdit, edit };
+}

hooks/use-phishing-report.ts

@@ -66,6 +66,11 @@ export function usePhishingReport(emails: ReadonlyArray<Email | null | undefined
  * in this session (a view that holds its own copy of the message, like a
  * Pro tab, doesn't see the new keyword until it loads the message again).
  */
+/** The same, once, for what isn't drawing a message: a forward taking its attachments along. */
+export function phishingMarkedNow(email: Email | null | undefined): boolean {
+  return !!email && (isPhishingMarked(email) || usePhishingReportStore.getState().reported[emailKeyFor(email)] === true);
+}
+
 export function usePhishingMarked(email: Email | null | undefined): boolean {
   const reported = usePhishingReportStore((s) => (email ? s.reported[emailKeyFor(email)] === true : false));
   return isPhishingMarked(email) || reported;

hooks/use-wopi-status.ts

@@ -3,11 +3,12 @@
 import { useEffect, useState } from "react";
 import { IS_LITE } from "@/lib/lite";
 import { apiFetch } from "@/lib/browser-navigation";
+import { useAuthStore } from "@/stores/auth-store";
 
 /**
  * Whether a WOPI document editor is configured for this deployment and which
- * file extensions it handles (#425). Fetched once per page load and shared
- * across consumers via a module-level promise.
+ * file extensions it handles (#425). The answer is the same for every account,
+ * so the first real one is kept for the page load and shared across consumers.
  */
 export interface WopiStatus {
   enabled: boolean;
@@ -19,41 +20,61 @@ export interface WopiStatus {
 
 const DISABLED: WopiStatus = { enabled: false, editExtensions: [], viewExtensions: [], newExtensions: [] };
 
-let statusPromise: Promise<WopiStatus> | null = null;
+let known: WopiStatus | null = null;
+let pending: Promise<WopiStatus> | null = null;
+let pendingClient: unknown = null;
 
-function fetchWopiStatus(): Promise<WopiStatus> {
+function fetchWopiStatus(client: unknown): Promise<WopiStatus> {
   // The WOPI bridge is a server feature; the static build never has an editor.
   if (IS_LITE) return Promise.resolve(DISABLED);
-  if (!statusPromise) {
-    statusPromise = apiFetch("/api/wopi/status")
-      .then((res) => (res.ok ? res.json() : DISABLED))
-      .then((data) => ({
+  if (known) return Promise.resolve(known);
+  // A request sent for an earlier client may be refused for lack of the sign-in
+  // context this one brought, so only the same client shares it.
+  if (pending && pendingClient === client) return pending;
+
+  const request: Promise<WopiStatus> = apiFetch("/api/wopi/status")
+    .then((res) => {
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      return res.json();
+    })
+    .then((data) => {
+      known = {
         enabled: !!data?.enabled,
         editExtensions: Array.isArray(data?.editExtensions) ? data.editExtensions : [],
         viewExtensions: Array.isArray(data?.viewExtensions) ? data.viewExtensions : [],
         newExtensions: Array.isArray(data?.newExtensions) ? data.newExtensions : [],
-      }))
-      .catch(() => {
-        statusPromise = null; // allow a retry on the next mount
-        return DISABLED;
-      });
-  }
-  return statusPromise;
+      };
+      return known;
+    })
+    // A refusal or an outage says nothing about the editor (#1518): show no
+    // editor for now and ask again on the next mount or client.
+    .catch(() => DISABLED)
+    .finally(() => {
+      if (pending === request) pending = null;
+    });
+  pending = request;
+  pendingClient = client;
+  return request;
 }
 
 export function useWopiStatus(enabled: boolean): WopiStatus | null {
   const [status, setStatus] = useState<WopiStatus | null>(null);
+  // The route needs the sign-in context cookie, which is written before the
+  // store holds a connected client. `isAuthenticated` alone comes back from
+  // storage on load, and a local copy's client gives way to the real one once
+  // the restore wrote the cookie, so this follows the client itself (#1518).
+  const client = useAuthStore((state) => (state.isAuthenticated ? state.client : null));
 
   useEffect(() => {
-    if (!enabled) return;
+    if (!enabled || !client) return;
     let cancelled = false;
-    fetchWopiStatus().then((s) => {
+    fetchWopiStatus(client).then((s) => {
       if (!cancelled) setStatus(s);
     });
     return () => {
       cancelled = true;
     };
-  }, [enabled]);
+  }, [enabled, client]);
 
   return status;
 }

lib/__tests__/desktop-handoff-routes.test.ts

@@ -0,0 +1,469 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { createHash } from 'crypto';
+import { NextRequest } from 'next/server';
+
+/**
+ * The desktop app's sign-in on an instance: what the browser checks and parks, and what the
+ * app's own page gets for the code. The real store, budgets and routes, with the mail server faked.
+ */
+
+const cookieJar = vi.hoisted(() => new Map<string, { value: string; options?: Record<string, unknown> }>());
+vi.mock('next/headers', () => ({
+  cookies: async () => ({
+    get: (name: string) => (cookieJar.has(name) ? { name, value: cookieJar.get(name)!.value } : undefined),
+    set: (name: string, value: string, options?: Record<string, unknown>) => {
+      cookieJar.set(name, { value, options });
+    },
+    delete: (name: string) => {
+      cookieJar.delete(name);
+    },
+    getAll: () => [...cookieJar.entries()].map(([name, { value }]) => ({ name, value })),
+  }),
+}));
+
+const config = vi.hoisted(() => ({ values: {} as Record<string, unknown> }));
+vi.mock('@/lib/admin/config-manager', () => ({
+  configManager: {
+    ensureLoaded: async () => {},
+    get: (key: string, fallback: unknown) => (key in config.values ? config.values[key] : fallback),
+  },
+}));
+
+const verifyJmapAuth = vi.hoisted(() => vi.fn());
+vi.mock('@/lib/auth/verify-jmap-auth', async (original) => ({
+  ...(await original<object>()),
+  verifyJmapAuth,
+}));
+
+const stalwartPasswordLogin = vi.hoisted(() => vi.fn());
+vi.mock('@/lib/auth/stalwart-password-login', async (original) => ({
+  ...(await original<object>()),
+  stalwartPasswordLogin,
+}));
+
+const reserveLoginAttempt = vi.hoisted(() => vi.fn());
+vi.mock('@/lib/auth/verify-budget', async (original) => ({
+  ...(await original<object>()),
+  reserveLoginAttempt,
+}));
+
+const discoverOAuth = vi.hoisted(() => vi.fn());
+vi.mock('@/lib/oauth/discovery', () => ({ discoverOAuth }));
+
+vi.mock('@/lib/logger', () => ({ logger: { warn: vi.fn(), error: vi.fn(), debug: vi.fn(), info: vi.fn() } }));
+
+const { POST: check } = await import('@/app/api/auth/desktop-handoff/check/route');
+const { POST: park } = await import('@/app/api/auth/desktop-handoff/park/route');
+const { POST: redeem } = await import('@/app/api/auth/desktop-handoff/redeem/route');
+const { POST: discard } = await import('@/app/api/auth/desktop-handoff/discard/route');
+const { POST: mobileRedeem } = await import('@/app/api/auth/handoff/redeem/route');
+const { JmapAuthVerificationError } = await import('@/lib/auth/verify-jmap-auth');
+const { HANDOFF_CONFIRM_TTL_MS, HANDOFF_TTL_MS, resetHandoffStoreForTests, stashHandoff } = await import('@/lib/auth/handoff-store');
+const { desktopHandoffDeclineUrl, desktopHandoffPort, desktopHandoffTarget, mobileHandoffTarget } = await import('@/lib/auth/mobile-handoff');
+const { isDesktopBlockedRoute } = await import('@/lib/desktop/blocked-routes');
+
+const ORIGIN = 'https://bulwark.example';
+const VERIFIER = 'v'.repeat(64);
+const CHALLENGE = createHash('sha256').update(VERIFIER, 'ascii').digest('base64url');
+const SERVER = 'https://mail.example';
+const TOKENS = { ok: true, tokens: { access_token: 'access', refresh_token: 'refresh', expires_in: 3600 }, tokenEndpoint: `${SERVER}/auth/token`, clientId: 'x' };
+
+/** A client of its own per test, so the budgets don't carry over: the real ones, unmocked. */
+let clientAddress = '';
+let nextClient = 1;
+
+function post(path: string, body: unknown, origin = ORIGIN) {
+  return new NextRequest(`${ORIGIN}${path}`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Origin: origin, Host: 'bulwark.example', 'x-forwarded-for': clientAddress },
+    body: JSON.stringify(body),
+  });
+}
+
+const parkBody = (extra: Record<string, unknown> = {}) => ({
+  code_challenge: CHALLENGE,
+  state: 'state-1',
+  server_url: SERVER,
+  username: 'a@example.org',
+  password: 'secret',
+  ...extra,
+});
+const checkBody = (extra: Record<string, unknown> = {}) => ({ server_url: SERVER, username: 'a@example.org', password: 'secret', ...extra });
+
+const parkIt = (extra: Record<string, unknown> = {}) => park(post('/api/auth/desktop-handoff/park', parkBody(extra)));
+
+async function parkedCode(extra: Record<string, unknown> = {}): Promise<string> {
+  const answer = await parkIt(extra);
+  expect(answer.status).toBe(200);
+  return ((await answer.json()) as { code: string }).code;
+}
+
+const redeemBody = (code: string, extra: Record<string, unknown> = {}) => ({ code, code_verifier: VERIFIER, slot: 1, remember: true, allowed_servers: null, custom_servers_allowed: true, ...extra });
+const redeemIt = (code: string, extra: Record<string, unknown> = {}) => redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code, extra)));
+
+/** Everything the store holds, in the open. Nothing secret may be in it after its use. */
+const heldInMemory = () => JSON.stringify([...((globalThis as unknown as { __bulwarkMobileHandoffStore?: Map<string, unknown> }).__bulwarkMobileHandoffStore ?? new Map()).values()]);
+
+let revoked: string[];
+
+beforeEach(() => {
+  cookieJar.clear();
+  resetHandoffStoreForTests();
+  clientAddress = `203.0.113.${(nextClient += 1)}`;
+  config.values = { jmapServerUrl: SERVER };
+  verifyJmapAuth.mockReset();
+  verifyJmapAuth.mockResolvedValue(undefined);
+  stalwartPasswordLogin.mockReset();
+  stalwartPasswordLogin.mockResolvedValue(TOKENS);
+  reserveLoginAttempt.mockReset();
+  reserveLoginAttempt.mockResolvedValue(async () => {});
+  discoverOAuth.mockReset();
+  discoverOAuth.mockResolvedValue({ revocation_endpoint: `${SERVER}/revoke` });
+  revoked = [];
+  vi.stubGlobal('fetch', vi.fn(async (url: string, init?: RequestInit) => {
+    if (String(url).endsWith('/revoke')) revoked.push(new URLSearchParams(String(init?.body)).get('token') ?? '');
+    return new Response('{}', { status: 200 });
+  }));
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.useRealTimers();
+  vi.restoreAllMocks();
+});
+
+describe('the target', () => {
+  it('is only ever this computer on the one path', () => {
+    expect(desktopHandoffTarget('http://127.0.0.1:51234/bulwark-desktop/callback')).toBe('http://127.0.0.1:51234/bulwark-desktop/callback');
+    for (const bad of [
+      'http://127.0.0.1/bulwark-desktop/callback',
+      'http://127.0.0.1:99999/bulwark-desktop/callback',
+      'http://localhost:51234/bulwark-desktop/callback',
+      'https://127.0.0.1:51234/bulwark-desktop/callback',
+      'http://127.0.0.1:51234/other',
+      'http://127.0.0.1:51234/bulwark-desktop/callback?x=1',
+      'http://127.0.0.1@evil.example:51234/bulwark-desktop/callback',
+      'http://evil.example/bulwark-desktop/callback',
+      'bulwarkmobile://auth/callback',
+      null,
+    ]) {
+      expect(desktopHandoffTarget(bad), String(bad)).toBe('');
+    }
+  });
+
+  it('leaves the phone\'s rule as it was', () => {
+    expect(mobileHandoffTarget('http://127.0.0.1:51234/bulwark-desktop/callback')).toBe('');
+  });
+
+  it('a no goes back with the state and no code', () => {
+    const target = 'http://127.0.0.1:51234/bulwark-desktop/callback';
+    expect(desktopHandoffPort(target)).toBe('51234');
+    expect(desktopHandoffDeclineUrl(target, 's t')).toBe(`${target}?error=access_denied&state=s+t`);
+  });
+
+  it('the embedded build has none of these routes', () => {
+    for (const route of ['check', 'park', 'redeem', 'discard']) expect(isDesktopBlockedRoute(`/api/auth/desktop-handoff/${route}`)).toBe(true);
+    expect(isDesktopBlockedRoute('/api/auth/desktop-oauth')).toBe(false);
+  });
+});
+
+describe('checking, before the question', () => {
+  const checkIt = (extra: Record<string, unknown> = {}, origin = ORIGIN) => check(post('/api/auth/desktop-handoff/check', checkBody(extra), origin));
+
+  it('keeps nothing: no record, no cookie, and the password appears nowhere', async () => {
+    const answer = await checkIt();
+    expect(answer.status).toBe(200);
+    expect(heldInMemory()).toBe('[]');
+    expect([...cookieJar.keys()]).toEqual([]);
+    expect(stalwartPasswordLogin).not.toHaveBeenCalled();
+  });
+
+  it('refuses another origin', async () => {
+    expect((await checkIt({}, 'https://evil.example')).status).toBe(403);
+    expect(verifyJmapAuth).not.toHaveBeenCalled();
+  });
+
+  it('says a wrong password is wrong, and that a second factor is needed', async () => {
+    verifyJmapAuth.mockRejectedValueOnce(new JmapAuthVerificationError('no', 401, 401));
+    expect(await (await checkIt()).json()).toEqual({ error: 'invalid_credentials' });
+    verifyJmapAuth.mockRejectedValueOnce(new JmapAuthVerificationError('no', 401, 402));
+    expect(await (await checkIt()).json()).toEqual({ error: 'totp_required' });
+  });
+
+  it('holds no password on an OAuth-only instance', async () => {
+    config.values = { jmapServerUrl: SERVER, oauthEnabled: true, oauthOnly: true };
+    expect((await checkIt()).status).toBe(403);
+    expect(verifyJmapAuth).not.toHaveBeenCalled();
+  });
+
+  it('over the login budget, nothing reaches the mail server, and the answer says why', async () => {
+    reserveLoginAttempt.mockResolvedValue(null);
+    const answer = await checkIt();
+    expect(answer.status).toBe(429);
+    expect(await answer.json()).toEqual({ error: 'too_many_attempts' });
+    expect(verifyJmapAuth).not.toHaveBeenCalled();
+  });
+
+  it('never goes to a server the instance does not know', async () => {
+    expect((await checkIt({ server_url: 'https://evil.example' })).status).toBe(400);
+    expect(verifyJmapAuth).not.toHaveBeenCalled();
+  });
+});
+
+describe('the instance admin\'s switch', () => {
+  it('closes every route, with nothing checked, parked or redeemed', async () => {
+    const code = await parkedCode();
+    verifyJmapAuth.mockClear();
+    stalwartPasswordLogin.mockClear();
+    config.values = { jmapServerUrl: SERVER, desktopBrowserSignIn: false };
+    expect((await check(post('/api/auth/desktop-handoff/check', checkBody()))).status).toBe(403);
+    expect((await parkIt()).status).toBe(403);
+    expect(verifyJmapAuth).not.toHaveBeenCalled();
+    expect(stalwartPasswordLogin).not.toHaveBeenCalled();
+    expect((await redeemIt(code)).status).toBe(403);
+  });
+});
+
+describe('parking, after the yes', () => {
+  it('hands over tokens wherever the server can give them, and leaves this browser with no session', async () => {
+    const code = await parkedCode();
+    expect(verifyJmapAuth).not.toHaveBeenCalled();
+    expect([...cookieJar.keys()]).toEqual([]);
+    expect(heldInMemory()).not.toContain('secret');
+    const answer = await redeemIt(code);
+    const body = await answer.json();
+    expect(body).toMatchObject({ flow: 'tokens', password_login: true, username: 'a@example.org', access_token: 'access' });
+    expect(JSON.stringify(body)).not.toContain('secret');
+    expect(JSON.stringify(body)).not.toContain('"refresh"');
+    expect(cookieJar.get('jmap_rt_1')?.value).toBe('refresh');
+  });
+
+  it.each(['login_endpoint_missing', 'login_rejected', 'login_unreachable', 'token_exchange_failed'])('a password only as the last resort: %s', async (error) => {
+    stalwartPasswordLogin.mockResolvedValue({ ok: false, error });
+    const code = await parkedCode();
+    expect(verifyJmapAuth).toHaveBeenCalledOnce();
+    expect(await (await redeemIt(code)).json()).toEqual({ flow: 'password', server_url: SERVER, username: 'a@example.org', password: 'secret' });
+  });
+
+  it('a password that turns out wrong, on the way, parks nothing', async () => {
+    stalwartPasswordLogin.mockResolvedValue({ ok: false, error: 'invalid_credentials' });
+    const answer = await parkIt();
+    expect(answer.status).toBe(401);
+    expect(await answer.json()).toEqual({ error: 'invalid_credentials' });
+    expect(heldInMemory()).toBe('[]');
+  });
+
+  it('a wrong two-factor code gets no fallback to a password', async () => {
+    stalwartPasswordLogin.mockResolvedValue({ ok: false, error: 'login_rejected' });
+    expect((await parkIt({ totp: '000000' })).status).toBe(502);
+    expect(verifyJmapAuth).not.toHaveBeenCalled();
+    expect(heldInMemory()).toBe('[]');
+  });
+
+  it('refuses another origin', async () => {
+    expect((await park(post('/api/auth/desktop-handoff/park', parkBody(), 'https://evil.example'))).status).toBe(403);
+    expect(stalwartPasswordLogin).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ['no challenge', { code_challenge: '' }],
+    ['a bad challenge', { code_challenge: 'short' }],
+    ['no state', { state: '' }],
+    ['no password', { password: '' }],
+  ])('refuses %s', async (_name, extra) => {
+    expect((await parkIt(extra)).status).toBe(400);
+    expect(stalwartPasswordLogin).not.toHaveBeenCalled();
+  });
+
+  it('what was checked is what is parked: the body can\'t name another server for the app', async () => {
+    config.values = { jmapServerUrl: SERVER, jmapServers: [{ id: 'two', url: 'https://two.example', name: 'Two' }] };
+    const code = await parkedCode({ server_id: 'two', server_url: 'https://evil.example' });
+    expect(stalwartPasswordLogin.mock.calls[0][0]).toMatchObject({ serverUrl: 'https://two.example' });
+    expect(await (await redeemIt(code)).json()).toMatchObject({ server_url: 'https://two.example' });
+  });
+});
+
+describe('the budget, with one address for a whole office', () => {
+  it('sign-ins that work never run out', async () => {
+    clientAddress = '198.51.100.7';
+    for (let i = 0; i < 25; i += 1) expect((await parkIt()).status, `sign-in ${i}`).toBe(200);
+  });
+
+  it('after ten failures it refuses before going upstream, so no code is spent, and says why', async () => {
+    clientAddress = '198.51.100.8';
+    stalwartPasswordLogin.mockResolvedValue({ ok: false, error: 'invalid_credentials' });
+    for (let i = 0; i < 10; i += 1) expect((await parkIt({ totp: '000000' })).status).toBe(401);
+    stalwartPasswordLogin.mockClear();
+    const answer = await parkIt({ totp: '123456' });
+    expect(answer.status).toBe(429);
+    expect(await answer.json()).toEqual({ error: 'too_many_attempts' });
+    expect(answer.headers.get('Retry-After')).toBeTruthy();
+    expect(stalwartPasswordLogin).not.toHaveBeenCalled();
+  });
+
+  it('a bad code to redeem is what its budget counts, and a good one gives it back', async () => {
+    clientAddress = '198.51.100.9';
+    for (let i = 0; i < 12; i += 1) expect((await redeemIt(await parkedCode())).status).toBe(200);
+    for (let i = 0; i < 10; i += 1) expect((await redeemIt('f'.repeat(64))).status).toBe(400);
+    expect((await redeemIt('f'.repeat(64))).status).toBe(429);
+  });
+});
+
+describe('redeeming, in the app', () => {
+  it('a code can be used once', async () => {
+    const code = await parkedCode();
+    expect((await redeemIt(code)).status).toBe(200);
+    const again = await redeemIt(code);
+    expect(again.status).toBe(400);
+    expect(await again.json()).toEqual({ error: 'invalid_code' });
+  });
+
+  it('a wrong verifier gets nothing, and spends the code', async () => {
+    const code = await parkedCode();
+    const wrong = await redeemIt(code, { code_verifier: 'w'.repeat(64) });
+    expect(wrong.status).toBe(400);
+    expect(await wrong.json()).toEqual({ error: 'invalid_verifier' });
+    expect((await redeemIt(code)).status).toBe(400);
+    expect([...cookieJar.keys()]).toEqual([]);
+  });
+
+  it('a late code is told so', async () => {
+    const code = await parkedCode();
+    const now = Date.now();
+    vi.spyOn(Date, 'now').mockReturnValue(now + 61_000);
+    const answer = await redeemIt(code);
+    expect(answer.status).toBe(400);
+    expect(await answer.json()).toEqual({ error: 'expired_code' });
+  });
+
+  it('keeps the instance\'s strict cookies strict', async () => {
+    config.values = { jmapServerUrl: SERVER, cookieSameSite: 'strict' };
+    await redeemIt(await parkedCode());
+    expect(cookieJar.get('jmap_rt_1')?.options).toMatchObject({ sameSite: 'strict', httpOnly: true });
+  });
+
+  it('a server off the device\'s list gets nothing written, the token is revoked, and the code is gone', async () => {
+    const code = await parkedCode();
+    const answer = await redeemIt(code, { allowed_servers: ['https://other.example'] });
+    expect(answer.status).toBe(403);
+    expect(await answer.json()).toMatchObject({ code: 'blocked_by_policy' });
+    expect([...cookieJar.keys()]).toEqual([]);
+    expect(revoked).toEqual(['refresh']);
+    expect((await redeemIt(code)).status).toBe(400);
+  });
+
+  it('a list that names the server lets it through', async () => {
+    expect((await redeemIt(await parkedCode(), { allowed_servers: [SERVER] })).status).toBe(200);
+  });
+
+  describe('a server of the user\'s own, on an instance that allows them', () => {
+    const OWN = 'https://1.1.1.1';
+    beforeEach(() => {
+      config.values = { jmapServerUrl: SERVER, allowCustomJmapEndpoint: true };
+    });
+
+    it('is refused when the device\'s rule says no: forced InstanceUrl, or AllowStandalone off', async () => {
+      const code = await parkedCode({ server_url: OWN });
+      const answer = await redeemIt(code, { custom_servers_allowed: false });
+      expect(answer.status).toBe(403);
+      expect(await answer.json()).toMatchObject({ code: 'blocked_by_policy' });
+      expect([...cookieJar.keys()]).toEqual([]);
+    });
+
+    it('is refused when a page says nothing about it', async () => {
+      const code = await parkedCode({ server_url: OWN });
+      const { custom_servers_allowed: _left, ...withoutRule } = redeemBody(code);
+      expect((await redeem(post('/api/auth/desktop-handoff/redeem', withoutRule))).status).toBe(403);
+    });
+
+    it('goes through when the device allows it', async () => {
+      expect((await redeemIt(await parkedCode({ server_url: OWN }))).status).toBe(200);
+    });
+
+    it('the instance\'s own server is no such thing', async () => {
+      expect((await redeemIt(await parkedCode(), { custom_servers_allowed: false })).status).toBe(200);
+    });
+  });
+
+  it('refuses another origin', async () => {
+    const code = await parkedCode();
+    expect((await redeem(post('/api/auth/desktop-handoff/redeem', redeemBody(code), 'https://evil.example'))).status).toBe(403);
+  });
+});
+
+describe('what stays behind', () => {
+  const ssoBundle = {
+    flow: 'desktop-tokens' as const,
+    server_url: SERVER,
+    server_id: null,
+    custom: false,
+    access_token: 'sso-access',
+    refresh_token: 'sso-refresh',
+    expires_in: 3600,
+    signed_in_at: 1,
+  };
+  const parkedSso = () => stashHandoff(ssoBundle, { challenge: CHALLENGE, state: 's', awaitConfirm: true });
+  const discardIt = (code: string) => discard(post('/api/auth/desktop-handoff/discard', { code }));
+
+  it('"Not now" takes the tokens out of the store and revokes the refresh token', async () => {
+    const code = await parkedSso();
+    expect(heldInMemory()).toContain('sso-refresh');
+    expect((await discardIt(code)).status).toBe(200);
+    expect(heldInMemory()).not.toContain('sso-refresh');
+    expect(heldInMemory()).not.toContain('sso-access');
+    expect(revoked).toEqual(['sso-refresh']);
+    expect((await redeemIt(code)).status).toBe(400);
+  });
+
+  it('a provider with no revocation endpoint: the store is still emptied', async () => {
+    discoverOAuth.mockResolvedValue({});
+    const code = await parkedSso();
+    expect((await discardIt(code)).status).toBe(200);
+    expect(heldInMemory()).not.toContain('sso-refresh');
+    expect(revoked).toEqual([]);
+  });
+
+  it('discards only the desktop\'s, and nothing twice', async () => {
+    const phone = await stashHandoff({ flow: 'password', server_url: SERVER, username: 'a', password: 'phone-secret' }, { challenge: CHALLENGE, state: 's' });
+    await discardIt(phone);
+    expect(heldInMemory()).toContain('phone-secret');
+    const code = await parkedSso();
+    await discardIt(code);
+    await discardIt(code);
+    expect(revoked).toEqual(['sso-refresh']);
+  });
+
+  it('a code no one knows gets nothing', async () => {
+    expect((await discardIt('nonsense')).status).toBe(400);
+  });
+
+  it('with nobody coming back, a timer wipes what was parked, at its real expiry', async () => {
+    vi.useFakeTimers();
+    await stashHandoff({ flow: 'desktop-password', server_url: SERVER, server_id: null, custom: false, username: 'a', password: 'timer-secret' }, { challenge: CHALLENGE, state: 's' });
+    await parkedSso();
+    expect(heldInMemory()).toContain('timer-secret');
+    vi.advanceTimersByTime(HANDOFF_TTL_MS + 2);
+    expect(heldInMemory()).not.toContain('timer-secret');
+    expect(heldInMemory()).toContain('sso-refresh');
+    vi.advanceTimersByTime(HANDOFF_CONFIRM_TTL_MS);
+    expect(heldInMemory()).not.toContain('sso-refresh');
+  });
+});
+
+describe('the two kinds of code stay apart', () => {
+  it('the phone\'s redeem gives away nothing of a desktop sign-in', async () => {
+    const code = await parkedCode();
+    const answer = await mobileRedeem(post('/api/auth/handoff/redeem', { code, code_verifier: VERIFIER }));
+    expect(answer.status).toBe(400);
+    const body = JSON.stringify(await answer.json());
+    expect(body).not.toContain('refresh');
+    expect(body).not.toContain('access');
+  });
+
+  it('the desktop redeem takes no phone code', async () => {
+    const code = await stashHandoff({ flow: 'password', server_url: SERVER, username: 'a', password: 'secret' }, { challenge: CHALLENGE, state: 's' });
+    const answer = await redeemIt(code);
+    expect(answer.status).toBe(400);
+    expect(JSON.stringify(await answer.json())).not.toContain('secret');
+  });
+});

lib/__tests__/fixtures/config.ts

@@ -32,6 +32,7 @@ export function createConfig(overrides: Partial<ConfigData> = {}): ConfigData {
     loginShowSubtitle: true,
     loginShowTotp: true,
     loginShowTokenLogin: false,
+    desktopBrowserSignIn: true,
     loginShowRememberMe: false,
     loginShowVersion: true,
     demoMode: false,

lib/__tests__/helpers/push-click.ts

@@ -5,7 +5,7 @@ import vm from 'node:vm';
 export async function pushClick(
   accountId: string,
   preview: (url: string) => Promise<unknown>,
-  options: { warm?: boolean; basePath?: string; legacy?: boolean; emailId?: string; noParamsSize?: boolean } = {},
+  options: { warm?: boolean; basePath?: string; legacy?: boolean; emailId?: string; noParamsSize?: boolean; onScreen?: string[] } = {},
 ): Promise<string> {
   const source = readFileSync(resolve('public/sw.js'), 'utf8');
   let notification: { data: unknown } | undefined;
@@ -33,7 +33,7 @@ export async function pushClick(
       },
       registration: {
         showNotification: async (_title: string, data: { data: unknown }) => { notification = data; },
-        getNotifications: async () => [],
+        getNotifications: async () => (options.onScreen?.length ? [{ data: { ids: options.onScreen } }] : []),
       },
     },
     caches: { open: async () => ({

lib/__tests__/oauth-discovery.test.ts

@@ -47,6 +47,14 @@ describe('oauth/discovery', () => {
     }
   });
 
+  it('keeps a registration endpoint the server names, for the desktop app, and only a string', async () => {
+    const answer = (extra: Record<string, unknown>) => ({ status: 200, ok: true, headers: new Headers(), json: async () => ({ ...VALID_METADATA, ...extra }) });
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue(answer({ registration_endpoint: 'https://auth.example.com/register' })));
+    expect((await discoverOAuth('https://a.example.com', { validateEndpoint }))?.registration_endpoint).toBe('https://auth.example.com/register');
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue(answer({ registration_endpoint: 7 })));
+    expect((await discoverOAuth('https://b.example.com', { validateEndpoint }))?.registration_endpoint).toBeUndefined();
+  });
+
   it('follows one redirect that stays on the same host', async () => {
     const redirect = { status: 301, ok: false, headers: new Headers({ location: '/auth/.well-known/openid-configuration' }), json: async () => ({}) };
     const document = { status: 200, ok: true, headers: new Headers(), json: async () => VALID_METADATA };

lib/__tests__/plugin-keystore-runtime.test.ts

@@ -20,10 +20,10 @@ function post(source: unknown, data: unknown): void {
 }
 
 interface KeystoreFacade {
-  list(): Promise<unknown>;
-  sign(id: string, digest: Uint8Array, scheme: unknown): Promise<Uint8Array>;
-  decrypt(id: string, data: Uint8Array, scheme: unknown): Promise<Uint8Array>;
-  agree(id: string, peer: Uint8Array): Promise<Uint8Array>;
+  list(options?: { quiet?: boolean }): Promise<unknown>;
+  sign(id: string, signedAttributes: Uint8Array, scheme: unknown): Promise<Uint8Array>;
+  decrypt(id: string, data: Uint8Array, scheme: unknown, options?: { quiet?: boolean }): Promise<Uint8Array>;
+  agree(id: string, peer: Uint8Array, options?: { quiet?: boolean }): Promise<Uint8Array>;
 }
 
 describe('api.keystore in the sandbox', () => {
@@ -104,6 +104,12 @@ describe('api.keystore in the sandbox', () => {
     const signing = api.sign('the-id', digest, scheme);
     const sent = requests().at(-1)!;
     expect(sent.args).toEqual(['the-id', digest, scheme]);
+    void api.list({ quiet: true }).catch(() => {});
+    expect(requests().at(-1)!.args).toEqual([{ quiet: true }]);
+    void api.decrypt('the-id', new Uint8Array(4), { scheme: 'rsa-pkcs1' }, { quiet: true }).catch(() => {});
+    expect(requests().at(-1)!.args).toEqual(['the-id', new Uint8Array(4), { scheme: 'rsa-pkcs1' }, { quiet: true }]);
+    void api.agree('the-id', new Uint8Array(4), { quiet: true }).catch(() => {});
+    expect(requests().at(-1)!.args).toEqual(['the-id', new Uint8Array(4), { quiet: true }]);
     post(hostWindow, { type: 'api-response', id: sent.id, ok: false, error: 'keystore:cancelled' });
     await expect(signing).rejects.toThrow(/^keystore:cancelled$/);
 

lib/__tests__/plugin-keystore.test.ts

@@ -12,7 +12,9 @@ import { dispatchApiCall, PERM_PER_METHOD } from '../plugin-sandbox/host-api';
 import { hasDialogFor, holdForUser, whenNoDialogFor } from '../plugin-sandbox/host-dialog';
 import { snapshotHostFeatures } from '../plugin-sandbox/host-features';
 import { keystoreFeature } from '../plugin-sandbox/host-api-keystore';
-import { HIGH_RISK_PERMISSIONS } from '../plugin-sandbox/permission-text';
+import { DEFAULT_POLICY_SNAPSHOT } from '../desktop/policy-schema';
+import { declaredPermissions, HIGH_RISK_PERMISSIONS } from '../plugin-sandbox/permission-text';
+import { pluginHasPermission } from '../plugin-sandbox/permissions';
 
 vi.mock('@/stores/toast-store', () => ({
   toast: { success: vi.fn(), error: vi.fn(), info: vi.fn(), warning: vi.fn() },
@@ -28,6 +30,7 @@ function plugin(overrides: Partial<InstalledPlugin> = {}): InstalledPlugin {
     type: 'hook',
     tier: 'privileged',
     managed: true,
+    grantedPermissions: ['keystore'],
     permissions: ['crypto:full', 'keystore'],
     entrypoint: 'index.js',
     enabled: true,
@@ -37,7 +40,7 @@ function plugin(overrides: Partial<InstalledPlugin> = {}): InstalledPlugin {
   };
 }
 
-const DIGEST = new Uint8Array(32).fill(7);
+const ATTRIBUTES = new Uint8Array(200).fill(7);
 const SIGN = { scheme: 'rsa-pkcs1', hash: 'SHA-256' };
 
 function fakeBridge() {
@@ -66,7 +69,7 @@ describe('who may call it', () => {
 
   const METHODS: Array<[string, unknown[]]> = [
     ['keystore.list', []],
-    ['keystore.sign', ['id', DIGEST, SIGN]],
+    ['keystore.sign', ['id', ATTRIBUTES, SIGN]],
     ['keystore.decrypt', ['id', new Uint8Array(256), { scheme: 'rsa-pkcs1' }]],
     ['keystore.agree', ['id', new Uint8Array(91)]],
   ];
@@ -91,9 +94,17 @@ describe('who may call it', () => {
     await expect(dispatchApiCall(notGiven, 'keystore.list', [], { privileged: true })).rejects.toThrow(/lacks permission "keystore"/);
   });
 
+  it('is refused for a plugin an admin installed until this user says yes too', async () => {
+    const adminsOnly = plugin({ managed: true, grantedPermissions: [] });
+    await expect(dispatchApiCall(adminsOnly, 'keystore.list', [], { privileged: true })).rejects.toThrow(/lacks permission "keystore"/);
+    expect(keystoreFeature(adminsOnly)).toEqual({});
+    expect(pluginHasPermission(adminsOnly, 'crypto:full'), 'its other permissions are the admin\'s call').toBe(true);
+    expect(pluginHasPermission(plugin({ managed: true }), 'keystore')).toBe(true);
+  });
+
   it('passes for a privileged plugin holding it', async () => {
-    await expect(dispatchApiCall(plugin(), 'keystore.sign', ['id', DIGEST, SIGN], { privileged: true })).resolves.toEqual(new Uint8Array([1, 2, 3]));
-    expect(bridge.sign).toHaveBeenCalledWith('id', DIGEST, SIGN);
+    await expect(dispatchApiCall(plugin(), 'keystore.sign', ['id', ATTRIBUTES, SIGN], { privileged: true })).resolves.toEqual(new Uint8Array([1, 2, 3]));
+    expect(bridge.sign).toHaveBeenCalledWith('id', ATTRIBUTES, SIGN);
     await expect(dispatchApiCall(plugin(), 'keystore.list', [], { privileged: true })).resolves.toEqual([]);
     await expect(dispatchApiCall(plugin(), 'keystore.decrypt', ['id', new Uint8Array(256), { scheme: 'rsa-pkcs1' }], { privileged: true })).resolves.toEqual(new Uint8Array([4, 5, 6]));
     await expect(dispatchApiCall(plugin(), 'keystore.agree', ['id', new Uint8Array(91)], { privileged: true })).resolves.toEqual(new Uint8Array([7, 8, 9]));
@@ -122,17 +133,17 @@ describe('what gets through to the shell', () => {
   const call = (method: string, ...args: unknown[]) => dispatchApiCall(plugin(), method, args, { privileged: true });
 
   it.each<[string, unknown[]]>([
-    ['an id that is no string', [42, DIGEST, SIGN]],
-    ['an empty id', ['', DIGEST, SIGN]],
-    ['a long id', ['x'.repeat(65), DIGEST, SIGN]],
-    ['a digest that is no bytes', ['id', 'not bytes', SIGN]],
-    ['an empty digest', ['id', new Uint8Array(0), SIGN]],
-    ['a digest longer than any hash', ['id', new Uint8Array(65), SIGN]],
-    ['no scheme', ['id', DIGEST, null]],
-    ['a list as scheme', ['id', DIGEST, []]],
-    ['an unknown scheme', ['id', DIGEST, { scheme: 'raw', hash: 'SHA-256' }]],
-    ['an unknown hash', ['id', DIGEST, { scheme: 'rsa-pkcs1', hash: 'MD5' }]],
-    ['no hash', ['id', DIGEST, { scheme: 'rsa-pkcs1' }]],
+    ['an id that is no string', [42, ATTRIBUTES, SIGN]],
+    ['an empty id', ['', ATTRIBUTES, SIGN]],
+    ['a long id', ['x'.repeat(65), ATTRIBUTES, SIGN]],
+    ['attributes that are no bytes', ['id', 'not bytes', SIGN]],
+    ['empty attributes', ['id', new Uint8Array(0), SIGN]],
+    ['attributes past what S/MIME could need', ['id', new Uint8Array(4097), SIGN]],
+    ['no scheme', ['id', ATTRIBUTES, null]],
+    ['a list as scheme', ['id', ATTRIBUTES, []]],
+    ['an unknown scheme', ['id', ATTRIBUTES, { scheme: 'raw', hash: 'SHA-256' }]],
+    ['an unknown hash', ['id', ATTRIBUTES, { scheme: 'rsa-pkcs1', hash: 'MD5' }]],
+    ['no hash', ['id', ATTRIBUTES, { scheme: 'rsa-pkcs1' }]],
   ])('sign refuses %s', async (_name, args) => {
     await expect(call('keystore.sign', ...args)).rejects.toThrow('keystore:invalid');
     expect(bridge.sign).not.toHaveBeenCalled();
@@ -148,9 +159,9 @@ describe('what gets through to the shell', () => {
   it('passes only the fields it knows', async () => {
     const data = new Uint8Array(256);
     await call('keystore.decrypt', 'id', data, { scheme: 'rsa-oaep', hash: 'SHA-1', extra: 'x', label: new Uint8Array(0) });
-    expect(bridge.decrypt).toHaveBeenCalledWith('id', data, { scheme: 'rsa-oaep', hash: 'SHA-1' });
-    await call('keystore.sign', 'id', DIGEST, { ...SIGN, extra: 'x' });
-    expect(bridge.sign).toHaveBeenCalledWith('id', DIGEST, SIGN);
+    expect(bridge.decrypt).toHaveBeenCalledWith('id', data, { scheme: 'rsa-oaep', hash: 'SHA-1' }, {});
+    await call('keystore.sign', 'id', ATTRIBUTES, { ...SIGN, extra: 'x' });
+    expect(bridge.sign).toHaveBeenCalledWith('id', ATTRIBUTES, SIGN);
   });
 
   it('agree refuses an oversized peer key', async () => {
@@ -160,12 +171,81 @@ describe('what gets through to the shell', () => {
 
   it.each(['cancelled', 'not-found', 'unsupported', 'locked', 'failed'])('hands keystore:%s to the frame as the message', async (code) => {
     bridge.sign.mockRejectedValueOnce(new Error(`Error invoking remote method: Error: keystore:${code}`));
-    await expect(call('keystore.sign', 'id', DIGEST, SIGN)).rejects.toThrow(new RegExp(`^keystore:${code}$`));
+    await expect(call('keystore.sign', 'id', ATTRIBUTES, SIGN)).rejects.toThrow(new RegExp(`^keystore:${code}$`));
   });
 
   it('turns anything else into keystore:failed, not a stack or a path', async () => {
     bridge.sign.mockRejectedValueOnce(new Error('C:\\secret\\path blew up'));
-    await expect(call('keystore.sign', 'id', DIGEST, SIGN)).rejects.toThrow(/^keystore:failed$/);
+    await expect(call('keystore.sign', 'id', ATTRIBUTES, SIGN)).rejects.toThrow(/^keystore:failed$/);
+  });
+});
+
+describe('a call that must not ask', () => {
+  const call = (method: string, ...args: unknown[]) => dispatchApiCall(plugin(), method, args, { privileged: true });
+  let bridge: ReturnType<typeof fakeBridge>;
+  beforeEach(() => {
+    bridge = fakeBridge();
+    (window as { bulwarkDesktop?: unknown }).bulwarkDesktop = { version: 1, keystore: bridge };
+  });
+  afterEach(() => { delete (window as { bulwarkDesktop?: unknown }).bulwarkDesktop; });
+
+  it('passes quiet to the shell, and only quiet', async () => {
+    await call('keystore.list', { quiet: true, other: 1 });
+    expect(bridge.list).toHaveBeenCalledWith({ quiet: true });
+    await call('keystore.decrypt', 'id', new Uint8Array(256), { scheme: 'rsa-pkcs1' }, { quiet: true });
+    expect(bridge.decrypt).toHaveBeenCalledWith('id', new Uint8Array(256), { scheme: 'rsa-pkcs1' }, { quiet: true });
+    await call('keystore.agree', 'id', new Uint8Array(91), { quiet: true });
+    expect(bridge.agree).toHaveBeenCalledWith('id', new Uint8Array(91), { quiet: true });
+  });
+
+  it('a call without it, or with something else, can ask', async () => {
+    await call('keystore.list');
+    expect(bridge.list).toHaveBeenLastCalledWith({});
+    await call('keystore.list', { quiet: 'yes' });
+    expect(bridge.list).toHaveBeenLastCalledWith({});
+  });
+
+  it('the shell\'s answer comes through as its code', async () => {
+    bridge.list.mockRejectedValueOnce(new Error('keystore:ask-first'));
+    await expect(call('keystore.list', { quiet: true })).rejects.toThrow(/^keystore:ask-first$/);
+  });
+});
+
+describe('policy', () => {
+  const withPolicy = (values: Record<string, { value: unknown }>) => {
+    (window as { bulwarkDesktop?: unknown }).bulwarkDesktop = {
+      version: 1,
+      keystore: fakeBridge(),
+      policy: { get: () => ({ ...DEFAULT_POLICY_SNAPSHOT, ...values }) },
+    };
+  };
+  afterEach(() => { delete (window as { bulwarkDesktop?: unknown }).bulwarkDesktop; });
+
+  it.each([
+    ['KeystoreEnabled off', { KeystoreEnabled: { value: false } }],
+    ['PluginsMode off', { PluginsMode: { value: 'off' } }],
+  ])('%s takes the flag away and refuses the call', async (_name, values) => {
+    withPolicy(values);
+    expect(keystoreFeature(plugin())).toEqual({});
+    await expect(dispatchApiCall(plugin(), 'keystore.list', [], { privileged: true })).rejects.toThrow('keystore:unsupported');
+  });
+
+  it('leaves it alone otherwise', () => {
+    withPolicy({});
+    expect(keystoreFeature(plugin())).toEqual({ keystore: true });
+  });
+});
+
+describe('what a manifest declares', () => {
+  it('counts optional permissions, as the install does', () => {
+    expect(declaredPermissions({ tier: 'privileged', permissions: ['crypto:full', 'email:read'], optionalPermissions: ['keystore', 'email:read'] }))
+      .toEqual(['crypto:full', 'email:read', 'keystore']);
+  });
+
+  it('leaves out what an untrusted plugin can not get, what this version does not know, and junk', () => {
+    expect(declaredPermissions({ permissions: ['email:read'], optionalPermissions: ['keystore', 'from:the-future', 7] })).toEqual(['email:read']);
+    expect(declaredPermissions(null)).toEqual([]);
+    expect(declaredPermissions({ permissions: 'email:read' })).toEqual([]);
   });
 });
 
@@ -285,7 +365,7 @@ describe('a keystore call and the hook timer', () => {
     const bridge = fakeBridge();
     bridge.sign.mockRejectedValueOnce(new Error('keystore:cancelled'));
     installBridge(bridge);
-    await expect(dispatchApiCall(plugin(), 'keystore.sign', ['id', DIGEST, SIGN], { privileged: true })).rejects.toThrow('keystore:cancelled');
+    await expect(dispatchApiCall(plugin(), 'keystore.sign', ['id', ATTRIBUTES, SIGN], { privileged: true })).rejects.toThrow('keystore:cancelled');
     expect(hasDialogFor(ID)).toBe(false);
 
     await expect(dispatchApiCall(plugin(), 'keystore.sign', [42], { privileged: true })).rejects.toThrow('keystore:invalid');

lib/__tests__/plugin-store.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import type { InstalledPlugin } from '@/lib/plugin-types';
 
 // We test the raw store by directly invoking Zustand
@@ -64,6 +64,7 @@ import { usePluginStore, PLUGIN_PERSIST_DELAY_MS } from '@/stores/plugin-store';
 import { pluginStorage } from '@/lib/plugin-storage';
 import { deactivatePlugin, forgetSlotOffers } from '@/lib/plugin-loader';
 import { purgeSignedOutData } from '@/lib/sign-out-cleanup';
+import { head as consentHead, resolveHead as resolveConsent, subscribe as subscribeConsent } from '@/lib/plugin-sandbox/consent';
 
 function resetStore() {
   usePluginStore.setState({
@@ -561,3 +562,128 @@ describe('saving the plugin list', () => {
     }
   });
 });
+
+describe('a plugin an admin installed, and the certificates on this computer', () => {
+  const serverSmime = {
+    id: 'smime', name: 'S/MIME', version: '1.5.0', author: 'a', description: '', type: 'hook', tier: 'privileged',
+    permissions: ['crypto:full', 'keystore'], entrypoint: 'index.js', forceEnabled: true, bundleHash: 'h',
+  };
+  const local = (overrides: Partial<InstalledPlugin> = {}) => mockPlugin({
+    id: 'smime', name: 'S/MIME', version: '1.5.0', tier: 'privileged', managed: true, enabled: true, status: 'enabled', adminApproved: true, bundleHash: 'h',
+    permissions: ['crypto:full', 'keystore'], ...overrides,
+  });
+  const answerConsent = (answer: boolean) => {
+    const seen: string[][] = [];
+    const stop = subscribeConsent(() => {
+      const request = consentHead();
+      if (!request) return;
+      seen.push(request.permissions);
+      queueMicrotask(() => resolveConsent(answer));
+    });
+    return { seen, stop };
+  };
+  const settle = () => new Promise((resolve) => setTimeout(resolve, 10));
+
+  beforeEach(() => {
+    localStorage.clear();
+    resetStore();
+    (window as { bulwarkDesktop?: unknown }).bulwarkDesktop = { version: 1, keystore: {} };
+    vi.mocked(pluginStorage.codeIds).mockResolvedValue(['smime']);
+    mocks.apiFetch.mockImplementation(async (url: string) => (String(url).startsWith('/api/plugins')
+      ? new Response(JSON.stringify({ plugins: [serverSmime], themes: [] }))
+      : new Response(JSON.stringify({}))));
+  });
+  afterEach(() => { delete (window as { bulwarkDesktop?: unknown }).bulwarkDesktop; });
+
+  it('asks this person, for that alone, and keeps a yes', async () => {
+    usePluginStore.setState({ plugins: [local()] });
+    const { seen, stop } = answerConsent(true);
+    await usePluginStore.getState().initializePlugins();
+    await settle();
+    stop();
+    expect(seen).toEqual([['keystore']]);
+    expect(usePluginStore.getState().plugins[0].grantedPermissions).toEqual(['keystore']);
+  });
+
+  it('asks when an update adds it to a plugin that had none', async () => {
+    usePluginStore.setState({ plugins: [local({ permissions: ['crypto:full'], version: '1.4.0' })] });
+    vi.mocked(mocks.downloadManagedBundle).mockResolvedValue('code');
+    const { seen, stop } = answerConsent(true);
+    await usePluginStore.getState().initializePlugins();
+    await settle();
+    stop();
+    expect(seen).toEqual([['keystore']]);
+  });
+
+  it('runs it either way, and a no is not asked again', async () => {
+    const { loadPlugin } = await import('@/lib/plugin-loader');
+    vi.mocked(loadPlugin).mockClear();
+    usePluginStore.setState({ plugins: [local()] });
+    const first = answerConsent(false);
+    await usePluginStore.getState().initializePlugins();
+    await settle();
+    first.stop();
+    expect(first.seen).toHaveLength(1);
+    expect(loadPlugin).toHaveBeenCalledTimes(1);
+    expect(usePluginStore.getState().plugins[0].grantedPermissions ?? []).not.toContain('keystore');
+    usePluginStore.setState({ initialized: false });
+    const second = answerConsent(true);
+    await usePluginStore.getState().initializePlugins();
+    await settle();
+    second.stop();
+    expect(second.seen).toEqual([]);
+  });
+
+  it('starts the plugin again after a yes, so it sees what it was given', async () => {
+    const { loadPlugin } = await import('@/lib/plugin-loader');
+    vi.mocked(loadPlugin).mockClear();
+    vi.mocked(deactivatePlugin).mockClear();
+    usePluginStore.setState({ plugins: [local()] });
+    const { stop } = answerConsent(true);
+    await usePluginStore.getState().initializePlugins();
+    await settle();
+    stop();
+    expect(deactivatePlugin).toHaveBeenCalledWith('smime');
+    expect(vi.mocked(loadPlugin).mock.lastCall?.[0]).toMatchObject({ grantedPermissions: ['keystore'] });
+  });
+
+  it('asks nothing in a browser, where there is no such thing', async () => {
+    delete (window as { bulwarkDesktop?: unknown }).bulwarkDesktop;
+    usePluginStore.setState({ plugins: [local()] });
+    const { seen, stop } = answerConsent(true);
+    await usePluginStore.getState().initializePlugins();
+    await settle();
+    stop();
+    expect(seen).toEqual([]);
+  });
+
+  it('asks nothing for a plugin that does not want it', async () => {
+    mocks.apiFetch.mockImplementation(async (url: string) => (String(url).startsWith('/api/plugins')
+      ? new Response(JSON.stringify({ plugins: [{ ...serverSmime, permissions: ['crypto:full'] }], themes: [] }))
+      : new Response(JSON.stringify({}))));
+    usePluginStore.setState({ plugins: [local({ permissions: ['crypto:full'] })] });
+    const { seen, stop } = answerConsent(true);
+    await usePluginStore.getState().initializePlugins();
+    await settle();
+    stop();
+    expect(seen).toEqual([]);
+  });
+
+  it('asks when someone turns it on themselves, and its other permissions stay the admin\'s call', async () => {
+    usePluginStore.setState({ plugins: [local({ enabled: false, status: 'installed', forceEnabled: false })] });
+    const { seen, stop } = answerConsent(true);
+    await usePluginStore.getState().enablePlugin('smime');
+    stop();
+    expect(seen).toEqual([['keystore']]);
+    expect(usePluginStore.getState().plugins[0]).toMatchObject({ enabled: true, grantedPermissions: ['keystore'] });
+  });
+
+  it('forgets the answer once everyone has signed out: the next person gets asked', async () => {
+    usePluginStore.setState({ plugins: [local({ grantedPermissions: ['keystore'], declinedPermissions: ['keystore'] })] });
+    await purgeSignedOutData();
+    const [plugin] = usePluginStore.getState().plugins;
+    expect(plugin.grantedPermissions ?? []).toEqual([]);
+    expect(plugin.declinedPermissions ?? []).toEqual([]);
+    expect(plugin.managed).toBe(true);
+  });
+});

lib/__tests__/push-auth-context.test.ts

@@ -0,0 +1,88 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+// The context cookie lasts as long as the browser session. With every window
+// closed and the browser started again by a push, only the remembered session
+// is left, and the worker has to make do with that or show "New mail".
+vi.mock('@/lib/logger', () => ({ logger: { warn: vi.fn(), error: vi.fn(), debug: vi.fn(), info: vi.fn() } }));
+const maxHours = vi.hoisted(() => ({ value: 0 }));
+vi.mock('@/lib/auth/session-age', () => ({
+  isPastMaxAge: (signedInAt: number, hours: number) => hours > 0 && Date.now() - signedInAt > hours * 3600_000,
+  limitsEnforcedSince: async () => Date.now(),
+  maxSessionHoursFor: async () => maxHours.value,
+}));
+const impersonation = vi.hoisted(() => ({ master: null as string | null }));
+const policy = vi.hoisted(() => ({ value: {} as Record<string, unknown> }));
+vi.mock('@/lib/admin/config-manager', () => ({
+  configManager: { ensureLoaded: async () => {}, getPolicy: () => policy.value },
+}));
+vi.mock('@/lib/impersonation/master-config', () => ({
+  readImpersonationConfig: () => (impersonation.master ? { masterPassword: impersonation.master } : null),
+}));
+
+import { encryptSession } from '@/lib/auth/crypto';
+import { sessionCookieName } from '@/lib/auth/session-cookie';
+import { readPushAuthContext } from '@/lib/stalwart/push-auth-context';
+import { stalwartAuthContextCookieName } from '@/lib/stalwart/auth-context';
+import { encryptPayload } from '@/lib/auth/crypto';
+
+function store(cookies: Record<string, string>) {
+  return { get: (name: string) => (name in cookies ? { value: cookies[name] } : undefined) } as never;
+}
+
+const remembered = (signedInAt = Date.now(), password = 'pw') => encryptSession('https://mail.example.org', 'me@example.org', password, signedInAt);
+
+beforeEach(() => {
+  process.env.SESSION_SECRET = 'a-test-secret-that-is-long-enough-for-this-0123456789';
+  maxHours.value = 0;
+  impersonation.master = null;
+  policy.value = {};
+});
+
+describe('readPushAuthContext', () => {
+  it('prefers the context cookie', async () => {
+    const context = encryptPayload({ serverUrl: 'https://ctx.example.org', username: 'ctx@example.org', authHeader: 'Bearer t' }, 'session-context');
+    const found = await readPushAuthContext(store({ [stalwartAuthContextCookieName(0)]: context, [sessionCookieName(0)]: remembered() }), 0);
+    expect(found?.username).toBe('ctx@example.org');
+  });
+
+  it('falls back to the remembered session', async () => {
+    const found = await readPushAuthContext(store({ [sessionCookieName(1)]: remembered() }), 1);
+    expect(found).toMatchObject({ serverUrl: 'https://mail.example.org', username: 'me@example.org' });
+    expect(found?.authHeader).toMatch(/^Basic /);
+  });
+
+  it('finds nothing in another slot, or without either cookie', async () => {
+    expect(await readPushAuthContext(store({ [sessionCookieName(1)]: remembered() }), 0)).toBeNull();
+    expect(await readPushAuthContext(store({}), 0)).toBeNull();
+  });
+
+  it('refuses a session past the organisation\'s maximum length', async () => {
+    maxHours.value = 1;
+    expect(await readPushAuthContext(store({ [sessionCookieName(0)]: remembered(Date.now() - 2 * 3600_000) }), 0)).toBeNull();
+    expect(await readPushAuthContext(store({ [sessionCookieName(0)]: remembered() }), 0)).not.toBeNull();
+  });
+
+  it('stays out when the organisation has limits only a page enforces', async () => {
+    const cookies = store({ [sessionCookieName(0)]: remembered() });
+    policy.value = { organisation: { session: { idleMinutes: 30 } } };
+    expect(await readPushAuthContext(cookies, 0)).toBeNull();
+    policy.value = { scopes: [{ match: { domains: ['example.org'] }, policy: { organisation: { session: { idleMinutes: 5 } } } }] };
+    expect(await readPushAuthContext(cookies, 0)).toBeNull();
+    policy.value = { scopes: [{ match: { groups: ['staff@example.org'] }, policy: { organisation: { session: { maxHours: 8 } } } }] };
+    expect(await readPushAuthContext(cookies, 0)).toBeNull();
+    // A maximum by domain the server checks itself, above.
+    policy.value = { scopes: [{ match: { domains: ['example.org'] }, policy: { organisation: { session: { maxHours: 8 } } } }] };
+    expect(await readPushAuthContext(cookies, 0)).not.toBeNull();
+  });
+
+  it('stays out for a bare user name, which policies for a domain cannot match', async () => {
+    const token = encryptSession('https://mail.example.org', 'john', 'pw', Date.now());
+    expect(await readPushAuthContext(store({ [sessionCookieName(0)]: token }), 0)).toBeNull();
+  });
+
+  it('refuses garbage and a cookie holding the impersonation master password', async () => {
+    expect(await readPushAuthContext(store({ [sessionCookieName(0)]: 'garbage' }), 0)).toBeNull();
+    impersonation.master = 'master-secret';
+    expect(await readPushAuthContext(store({ [sessionCookieName(0)]: remembered(Date.now(), 'master-secret') }), 0)).toBeNull();
+  });
+});

lib/__tests__/push-preferences.test.ts

@@ -3,6 +3,25 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 // The page mirrors the notification sound setting into the service worker's
 // Cache store, where sw.js reads it before showing a push notification (#1289).
 
+describe('writeLoginQuiet', () => {
+  it('keeps one answer per login', async () => {
+    const stored = new Map<string, string>();
+    vi.stubGlobal('caches', {
+      open: async () => ({
+        match: async (key: string) => (stored.has(key) ? new Response(stored.get(key)) : undefined),
+        put: async (key: string, res: Response) => { stored.set(key, await res.text()); },
+      }),
+    });
+    const { writeLoginQuiet } = await import('../push-preferences');
+    await writeLoginQuiet('a@example.org', true);
+    await writeLoginQuiet('b@example.org', false);
+    await writeLoginQuiet('a@example.org', true);
+    const value = JSON.parse(stored.get(`${window.location.origin}/__push-state/quiet-logins`) ?? 'null');
+    expect(value).toEqual({ 'a@example.org': true, 'b@example.org': false });
+    vi.unstubAllGlobals();
+  });
+});
+
 describe('writePushPreferences', () => {
   const put = vi.fn();
 
@@ -65,7 +84,7 @@ describe('settings store push preference mirror', () => {
     useSettingsStore.getState().updateSetting('emailNotificationsEnabled', true);
     expect(writePushPreferences).not.toHaveBeenCalled();
 
-    // Email notifications off means no sound for push either.
+    // Email notifications off means no notification, so no sound either.
     useSettingsStore.getState().updateSetting('emailNotificationSound', true);
     useSettingsStore.getState().updateSetting('emailNotificationsEnabled', false);
     expect(writePushPreferences).toHaveBeenLastCalledWith({ sound: false });

lib/__tests__/push-preview-route-ambiguous.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { beforeAll, describe, it, expect, vi, beforeEach } from 'vitest';
 
 // The push names only the JMAP account id, and ids repeat: Stalwart numbers
 // accounts alike on every install, and a group account is listed in the
@@ -26,13 +26,18 @@ vi.mock('@/lib/account-utils', () => ({ MAX_ACCOUNT_SLOTS: 3 }));
 
 // slot 0: alice on one.example, slot 1: bob on two.example, slot 2: carol on one.example
 const LOGINS = [
-  { serverUrl: 'https://one.example', authHeader: 'Basic alice' },
-  { serverUrl: 'https://two.example', authHeader: 'Basic bob' },
-  { serverUrl: 'https://one.example', authHeader: 'Basic carol' },
+  { serverUrl: 'https://one.example', authHeader: 'Basic alice', username: 'alice@one.example' },
+  { serverUrl: 'https://two.example', authHeader: 'Basic bob', username: 'bob@two.example' },
+  { serverUrl: 'https://one.example', authHeader: 'Basic carol', username: 'carol@one.example' },
 ];
+const ORIGINAL_LOGINS = [...LOGINS];
 vi.mock('@/lib/stalwart/auth-context', () => ({
   readStalwartAuthContextFromStore: (_store: unknown, slot: number) => LOGINS[slot] ?? null,
 }));
+const remembered = vi.hoisted(() => ({ value: null as null | { serverUrl: string; authHeader: string; username: string } }));
+vi.mock('@/lib/stalwart/push-auth-context', () => ({
+  readPushAuthContext: async (_store: unknown, slot: number) => LOGINS[slot] ?? (slot === 0 ? remembered.value : null),
+}));
 
 vi.mock('@/lib/stalwart/credentials', () => ({
   getStalwartCredentials: vi.fn(),
@@ -73,10 +78,10 @@ vi.mock('@/lib/admin/config-manager', async () => {
   return { configManager: { ensureLoaded: async () => {}, getPolicy: () => DEFAULT_POLICY } };
 });
 
-async function callRoute(accountId: string) {
+async function callRoute(accountId: string, login?: string) {
   const { GET } = await import('@/app/api/push/preview/route');
   const request = {
-    nextUrl: { searchParams: { get: (k: string) => (k === 'accountId' ? accountId : k === 'emailId' ? 'e1' : null) } },
+    nextUrl: { searchParams: { get: (k: string) => (k === 'accountId' ? accountId : k === 'emailId' ? 'e1' : k === 'login' ? login ?? null : null) } },
     headers: new Headers(),
   };
   const res = (await GET(request as unknown as Parameters<typeof GET>[0])) as unknown as {
@@ -88,11 +93,86 @@ async function callRoute(accountId: string) {
 
 const mailCalls = () => fetchJmapServer.mock.calls.filter(([url]) => !url.endsWith('/.well-known/jmap'));
 
+// The route's first import can take longer than a test's limit on a busy machine,
+// and a test that times out keeps running into the next one's state.
+beforeAll(async () => {
+  await import('@/app/api/push/preview/route');
+}, 60_000);
+
+describe('push preview after the browser was closed', () => {
+  it('reads the login from the remembered session when the context cookie is gone', async () => {
+    remembered.value = { serverUrl: 'https://one.example', authHeader: 'Basic remembered', username: 'alice@one.example' };
+    LOGINS.length = 0;
+    try {
+      SESSIONS = { 'Basic remembered': session('https://one.example', 'a') };
+      const { status, body } = await callRoute('a');
+      expect(status).toBe(200);
+      expect((body.email as { subject: string }).subject).toBe('mail of Basic remembered');
+    } finally {
+      remembered.value = null;
+      LOGINS.push(...ORIGINAL_LOGINS);
+    }
+  });
+});
+
 describe('push preview when the account id is in more than one login', () => {
   beforeEach(() => {
     fetchJmapServer.mockClear();
   });
 
+  it('does not go by the name when two servers use the same id: those logins share one relay record', async () => {
+    SESSIONS = {
+      'Basic alice': session('https://one.example', 'a'),
+      'Basic bob': session('https://two.example', 'z'),
+      'Basic carol': session('https://one.example', 'z'),
+    };
+    const { status, body } = await callRoute('z', 'BOB@two.example');
+    expect(status).toBe(409);
+    expect(body.slot).toBeUndefined();
+  });
+
+  it('does not answer for another login when the one the push names is gone', async () => {
+    SESSIONS = {
+      'Basic alice': session('https://one.example', 'a'),
+      'Basic bob': session('https://two.example', 'z'),
+      'Basic carol': session('https://one.example', 'c'),
+    };
+    const { status } = await callRoute('z', 'somebody-gone@two.example');
+    expect(status).toBe(409);
+  });
+
+  it('takes the one login with the account when the push names it', async () => {
+    SESSIONS = {
+      'Basic alice': session('https://one.example', 'a'),
+      'Basic bob': session('https://two.example', 'z'),
+      'Basic carol': session('https://one.example', 'c'),
+    };
+    const { status, body } = await callRoute('z', 'bob@two.example');
+    expect(status).toBe(200);
+    expect(body.slot).toBe(1);
+  });
+
+  it('takes the login the push names for a group two logins belong to', async () => {
+    SESSIONS = {
+      'Basic alice': session('https://one.example', 'a', ['team']),
+      'Basic bob': session('https://two.example', 'b'),
+      'Basic carol': session('https://one.example', 'c', ['team']),
+    };
+    const { status, body } = await callRoute('team', 'carol@one.example');
+    expect(status).toBe(200);
+    expect(body.slot).toBe(2);
+  });
+
+  it('does not take a login that does not have the account', async () => {
+    SESSIONS = {
+      'Basic alice': session('https://one.example', 'a', ['team']),
+      'Basic bob': session('https://two.example', 'b'),
+      'Basic carol': session('https://one.example', 'c', ['team']),
+    };
+    const { status } = await callRoute('team', 'bob@two.example');
+    expect(status).toBe(409);
+  });
+
   it('shows no preview and names no login when two servers use the same id', async () => {
     SESSIONS = {
       'Basic alice': session('https://one.example', 'a'),

lib/__tests__/push-relay-registrations.test.ts

@@ -0,0 +1,40 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { forgetRelayRegistration, keepRelayRegistration, relayRegistrationsKey } from '@/lib/pwa-notify/worker-state';
+
+const store = new Map<string, string>();
+
+beforeEach(() => {
+  store.clear();
+  vi.stubGlobal('caches', {
+    open: async () => ({
+      match: async (key: string) => (store.has(key) ? new Response(store.get(key)) : undefined),
+      put: async (key: string, res: Response) => { store.set(key, await res.text()); },
+    }),
+  });
+});
+
+const stored = () => JSON.parse(store.get(relayRegistrationsKey(window.location.origin)) ?? 'null');
+
+describe('what the worker keeps to re-register without a tab', () => {
+  it('keeps one entry per account and the key', async () => {
+    await keepRelayRegistration('a', { relay: 'https://r', subscriptionId: 'd1', accountLabel: 'a@x' }, 'KEY');
+    await keepRelayRegistration('b', { relay: 'https://r', subscriptionId: 'd2' }, 'KEY');
+    expect(stored()).toEqual({
+      applicationServerKey: 'KEY',
+      entries: { a: { relay: 'https://r', subscriptionId: 'd1', accountLabel: 'a@x' }, b: { relay: 'https://r', subscriptionId: 'd2' } },
+    });
+  });
+
+  it('forgets an account, and leaves the others', async () => {
+    await keepRelayRegistration('a', { relay: 'https://r', subscriptionId: 'd1' }, 'KEY');
+    await keepRelayRegistration('b', { relay: 'https://r', subscriptionId: 'd2' }, 'KEY');
+    await forgetRelayRegistration('a');
+    expect(Object.keys(stored().entries)).toEqual(['b']);
+  });
+
+  it('stays out of the way without a Cache API', async () => {
+    vi.stubGlobal('caches', undefined);
+    await expect(keepRelayRegistration('a', { relay: 'https://r', subscriptionId: 'd1' }, 'KEY')).resolves.toBeUndefined();
+    await expect(forgetRelayRegistration('a')).resolves.toBeUndefined();
+  });
+});

lib/__tests__/shared-handoff-store.test.ts

@@ -109,3 +109,43 @@ describe('mobile hand-off with a shared store', () => {
     expect(await (await replica()).redeemHandoff(code, VERIFIER, T0 + 2)).toMatchObject({ ok: true });
   });
 });
+
+describe('what a shared store holds after a sign-in stops being any use', () => {
+  const key = (code: string) => 'handoff:' + createHash('sha256').update(code).digest('hex');
+  const DESKTOP = { flow: 'desktop-tokens' as const, server_url: 'https://mail.example.org', server_id: null, custom: false, access_token: 'a', refresh_token: 'r', expires_in: 60, signed_in_at: 1 };
+
+  it('a record with a sign-in in it is gone from the store at its real expiry, and a late code is still told so', async () => {
+    vi.useFakeTimers({ toFake: ['Date'] });
+    vi.setSystemTime(T0);
+    const { stashHandoff, redeemHandoff, HANDOFF_TTL_MS } = await replica();
+    const code = await stashHandoff(PASSWORD_BUNDLE, { challenge: CHALLENGE, state: 's' }, T0);
+    expect(await getStore().kv.get(key(code))).not.toBeNull();
+    vi.setSystemTime(T0 + HANDOFF_TTL_MS + 1);
+    expect(await getStore().kv.get(key(code))).toBeNull();
+    expect(await redeemHandoff(code, VERIFIER, T0 + HANDOFF_TTL_MS + 1)).toEqual({ ok: false, reason: 'expired' });
+    vi.useRealTimers();
+  });
+
+  it('a confirmed code stays no longer than its 60 seconds', async () => {
+    vi.useFakeTimers({ toFake: ['Date'] });
+    vi.setSystemTime(T0);
+    const { stashHandoff, confirmHandoff, HANDOFF_TTL_MS } = await replica();
+    const code = await stashHandoff(DESKTOP, { challenge: CHALLENGE, state: 's', awaitConfirm: true }, T0);
+    expect(await confirmHandoff(code, T0)).toBe(true);
+    vi.setSystemTime(T0 + HANDOFF_TTL_MS + 1);
+    expect(await getStore().kv.get(key(code))).toBeNull();
+    vi.useRealTimers();
+  });
+
+  it('a discard takes the sign-in out at once, gives it back once, and only the desktop\'s', async () => {
+    const { stashHandoff, discardDesktopHandoff, redeemHandoff } = await replica();
+    const code = await stashHandoff(DESKTOP, { challenge: CHALLENGE, state: 's', awaitConfirm: true });
+    const other = await replica();
+    expect(await other.discardDesktopHandoff(code)).toMatchObject({ refresh_token: 'r' });
+    expect(await discardDesktopHandoff(code)).toBeNull();
+    expect((await redeemHandoff(code, VERIFIER)).ok).toBe(false);
+    const phone = await stashHandoff(PASSWORD_BUNDLE, { challenge: CHALLENGE, state: 's' });
+    expect(await discardDesktopHandoff(phone)).toBeNull();
+    expect((await redeemHandoff(phone, VERIFIER)).ok).toBe(true);
+  });
+});

lib/__tests__/sso-complete-route.test.ts

@@ -224,3 +224,62 @@ describe('sso/complete mobile hand-off while the shared store is down (#1066)',
     expect(JSON.stringify(res.body)).not.toMatch(/"at"|"rt"|mobile_handoff_code/);
   });
 });
+
+describe('/api/auth/sso/complete for the desktop app', () => {
+  const VERIFIER = 'x'.repeat(50);
+  const CHALLENGE = createHash('sha256').update(VERIFIER).digest('base64url');
+  const LISTENER = 'http://127.0.0.1:51234/bulwark-desktop/callback';
+
+  it('parks the tokens under a code, writes nothing in this browser, and only a confirmed code redeems', async () => {
+    exchangeCodeForTokens.mockResolvedValue({ access_token: 'at', refresh_token: 'rt', id_token: 'idt', expires_in: 3600 });
+    pending({ mobile_redirect_uri: LISTENER, mobile_state: 'd-1', mobile_code_challenge: CHALLENGE });
+    const res = await complete();
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({
+      mobile_handoff_code: expect.stringMatching(/^[0-9a-f]{64}$/),
+      server_url: 'https://mail.example.org',
+      account: '',
+      mobile_redirect_uri: LISTENER,
+      mobile_state: 'd-1',
+    });
+    expect(JSON.stringify(res.body)).not.toMatch(/"at"|"rt"|idt/);
+    expect(jar.has('jmap_rt')).toBe(false);
+    expect(jar.has('sso_pending')).toBe(false);
+
+    expect((await redeemHandoff(res.body.mobile_handoff_code, VERIFIER)).ok).toBe(false);
+  });
+
+  it('names the account for the question: from the id token, or the server\'s session', async () => {
+    const jwt = (claims: object) => `x.${Buffer.from(JSON.stringify(claims)).toString('base64url')}.y`;
+    exchangeCodeForTokens.mockResolvedValue({ access_token: 'at', refresh_token: 'rt', id_token: jwt({ email: 'alice@example.org' }), expires_in: 3600 });
+    pending({ mobile_redirect_uri: LISTENER, mobile_state: 'd-1', mobile_code_challenge: CHALLENGE });
+    expect((await complete()).body.account).toBe('alice@example.org');
+
+    const fetched = vi.fn(async () => new Response(JSON.stringify({ username: 'bob@example.org' }), { status: 200 }));
+    vi.stubGlobal('fetch', fetched);
+    exchangeCodeForTokens.mockResolvedValue({ access_token: 'at', refresh_token: 'rt', expires_in: 3600 });
+    pending({ mobile_redirect_uri: LISTENER, mobile_state: 'd-1', mobile_code_challenge: CHALLENGE });
+    expect((await complete()).body.account).toBe('bob@example.org');
+    expect(fetched).toHaveBeenCalledWith('https://mail.example.org/.well-known/jmap', expect.objectContaining({ headers: { Authorization: 'Bearer at' } }));
+    vi.unstubAllGlobals();
+  });
+
+  it('hands the refresh token itself to the app, which writes its own cookie', async () => {
+    exchangeCodeForTokens.mockResolvedValue({ access_token: 'at', refresh_token: 'rt', id_token: 'idt', expires_in: 3600 });
+    pending({ mobile_redirect_uri: LISTENER, mobile_state: 'd-1', mobile_code_challenge: CHALLENGE, server_id: 'second' });
+    const res = await complete();
+    expect(await confirmHandoff(res.body.mobile_handoff_code)).toBe(true);
+    expect(await redeemHandoff(res.body.mobile_handoff_code, VERIFIER)).toMatchObject({
+      ok: true,
+      state: 'd-1',
+      bundle: { flow: 'desktop-tokens', server_id: 'second', access_token: 'at', refresh_token: 'rt', id_token: 'idt' },
+    });
+  });
+
+  it('fails rather than hands over tokens if a pending cookie has no challenge', async () => {
+    pending({ mobile_redirect_uri: LISTENER, mobile_state: 'd-1' });
+    const res = await complete();
+    expect(res.status).toBe(401);
+    expect(JSON.stringify(res.body)).not.toMatch(/"at"|"rt"/);
+  });
+});

lib/__tests__/sso-start-route.test.ts

@@ -66,8 +66,9 @@ vi.mock('@/lib/auth/session-secret', () => ({
   hasSessionSecret: () => true,
 }));
 
+const configValues = vi.hoisted(() => ({ desktopBrowserSignIn: true } as Record<string, unknown>));
 vi.mock('@/lib/admin/config-manager', () => ({
-  configManager: { get: () => '' },
+  configManager: { get: (key: string) => (key in configValues ? configValues[key] : '') },
 }));
 
 function mockRequest(body: Record<string, unknown>): unknown {
@@ -196,3 +197,44 @@ describe('sso start for the mobile app', () => {
     expect(encrypted.last).not.toHaveProperty('mobile_code_challenge');
   });
 });
+
+describe('sso start for the desktop app', () => {
+  const CHALLENGE = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
+  const LISTENER = 'http://127.0.0.1:51234/bulwark-desktop/callback';
+  const desktop = (extra: Record<string, unknown> = {}) => callRoute({
+    redirect_uri: 'https://mail.example.com/auth/callback',
+    mobile_redirect_uri: LISTENER,
+    mobile_state: 'd-1',
+    ...extra,
+  });
+
+  beforeEach(() => {
+    encrypted.last = null;
+  });
+
+  it('keeps the loopback target and its challenge for the complete route', async () => {
+    const { status } = await desktop({ mobile_code_challenge: CHALLENGE });
+    expect(status).toBe(200);
+    expect(encrypted.last).toMatchObject({ mobile_redirect_uri: LISTENER, mobile_state: 'd-1', mobile_code_challenge: CHALLENGE });
+  });
+
+  it('refuses it when the instance\'s admin turned it off', async () => {
+    configValues.desktopBrowserSignIn = false;
+    const { status } = await desktop({ mobile_code_challenge: CHALLENGE });
+    configValues.desktopBrowserSignIn = true;
+    expect(status).toBe(403);
+    expect(encrypted.last).toBeNull();
+  });
+
+  it('refuses it without a challenge: tokens would come back for a link', async () => {
+    const { status } = await desktop();
+    expect(status).toBe(400);
+    expect(encrypted.last).toBeNull();
+  });
+
+  it.each(['http://127.0.0.1:51234/other', 'http://localhost:51234/bulwark-desktop/callback', 'http://evil.example/bulwark-desktop/callback'])('refuses %s as a target', async (target) => {
+    const { status } = await desktop({ mobile_code_challenge: CHALLENGE, mobile_redirect_uri: target });
+    expect(status).toBe(400);
+    expect(encrypted.last).toBeNull();
+  });
+});

lib/__tests__/standalone-guard.test.ts

@@ -1,6 +1,6 @@
 // @vitest-environment node
 import { afterEach, describe, expect, it } from 'vitest';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
@@ -120,6 +120,36 @@ describe('standalone guard check', () => {
     expect(findForbidden(dir)).toEqual(['worktrees/webmail/data/']);
   });
 
+  it('goes by the name in any case, as a case-insensitive disk and Docker context would', () => {
+    const dir = tempDir();
+    put(dir, 'server.js');
+    put(dir, '.ENV', 'SECRET=1');
+    put(dir, 'Plugin-Signing.KEY', 'SECRET=1');
+    put(dir, 'Data/admin.json');
+    put(dir, 'LOCAL-DATA/a');
+    put(dir, 'Repos/a');
+    expect(findForbidden(dir)).toEqual(['.ENV', 'Data/', 'LOCAL-DATA/', 'Plugin-Signing.KEY', 'Repos/']);
+  });
+
+  it('refuses a link: it would ship whatever it points at', () => {
+    const dir = tempDir();
+    const outside = tempDir();
+    put(outside, 'admin.json');
+    put(dir, 'server.js');
+    symlinkSync(outside, path.join(dir, 'state'), 'junction');
+    expect(findForbidden(dir)).toEqual(['state (link)']);
+  });
+
+  it('leaves the links of .next and node_modules alone: Turbopack makes those on purpose', () => {
+    const dir = tempDir();
+    const outside = tempDir();
+    put(dir, 'node_modules/a/index.js');
+    mkdirSync(path.join(dir, '.next', 'node_modules'), { recursive: true });
+    symlinkSync(path.join(dir, 'node_modules', 'a'), path.join(dir, '.next', 'node_modules', 'a-1234'), 'junction');
+    symlinkSync(outside, path.join(dir, 'node_modules', 'b'), 'junction');
+    expect(findForbidden(dir)).toEqual([]);
+  });
+
   it('removes the .env files Next copies next to server.js, then passes', () => {
     const dir = tempDir();
     put(dir, 'worktrees/webmail/server.js');

lib/__tests__/sw-notification-actions.test.ts

@@ -90,12 +90,13 @@ const previewOf = (unreadTotal: number) => JSON.stringify({
 });
 
 describe('the buttons a notification gets', () => {
-  const buttonsFor = async (opts: { prefs?: unknown; max?: number | null; inline?: boolean; unreadTotal?: number }) => {
+  const buttonsFor = async (opts: { prefs?: unknown; max?: number | null; inline?: boolean; unreadTotal?: number; onScreen?: string[] }) => {
     const w = worker({
       caches: await cachesWith(opts.prefs),
       max: opts.max,
       inline: opts.inline,
       fetch: async () => new Response(previewOf(opts.unreadTotal ?? 1), { status: 200 }),
+      ...(opts.onScreen ? { notifications: [{ data: { ids: opts.onScreen } }] } : {}),
     });
     await pushFor({})(w);
     expect(w.shown).toHaveLength(1);
@@ -133,7 +134,7 @@ describe('the buttons a notification gets', () => {
   });
 
   it('gives the group notification none: it names no message', async () => {
-    expect(await buttonsFor({ prefs: PREFS, unreadTotal: 4 })).toBeUndefined();
+    expect(await buttonsFor({ prefs: PREFS, onScreen: ['e0'] })).toBeUndefined();
   });
 
   it('gives a message without its login none', async () => {

lib/__tests__/sw-push-delivery.test.ts

@@ -0,0 +1,320 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import vm from 'node:vm';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+// What one new message, several at once and several accounts turn into on screen.
+const SW_SOURCE = readFileSync(join(process.cwd(), 'public', 'sw.js'), 'utf8');
+
+type Preview = Record<string, unknown> | null;
+type Shown = { title: string; body?: unknown; data?: Record<string, unknown>; tag: string; options: Record<string, unknown>; close: () => void };
+
+function loadWorker(preview: (url: URL) => Preview, extra: { clients?: unknown[]; globals?: Record<string, unknown>; prefs?: unknown; quiet?: Record<string, boolean>; openWindow?: (url: string) => Promise<unknown>; registration?: Record<string, unknown> } = {}) {
+  const listeners = new Map<string, (event: unknown) => void>();
+  const shade = new Map<string, Shown>();
+  const previews: URL[] = [];
+  const cacheStore = new Map<string, string>();
+  if (extra.prefs) cacheStore.set('https://mail.example.com/__push-state/prefs', JSON.stringify(extra.prefs));
+  if (extra.quiet) cacheStore.set('https://mail.example.com/__push-state/quiet-logins', JSON.stringify(extra.quiet));
+  const self = {
+    location: { href: 'https://mail.example.com/sw.js', origin: 'https://mail.example.com' },
+    addEventListener: (type: string, fn: (event: unknown) => void) => listeners.set(type, fn),
+    skipWaiting: () => {},
+    clients: { claim: () => {}, matchAll: async () => extra.clients ?? [], openWindow: extra.openWindow },
+    registration: {
+      showNotification: async (title: string, options: Record<string, unknown>) => {
+        const tag = String(options.tag ?? '');
+        shade.set(tag, { title, body: options.body, data: options.data as Record<string, unknown>, tag, options, close: () => shade.delete(tag) });
+      },
+      getNotifications: async (filter?: { tag?: string }) => [...shade.values()].filter((n) => !filter?.tag || n.tag === filter.tag),
+      ...extra.registration,
+    },
+  };
+  const caches = {
+    open: async () => ({
+      match: async (key: string) => {
+        const value = cacheStore.get(key);
+        return value === undefined ? undefined : { json: async () => JSON.parse(value) };
+      },
+      put: async (key: string, res: { text: () => Promise<string> }) => { cacheStore.set(key, await res.text()); },
+    }),
+  };
+  const fetchMock = vi.fn(async (input: string) => {
+    const url = new URL(input, 'https://mail.example.com');
+    previews.push(url);
+    const body = preview(url);
+    return body ? { ok: true, json: async () => body } : { ok: false, status: 401, json: async () => ({}) };
+  });
+  const context = vm.createContext({ self, caches, fetch: fetchMock, URL, URLSearchParams, Response, Date, console, AbortController, setTimeout, clearTimeout, ...extra.globals });
+  vm.runInContext(SW_SOURCE, context);
+  async function dispatch(type: string, event: Record<string, unknown>) {
+    const waits: Promise<unknown>[] = [];
+    listeners.get(type)?.({ ...event, waitUntil: (p: Promise<unknown>) => waits.push(p) });
+    await Promise.all(waits);
+  }
+  const push = (payload: unknown) => dispatch('push', { data: { json: () => payload } });
+  return { push, dispatch, shade, previews };
+}
+
+const mail = (id: string, subject = 'Hello') => ({ id, threadId: `t-${id}`, from: [{ name: 'Alice' }], subject, preview: '' });
+const delivery = (accountId: string, ...emailIds: string[]) => ({ kind: 'jmap-email-push', accountLabel: 'me@example.org', accountId, emailIds });
+
+afterEach(() => vi.useRealTimers());
+
+describe('a state-change push naming several accounts', () => {
+  const stateChange = (changed: Record<string, Record<string, string>>, accountId = Object.keys(changed)[0]) => ({
+    kind: 'jmap-state-change', accountLabel: 'me@example.org', accountId, emailIds: [], changed,
+  });
+
+  it('notifies for each account with new mail', async () => {
+    const { push, shade, previews } = loadWorker((url) => ({ unreadTotal: 1, slot: 0, email: mail(`m-${url.searchParams.get('accountId')}`) }));
+    await push(stateChange({ me: { EmailDelivery: 's1', Email: 's1' }, team: { EmailDelivery: 's2' } }));
+    expect(previews.map((url) => url.searchParams.get('accountId'))).toEqual(['me', 'team']);
+    expect([...shade.keys()].sort()).toEqual(['bulwark-mail:me', 'bulwark-mail:team']);
+    expect(shade.get('bulwark-mail:team')?.data).toMatchObject({ accountId: 'team', emailId: 'm-team' });
+  });
+
+  it('leaves out an account that only changed some other way', async () => {
+    const { push, previews } = loadWorker(() => ({ unreadTotal: 1, slot: 0, email: mail('e1') }));
+    await push(stateChange({ quiet: { Mailbox: 's1' }, me: { EmailDelivery: 's2' } }));
+    expect(previews.map((url) => url.searchParams.get('accountId'))).toEqual(['me']);
+  });
+
+  it('still shows something for a ping without new mail in it', async () => {
+    const { push, previews } = loadWorker(() => ({ unreadTotal: 1, slot: 0, email: mail('e1') }));
+    await push(stateChange({ me: { Mailbox: 's1' } }));
+    expect(previews.map((url) => url.searchParams.get('accountId'))).toEqual(['me']);
+  });
+});
+
+describe('what a notification counts', () => {
+  it('opens the one new message, however much older mail is unread', async () => {
+    const { push, shade } = loadWorker(() => ({ unreadTotal: 40, slot: 0, login: 'fp', email: mail('e1') }));
+    await push(delivery('a', 'e1'));
+    const shown = shade.get('bulwark-mail:a')!;
+    expect(shown.body).toBe('Hello');
+    expect(shown.data).toMatchObject({ kind: 'email', emailId: 'e1', accountId: 'a', slot: 0, login: 'fp' });
+  });
+
+  it('counts the messages it announced, not the unread mail, and opens the inbox for a group', async () => {
+    const { push, shade } = loadWorker((url) => ({ unreadTotal: 40, slot: 0, email: mail(String(url.searchParams.get('emailId')), `About ${url.searchParams.get('emailId')}`) }));
+    await push(delivery('a', 'e1'));
+    await push(delivery('a', 'e2'));
+    let shown = shade.get('bulwark-mail:a')!;
+    expect(shown.body).toBe('About e2\n+1 more message');
+    expect(shown.data).toMatchObject({ kind: 'mail-list', accountId: 'a', slot: 0 });
+    await push(delivery('a', 'e3', 'e4'));
+    shown = shade.get('bulwark-mail:a')!;
+    expect(shown.body).toBe('About e4\n+3 more messages');
+  });
+
+  it('starts over once the notification was dismissed', async () => {
+    const { push, shade } = loadWorker((url) => ({ unreadTotal: 2, slot: 0, email: mail(String(url.searchParams.get('emailId'))) }));
+    await push(delivery('a', 'e1'));
+    shade.get('bulwark-mail:a')!.close();
+    await push(delivery('a', 'e2'));
+    expect(shade.get('bulwark-mail:a')!.data).toMatchObject({ kind: 'email', emailId: 'e2' });
+  });
+
+  it('does not count a redelivered message twice', async () => {
+    const { push, shade } = loadWorker((url) => ({ unreadTotal: 2, slot: 0, email: mail(String(url.searchParams.get('emailId'))) }));
+    await push(delivery('a', 'e1'));
+    await push(delivery('a', 'e1'));
+    expect(shade.get('bulwark-mail:a')!.data).toMatchObject({ kind: 'email', emailId: 'e1' });
+    expect(shade.get('bulwark-mail:a')!.options).toMatchObject({ silent: true });
+  });
+
+  it('counts on the state-change path too', async () => {
+    let id = 'e1';
+    const { push, shade } = loadWorker(() => ({ unreadTotal: 5, slot: 0, email: mail(id) }));
+    await push({ kind: 'jmap-state-change', accountId: 'a', changed: { a: { EmailDelivery: 's' } } });
+    expect(shade.get('bulwark-mail:a')!.data).toMatchObject({ kind: 'email', emailId: 'e1' });
+    id = 'e2';
+    await push({ kind: 'jmap-state-change', accountId: 'a', changed: { a: { EmailDelivery: 's2' } } });
+    expect(shade.get('bulwark-mail:a')!.body).toBe('Hello\n+1 more message');
+  });
+
+  it('says how many new messages without naming any when details are hidden', async () => {
+    const { push, shade } = loadWorker((url) => ({ unreadTotal: 9, slot: 0, redacted: true, email: { id: url.searchParams.get('emailId'), threadId: 't' } }));
+    await push(delivery('a', 'e1'));
+    expect(shade.get('bulwark-mail:a')!.body).toBe('You have new mail');
+    expect(shade.get('bulwark-mail:a')!.data).toMatchObject({ kind: 'email', emailId: 'e1' });
+    await push(delivery('a', 'e2'));
+    expect(shade.get('bulwark-mail:a')!.title).toBe('New mail (me@example.org)');
+    expect(shade.get('bulwark-mail:a')!.body).toBe('2 new messages');
+  });
+});
+
+describe('with notifications off or do not disturb on', () => {
+  const quiet = { 'me@example.org': true };
+
+  it('announces nothing for that login: shows and removes at once, without asking for the message', async () => {
+    const { push, shade, previews } = loadWorker(() => ({ unreadTotal: 1, slot: 0, email: mail('e1', 'Secret subject') }), { quiet });
+    await push(delivery('a', 'e1'));
+    expect(shade.size).toBe(0);
+    expect(previews).toHaveLength(0);
+  });
+
+  it('still announces mail for another login', async () => {
+    const { push, shade } = loadWorker(() => ({ unreadTotal: 1, slot: 0, email: mail('e1') }), { quiet: { 'someone-else@example.org': true } });
+    await push(delivery('a', 'e1'));
+    expect(shade.size).toBe(1);
+  });
+
+  it('does not bring the message up later', async () => {
+    const off = loadWorker(() => ({ unreadTotal: 1, slot: 0, email: mail('e1') }), { quiet });
+    await off.push(delivery('a', 'e1'));
+    await off.push(delivery('a', 'e1'));
+    expect(off.shade.size).toBe(0);
+  });
+
+  it('keeps showing with only the sound off', async () => {
+    const { push, shade } = loadWorker(() => ({ unreadTotal: 1, slot: 0, email: mail('e1') }), { prefs: { sound: false } });
+    await push(delivery('a', 'e1'));
+    expect(shade.get('bulwark-mail:a')!.options).toMatchObject({ silent: true, renotify: false });
+  });
+
+  it('shows for a push without a label, or with nothing stored', async () => {
+    const { push, shade } = loadWorker(() => ({ unreadTotal: 1, slot: 0, email: mail('e1') }), { quiet });
+    await push({ kind: 'jmap-email-push', accountId: 'a', emailIds: ['e1'] });
+    expect(shade.size).toBe(1);
+  });
+});
+
+describe('which login a push is for', () => {
+  it('names the login in the preview request', async () => {
+    const { push, previews } = loadWorker(() => ({ unreadTotal: 1, slot: 0, email: mail('e1') }));
+    await push(delivery('a', 'e1'));
+    expect(previews[0].searchParams.get('login')).toBe('me@example.org');
+  });
+
+  it('leaves it out when the push has no label', async () => {
+    const { push, previews } = loadWorker(() => ({ unreadTotal: 1, slot: 0, email: mail('e1') }));
+    await push({ kind: 'jmap-email-push', accountId: 'a', emailIds: ['e1'] });
+    expect(previews[0].searchParams.has('login')).toBe(false);
+  });
+});
+
+describe('when building the notification goes wrong', () => {
+  it('still shows one', async () => {
+    const { push, shade } = loadWorker(() => ({ unreadTotal: 1, slot: 0, login: 'fp', email: mail('e1') }), {
+      globals: { Notification: { get maxActions() { throw new Error('no such thing'); } } },
+    });
+    await push(delivery('a', 'e1'));
+    expect(shade.size).toBe(1);
+  });
+
+  it('shows one for a push that is no JSON at all', async () => {
+    const { dispatch, shade } = loadWorker(() => null);
+    await dispatch('push', { data: { json: () => { throw new SyntaxError('not JSON'); } } });
+    expect(shade.size).toBe(1);
+  });
+
+  it('shows one for a push without any data', async () => {
+    const { dispatch, shade } = loadWorker(() => null);
+    await dispatch('push', {});
+    expect(shade.size).toBe(1);
+  });
+});
+
+describe('which window a click uses', () => {
+  const win = (id: string, url: string, extra: Record<string, unknown> = {}) => {
+    const client = {
+      id, url: `https://mail.example.com${url}`, frameType: 'top-level', visibilityState: 'hidden', focused: false,
+      postMessage: vi.fn(),
+      focus: vi.fn(async () => client),
+      navigate: vi.fn(async () => client),
+      ...extra,
+    };
+    return client;
+  };
+  const clickOn = (w: ReturnType<typeof loadWorker>) => w.dispatch('notificationclick', {
+    notification: { tag: 'bulwark-mail:a', close() {}, data: { kind: 'email', emailId: 'e1', accountId: 'a', slot: 0 } },
+  });
+
+  it('leaves a pop-out and a frame alone and takes the app window', async () => {
+    const popout = win('p', '/popout/message/x');
+    const frame = win('f', '/mail/folder/inbox', { frameType: 'nested' });
+    const main = win('m', '/mail/folder/inbox');
+    const w = loadWorker(() => null, { clients: [popout, frame, main] });
+    await clickOn(w);
+    expect(popout.navigate).not.toHaveBeenCalled();
+    expect(frame.navigate).not.toHaveBeenCalled();
+    expect(main.navigate).toHaveBeenCalledWith('/mail/message/e1?slot=0&owner=a');
+  });
+
+  it('takes the window in front when there are several', async () => {
+    const back = win('b', '/mail/folder/inbox');
+    const front = win('f', '/mail/folder/inbox', { focused: true, visibilityState: 'visible' });
+    const w = loadWorker(() => null, { clients: [back, front] });
+    await clickOn(w);
+    expect(front.navigate).toHaveBeenCalled();
+    expect(back.navigate).not.toHaveBeenCalled();
+  });
+
+  it('opens a new window when only a pop-out is open', async () => {
+    const popout = win('p', '/popout/compose');
+    const openWindow = vi.fn(async () => null);
+    const w = loadWorker(() => null, { clients: [popout], openWindow });
+    await clickOn(w);
+    expect(popout.navigate).not.toHaveBeenCalled();
+    expect(openWindow).toHaveBeenCalledWith('/mail/message/e1?slot=0&owner=a');
+  });
+});
+
+describe('nothing new to say', () => {
+  it('removes only what it showed itself', async () => {
+    const { push, shade } = loadWorker(() => ({ unreadTotal: 0, email: null }));
+    await push({ kind: 'jmap-state-change', accountId: 'a', changed: { a: { EmailDelivery: 's' } } });
+    expect(shade.size).toBe(0);
+  });
+
+  it('still shows something when the browser cannot list its notifications', async () => {
+    const shown: string[] = [];
+    const w = loadWorker(() => ({ unreadTotal: 0, email: null }), {
+      registration: {
+        showNotification: async (title: string) => { shown.push(title); },
+        getNotifications: async () => { throw new Error('nope'); },
+      },
+    });
+    await w.push({ kind: 'jmap-state-change', accountId: 'a', changed: { a: { EmailDelivery: 's' } } });
+    expect(shown).toHaveLength(1);
+  });
+
+  it('uses its own tag, so it can never replace a real notification', async () => {
+    const tags: string[] = [];
+    const w = loadWorker(() => ({ unreadTotal: 0, email: null }), {
+      registration: {
+        showNotification: async (_title: string, options: { tag: string }) => { tags.push(options.tag); },
+        getNotifications: async () => [],
+      },
+    });
+    await w.push({ kind: 'jmap-state-change', accountId: 'a', changed: { a: { EmailDelivery: 's' } } });
+    expect(tags).toHaveLength(1);
+    expect(tags[0]).not.toBe('bulwark-mail:a');
+  });
+});
+
+describe('a push naming several accounts, one server slow', () => {
+  it('does not make the others wait out its deadline', async () => {
+    const started: string[] = [];
+    let release = () => {};
+    const slow = new Promise<void>((resolve) => { release = resolve; });
+    const fetchSlow = vi.fn(async (input: string) => {
+      const url = new URL(input, 'https://mail.example.com');
+      const account = url.searchParams.get('accountId') ?? '';
+      started.push(account);
+      if (account === 'slow') await slow;
+      return { ok: true, json: async () => ({ unreadTotal: 1, slot: 0, email: mail(`m-${account}`) }) };
+    });
+    const w = loadWorker(() => null, { globals: { fetch: fetchSlow } });
+    const done = w.push({ kind: 'jmap-state-change', accountId: 'slow', changed: { slow: { EmailDelivery: 's' }, fast: { EmailDelivery: 's' } } });
+    await vi.waitFor(() => expect(started).toEqual(['slow', 'fast']));
+    await vi.waitFor(() => expect(w.shade.has('bulwark-mail:fast')).toBe(true));
+    release();
+    await done;
+    expect(w.shade.size).toBe(2);
+  });
+});
+
+// -- end of cases --

lib/__tests__/sw-push-owner.test.ts

@@ -15,16 +15,16 @@ function parseTarget(target: string) {
 
 describe('push click keeps the owning mailbox (#1491)', () => {
   for (const owner of ['personal', 'team']) {
-    for (const unreadTotal of [1, 3]) {
+    for (const onScreen of [0, 2]) {
       for (const warm of [false, true]) {
-        it(`${owner}, ${unreadTotal} unread, ${warm ? 'existing' : 'new'} window`, async () => {
+        it(`${owner}, ${onScreen} announced already, ${warm ? 'existing' : 'new'} window`, async () => {
           const target = await pushClick(owner, async (url) => {
             expect(new URL(url, 'https://mail.example.test').searchParams.get('accountId')).toBe(owner);
-            return { slot: 0, unreadTotal, email: { id: 'same-id', threadId: 't', subject: 'Mail' } };
-          }, { warm });
+            return { slot: 0, unreadTotal: 3, email: { id: 'same-id', threadId: 't', subject: 'Mail' } };
+          }, { warm, onScreen: Array.from({ length: onScreen }, (_, i) => `earlier-${i}`) });
           const link = parseTarget(target);
           expect(link?.slot).toBe(0);
-          if (unreadTotal === 1) {
+          if (onScreen === 0) {
             expect(link).toMatchObject({ kind: 'message', id: 'same-id', ownerAccountId: owner });
           } else {
             expect(link).toMatchObject({ kind: 'folder', ref: 'inbox', ownerAccountId: owner });
@@ -42,7 +42,7 @@ describe('push click keeps the owning mailbox (#1491)', () => {
   });
 
   it('keeps the login slot and owner with a mount prefix and legacy payload', async () => {
-    const target = await pushClick('team', async () => ({ slot: 2, unreadTotal: 3, email: { id: 'same-id' } }), { basePath: '/webmail', legacy: true });
+    const target = await pushClick('team', async () => ({ slot: 2, unreadTotal: 3, email: { id: 'same-id' } }), { basePath: '/webmail', legacy: true, onScreen: ['earlier'] });
     expect(target).toMatch(/^\/webmail\/mail\/folder\/inbox\?/);
     expect(parseTarget(target)).toMatchObject({ kind: 'folder', ownerAccountId: 'team', slot: 2 });
   });

lib/__tests__/sw-push-redacted.test.ts

@@ -45,10 +45,10 @@ describe('service worker with a redacted preview', () => {
     expect(calls[0].options.data).toMatchObject({ kind: 'email', emailId: 'e1' });
   });
 
-  it('counts several unread messages without naming any', async () => {
+  it('opens the one new message however much else is unread', async () => {
     const { push, calls } = loadWorker({ unreadTotal: 3, redacted: true, email: { id: 'e1', threadId: 't1' } });
     await push(delivery);
     expect(calls[0].title).toBe('New mail');
-    expect(calls[0].options.body).toBe('3 unread messages');
+    expect(calls[0].options.data).toMatchObject({ kind: 'email', emailId: 'e1' });
   });
 });

lib/__tests__/sw-push-subscription-change.test.ts

@@ -7,9 +7,11 @@ import { describe, expect, it, vi } from 'vitest';
 // in a VM with a minimal ServiceWorkerGlobalScope and fire the event.
 const SW_SOURCE = readFileSync(join(process.cwd(), 'public', 'sw.js'), 'utf8');
 
-function loadWorker(tabs: { postMessage: (msg: unknown) => void }[]) {
+function loadWorker(tabs: { postMessage: (msg: unknown) => void }[], registrations?: unknown, config: { noThirdPartyTraffic?: boolean } | null = {}) {
   const listeners = new Map<string, (event: unknown) => void>();
-  const subscribe = vi.fn(async () => ({}));
+  const newSubscription = { toJSON: () => ({ endpoint: 'https://push.example/new', keys: { p256dh: 'p', auth: 'a' } }) };
+  const subscribe = vi.fn(async (_options: { userVisibleOnly?: boolean; applicationServerKey?: Uint8Array }) => newSubscription);
+  const relayCalls: Array<{ url: string; body: unknown }> = [];
   const self = {
     location: { href: 'https://mail.example.com/sw.js', origin: 'https://mail.example.com' },
     addEventListener: (type: string, fn: (event: unknown) => void) => listeners.set(type, fn),
@@ -18,7 +20,18 @@ function loadWorker(tabs: { postMessage: (msg: unknown) => void }[]) {
     registration: { pushManager: { subscribe } },
   };
   const context = vm.createContext({
-    self, caches: {}, fetch: vi.fn(), URL, URLSearchParams, Response, Date, console,
+    self,
+    atob,
+    caches: { open: async () => ({ match: async () => (registrations ? { json: async () => registrations } : undefined) }) },
+    fetch: vi.fn(async (url: string, init?: { body: string }) => {
+      if (url.endsWith('/api/config')) {
+        if (!config) throw new TypeError('offline');
+        return { ok: true, json: async () => config };
+      }
+      relayCalls.push({ url, body: JSON.parse(init!.body) });
+      return { ok: true };
+    }),
+    URL, URLSearchParams, Response, Date, console, Uint8Array,
   });
   vm.runInContext(SW_SOURCE, context);
 
@@ -27,13 +40,57 @@ function loadWorker(tabs: { postMessage: (msg: unknown) => void }[]) {
     listeners.get(type)?.({ ...event, waitUntil: (p: Promise<unknown>) => waits.push(p) });
     await Promise.all(waits);
   }
-  return { fire, subscribe };
+  return { fire, subscribe, relayCalls, newSubscription };
 }
 
 // The push service dropped or replaced the subscription while no page was
 // involved (#1321). The worker puts a subscription back and tells the open
 // tabs, which hold the login needed to register the new endpoint.
 describe('service worker pushsubscriptionchange', () => {
+  const REGISTRATIONS = {
+    applicationServerKey: 'QUJD',
+    entries: {
+      a: { relay: 'https://relay.example', subscriptionId: 'device-a', accountLabel: 'a@example.org' },
+      b: { relay: 'https://relay.example', subscriptionId: 'device-b', accountLabel: 'b@example.org' },
+    },
+  };
+
+  it('tells the relay the new endpoint itself, for every account, with no tab open', async () => {
+    const { fire, relayCalls, newSubscription } = loadWorker([], REGISTRATIONS);
+    await fire('pushsubscriptionchange', { oldSubscription: null, newSubscription });
+    expect(relayCalls).toEqual([
+      { url: 'https://relay.example/api/push/register/web', body: { subscriptionId: 'device-a', subscription: newSubscription.toJSON(), accountLabel: 'a@example.org' } },
+      { url: 'https://relay.example/api/push/register/web', body: { subscriptionId: 'device-b', subscription: newSubscription.toJSON(), accountLabel: 'b@example.org' } },
+    ]);
+  });
+
+  it('subscribes with the kept key when the browser gives no old subscription', async () => {
+    const { fire, subscribe, relayCalls } = loadWorker([], REGISTRATIONS);
+    await fire('pushsubscriptionchange', { oldSubscription: null, newSubscription: null });
+    expect(subscribe).toHaveBeenCalledTimes(1);
+    expect(subscribe.mock.calls[0][0]).toMatchObject({ userVisibleOnly: true });
+    expect(Array.from(subscribe.mock.calls[0][0].applicationServerKey!)).toEqual([65, 66, 67]);
+    expect(relayCalls).toHaveLength(2);
+  });
+
+  it('calls no relay while third-party traffic is off: the page moves it', async () => {
+    const { fire, relayCalls, newSubscription } = loadWorker([], REGISTRATIONS, { noThirdPartyTraffic: true });
+    await fire('pushsubscriptionchange', { oldSubscription: null, newSubscription });
+    expect(relayCalls).toEqual([]);
+  });
+
+  it('calls no relay when it cannot find out', async () => {
+    const { fire, relayCalls, newSubscription } = loadWorker([], REGISTRATIONS, null);
+    await fire('pushsubscriptionchange', { oldSubscription: null, newSubscription });
+    expect(relayCalls).toEqual([]);
+  });
+
+  it('calls no relay for a browser where push was never on', async () => {
+    const { fire, relayCalls, newSubscription } = loadWorker([]);
+    await fire('pushsubscriptionchange', { oldSubscription: null, newSubscription });
+    expect(relayCalls).toEqual([]);
+  });
+
   it('re-subscribes with the old key and tells the open tabs to re-register', async () => {
     const tab = { postMessage: vi.fn() };
     const { fire, subscribe } = loadWorker([tab]);

lib/__tests__/web-push.test.ts

@@ -6,7 +6,9 @@ import { RateLimitError, RequestTimeoutError } from '@/lib/jmap/client';
 import {
   buildEmailPushConfig,
   disableWebPush,
+  dropAllWebPushRegistrations,
   enableWebPush,
+  endWebPushForSignOut,
   isWebPushEnabled,
   listPushDevices,
   mailAccountsWithoutPush,
@@ -16,8 +18,10 @@ import {
   revokePushDevice,
   waitForWebPushResync,
 } from '@/lib/web-push';
+import { webPushErrorKey } from '@/lib/web-push-errors';
 import { DEFAULT_RELAY_BASE_URL } from '@/lib/push-relays';
 import { setNoThirdPartyTraffic } from '@/lib/third-party-mode';
+import { keepRelayRegistration } from '@/lib/pwa-notify/worker-state';
 
 const RELAY = 'https://relay.example';
 const RELAY_BASE_KEY = `bulwark.push.relayBase.v1.${'acct-1'}`;
@@ -275,7 +279,7 @@ function installFetch(activeByDevice: Record<string, boolean | 'unknown'>) {
     if (url.includes('/api/push/active/')) {
       const device = url.split('/api/push/active/')[1];
       const state = activeByDevice[device];
-      if (state === undefined || state === 'unknown') return json({ error: 'Unknown' }, 404);
+      if (state === undefined || state === 'unknown') return json({ error: 'Unknown subscription' }, 404);
       return json({ active: state });
     }
     return json({});
@@ -472,6 +476,532 @@ describe('enableWebPush', () => {
 // Registrations made before the client learned about the delivery filter are
 // repaired in the background on app start - nobody should have to find the
 // settings toggle to stop the spam pushes.
+describe('enableWebPush when the verification does not come', () => {
+  // The relay's poll stays empty until `arrivesAfterTouch` calls come in, like a
+  // Stalwart that skipped the verification until the subscription is touched.
+  function installSilentRelay(codeOnceTouched: () => boolean) {
+    const fetchMock = vi.fn(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      const json = (body: unknown) => ({ ok: true, status: 200, json: async () => body }) as Response;
+      if (url.endsWith('/api/push/vapid-public-key')) return json({ publicKey: 'QUJD' });
+      if (url.includes('/api/push/verify/')) return json({ verificationCode: codeOnceTouched() ? 'late-code' : null });
+      return json({});
+    });
+    vi.stubGlobal('fetch', fetchMock);
+  }
+
+  afterEach(() => { vi.useRealTimers(); });
+
+  it('keeps polling through a network blip', async () => {
+    vi.useFakeTimers();
+    const client = makeClient([]);
+    let polls = 0;
+    const fetchMock = vi.fn(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      const json = (body: unknown) => ({ ok: true, status: 200, json: async () => body }) as Response;
+      if (url.endsWith('/api/push/vapid-public-key')) return json({ publicKey: 'QUJD' });
+      if (url.includes('/api/push/verify/')) {
+        polls += 1;
+        if (polls === 1) throw new TypeError('Failed to fetch');
+        return json({ verificationCode: 'code' });
+      }
+      return json({});
+    });
+    vi.stubGlobal('fetch', fetchMock);
+
+    const settled = enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false }).then(() => 'done', (error: Error) => error.message);
+    await vi.advanceTimersByTimeAsync(5_000);
+
+    expect(await settled).toBe('done');
+    expect(client.verifyPushSubscription).toHaveBeenCalledWith('push-new', 'code');
+  });
+
+  it('removes its unverified subscription and reads as off when the code never comes', async () => {
+    vi.useFakeTimers();
+    const client = makeClient([]);
+    installSilentRelay(() => false);
+
+    const settled = enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false }).then(() => 'done', (error: Error) => error.message);
+    await vi.advanceTimersByTimeAsync(120_000);
+
+    expect(await settled).toMatch(/verif/i);
+    expect(client.destroyed).toEqual(['push-new']);
+    expect(localStorage.getItem(SUB_KEY)).toBeNull();
+    expect(client.verifyPushSubscription).not.toHaveBeenCalled();
+  });
+
+  it('removes its subscription when the server refuses the code', async () => {
+    const client = makeClient([]);
+    installFetch({});
+    (client.verifyPushSubscription as ReturnType<typeof vi.fn>).mockRejectedValueOnce(new Error('Verification code does not match.'));
+
+    await expect(enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false })).rejects.toThrow('does not match');
+
+    expect(client.destroyed).toEqual(['push-new']);
+    expect(localStorage.getItem(SUB_KEY)).toBeNull();
+  });
+
+  it('keeps the old subscription working when its replacement fails verification', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-old');
+    const client = makeClient([sub('push-old', THIS_DEVICE)]);
+    installFetch({});
+    (client.verifyPushSubscription as ReturnType<typeof vi.fn>).mockRejectedValueOnce(new Error('nope'));
+
+    await expect(enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false, forceRecreate: true })).rejects.toThrow('nope');
+
+    expect(client.destroyed).toEqual(['push-new']);
+    expect(localStorage.getItem(SUB_KEY)).toBe('push-old');
+  });
+
+  it('touches the subscription after the server\'s minute, which makes it send the code', async () => {
+    vi.useFakeTimers();
+    const client = makeClient([]);
+    installSilentRelay(() => (client.updatePushSubscription as ReturnType<typeof vi.fn>).mock.calls.length > 0);
+
+    const run = enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+    const settled = run.then(() => 'done', (error: Error) => error.message);
+    await vi.advanceTimersByTimeAsync(58_000);
+    expect(client.updatePushSubscription).not.toHaveBeenCalled();
+    await vi.advanceTimersByTimeAsync(10_000);
+
+    expect(client.updatePushSubscription).toHaveBeenCalledTimes(1);
+    expect((client.updatePushSubscription as ReturnType<typeof vi.fn>).mock.calls[0][0]).toBe('push-new');
+    await vi.advanceTimersByTimeAsync(5_000);
+    expect(await settled).toBe('done');
+    expect(client.verifyPushSubscription).toHaveBeenCalledWith('push-new', 'late-code');
+  });
+});
+
+describe('two tabs at once', () => {
+  // What the browser's Web Locks do: one holder at a time, in order.
+  function installLocks() {
+    let tail: Promise<unknown> = Promise.resolve();
+    const request = vi.fn(async (_name: string, run: () => Promise<unknown>) => {
+      const next = tail.then(run, run);
+      tail = next.catch(() => undefined);
+      return next;
+    });
+    Object.defineProperty(navigator, 'locks', { configurable: true, value: { request } });
+    return request;
+  }
+
+  afterEach(() => {
+    delete (navigator as unknown as { locks?: unknown }).locks;
+  });
+
+  // A server that knows what was created and destroyed, as the race needs.
+  function statefulClient() {
+    const subs: JmapPushSubscription[] = [];
+    const client = makeClient(subs);
+    let next = 0;
+    (client.createPushSubscription as ReturnType<typeof vi.fn>).mockImplementation(async (params: { deviceClientId: string }) => {
+      const id = `push-${++next}`;
+      subs.push(sub(id, params.deviceClientId));
+      return id;
+    });
+    (client.verifyPushSubscription as ReturnType<typeof vi.fn>).mockImplementation(async (id: string) => {
+      if (client.destroyed.includes(id)) throw new Error('notFound');
+    });
+    return client;
+  }
+
+  it('makes one subscription, and neither tab fails', async () => {
+    installLocks();
+    const client = statefulClient();
+    installFetch({});
+
+    const results = await Promise.allSettled([
+      enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false }),
+      enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false }),
+    ]);
+
+    expect(results.map((r) => r.status)).toEqual(['fulfilled', 'fulfilled']);
+    expect(client.createPushSubscription).toHaveBeenCalledTimes(1);
+    expect(client.destroyed).toEqual([]);
+    expect(await client.listPushSubscriptions()).toHaveLength(1);
+  });
+
+  it('waits for a running enable before turning off', async () => {
+    const request = installLocks();
+    const client = statefulClient();
+    installFetch({});
+
+    const enabling = enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+    await vi.waitFor(() => expect(request).toHaveBeenCalledTimes(1));
+    await Promise.all([enabling, disableWebPush({ client, relayBaseUrl: RELAY })]);
+
+    expect(request).toHaveBeenCalledTimes(2);
+    expect(await client.listPushSubscriptions()).toEqual([]);
+    expect(localStorage.getItem(SUB_KEY)).toBeNull();
+  });
+
+  it('still works in a browser without Web Locks', async () => {
+    const client = statefulClient();
+    installFetch({});
+    await enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+    expect(client.createPushSubscription).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('what enabling and disabling say when they fail', () => {
+  it('tells a blocked browser from a question not answered', async () => {
+    const client = makeClient([]);
+    installFetch({});
+    (globalThis as unknown as { Notification: unknown }).Notification = { permission: 'denied' };
+    (window as unknown as { Notification: unknown }).Notification = { permission: 'denied' };
+    await expect(enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false })).rejects.toSatisfy((e) => webPushErrorKey(e) === 'error_blocked');
+
+    const unanswered = { permission: 'default', requestPermission: async () => 'default' };
+    (globalThis as unknown as { Notification: unknown }).Notification = unanswered;
+    (window as unknown as { Notification: unknown }).Notification = unanswered;
+    await expect(enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false })).rejects.toSatisfy((e) => webPushErrorKey(e) === 'error_not_granted');
+    expect(client.createPushSubscription).not.toHaveBeenCalled();
+  });
+
+  it('names an unreachable relay, and a relay that refuses', async () => {
+    const client = makeClient([]);
+    vi.stubGlobal('fetch', vi.fn(async () => { throw new TypeError('Failed to fetch'); }));
+    await expect(enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false })).rejects.toSatisfy((e) => webPushErrorKey(e) === 'error_relay');
+
+    vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL) => {
+      const json = (body: unknown, status = 200) => ({ ok: status < 300, status, json: async () => body }) as Response;
+      return String(input).endsWith('/vapid-public-key') ? json({ publicKey: 'QUJD' }) : json({}, 500);
+    }));
+    await expect(enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false })).rejects.toSatisfy((e) => webPushErrorKey(e) === 'error_relay');
+    expect(client.createPushSubscription).not.toHaveBeenCalled();
+  });
+
+  it('names a verification that never came', async () => {
+    vi.useFakeTimers();
+    try {
+      const client = makeClient([]);
+      vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL) => {
+        const url = String(input);
+        const json = (body: unknown) => ({ ok: true, status: 200, json: async () => body }) as Response;
+        if (url.endsWith('/vapid-public-key')) return json({ publicKey: 'QUJD' });
+        return json({ verificationCode: null });
+      }));
+      const settled = enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false }).catch((e: unknown) => webPushErrorKey(e));
+      await vi.advanceTimersByTimeAsync(120_000);
+      expect(await settled).toBe('error_verification_timeout');
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('keeps naming the server refusals, and nothing for an unknown error', () => {
+    expect(webPushErrorKey(refusedMap())).toBe('error_forbidden');
+    expect(webPushErrorKey(jmapSetError('x', OVER_QUOTA))).toBe('error_over_quota');
+    expect(webPushErrorKey(new Error('boom'))).toBeNull();
+  });
+
+  it('says so when turning off could not reach the server, and still ends up off here', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-mine');
+    const client = makeClient([sub('push-mine', THIS_DEVICE)]);
+    installFetch({});
+    (client.destroyPushSubscription as ReturnType<typeof vi.fn>).mockRejectedValue(new Error('offline'));
+
+    await expect(disableWebPush({ client, relayBaseUrl: RELAY })).rejects.toSatisfy((e) => webPushErrorKey(e) === 'error_teardown');
+
+    expect(localStorage.getItem(SUB_KEY)).toBeNull();
+  });
+
+  it('says so when turning off could not reach the relay', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-mine');
+    const client = makeClient([sub('push-mine', THIS_DEVICE)]);
+    vi.stubGlobal('fetch', vi.fn(async () => { throw new TypeError('Failed to fetch'); }));
+
+    await expect(disableWebPush({ client, relayBaseUrl: RELAY })).rejects.toSatisfy((e) => webPushErrorKey(e) === 'error_teardown');
+
+    expect(client.destroyed).toEqual(['push-mine']);
+    expect(localStorage.getItem(SUB_KEY)).toBeNull();
+  });
+
+  it('does not count a record the relay no longer has as a failure', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-mine');
+    const client = makeClient([sub('push-mine', THIS_DEVICE)]);
+    vi.stubGlobal('fetch', vi.fn(async () => ({ ok: false, status: 404, json: async () => ({}) })));
+
+    await expect(disableWebPush({ client, relayBaseUrl: RELAY })).resolves.toBeUndefined();
+  });
+
+  it('keeps the browser subscription for the other account, and says nothing when all went well', async () => {
+    const { browserSub } = installPushBrowser();
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-mine');
+    localStorage.setItem('bulwark.push.subscriptionId.v1.other-account', 'push-other');
+    const client = makeClient([sub('push-mine', THIS_DEVICE)]);
+    installFetch({});
+
+    await expect(disableWebPush({ client, relayBaseUrl: RELAY })).resolves.toBeUndefined();
+
+    expect(browserSub.unsubscribe).not.toHaveBeenCalled();
+  });
+});
+
+describe('an endpoint the push service gave up on', () => {
+  const ENDPOINT_KEY = `bulwark.push.endpoint.v1.${ACCOUNT_ID}`;
+
+  function registered() {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-mine');
+    localStorage.setItem(RELAY_BASE_KEY, RELAY);
+    localStorage.setItem(ENDPOINT_KEY, 'https://fcm.example/endpoint');
+    return makeClient([sub('push-mine', THIS_DEVICE)]);
+  }
+
+  it('gets a new subscription when the relay dropped the record for the very endpoint this browser still holds', async () => {
+    const { browserSub, registration } = installPushBrowser();
+    const client = registered();
+    installFetch({}); // The relay answers 404 for this device.
+
+    await resyncWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+
+    expect(browserSub.unsubscribe).toHaveBeenCalledTimes(1);
+    expect(registration.pushManager.subscribe).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not take a relay that lacks the route for one that lost the record', async () => {
+    const { browserSub } = installPushBrowser();
+    const client = registered();
+    vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      const json = (body: unknown, status = 200) => ({ ok: status < 300, status, json: async () => body }) as Response;
+      if (url.includes('/api/push/active/')) return json({ error: 'Not found' }, 404);
+      return url.endsWith('/vapid-public-key') ? json({ publicKey: 'QUJD' }) : json({});
+    }));
+
+    await resyncWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+
+    expect(browserSub.unsubscribe).not.toHaveBeenCalled();
+  });
+
+  it('moves the other logins to the new endpoint, connected or not', async () => {
+    const { registration } = installPushBrowser();
+    const moved = { endpoint: 'https://fcm.example/moved', options: { applicationServerKey: new Uint8Array([65, 66, 67]).buffer }, getKey: () => new Uint8Array([1, 2, 3]).buffer, unsubscribe: vi.fn(async () => true) };
+    (registration.pushManager.subscribe as ReturnType<typeof vi.fn>).mockResolvedValue(moved);
+    const stored = new Map<string, string>();
+    vi.stubGlobal('caches', {
+      open: async () => ({
+        match: async (key: string) => (stored.has(key) ? new Response(stored.get(key)) : undefined),
+        put: async (key: string, res: Response) => { stored.set(key, await res.text()); },
+      }),
+    });
+    await keepRelayRegistration('other-login', { relay: 'https://relay-of-other.example', subscriptionId: 'device-other', accountLabel: 'o@example.org' }, 'QUJD');
+    const client = registered();
+    const bodies: Array<{ url: string; body: { subscriptionId: string; subscription: { endpoint: string }; accountLabel?: string } }> = [];
+    vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      const json = (body: unknown, status = 200) => ({ ok: status < 300, status, json: async () => body }) as Response;
+      if (url.endsWith('/vapid-public-key')) return json({ publicKey: 'QUJD' });
+      if (url.includes('/api/push/active/')) return json({ error: 'Unknown subscription' }, 404);
+      if (url.endsWith('/api/push/register/web')) bodies.push({ url, body: JSON.parse(String(init?.body)) });
+      return json({});
+    }));
+
+    await resyncWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+
+    const other = bodies.find((b) => b.body.subscriptionId === 'device-other');
+    expect(other?.url).toBe('https://relay-of-other.example/api/push/register/web');
+    expect(other?.body.subscription.endpoint).toBe('https://fcm.example/moved');
+    expect(other?.body.accountLabel).toBe('o@example.org');
+    expect(bodies.filter((b) => b.body.subscriptionId === THIS_DEVICE)).toHaveLength(1);
+  });
+
+  it('keeps the subscription while the relay knows the record', async () => {
+    const { browserSub } = installPushBrowser();
+    const client = registered();
+    installFetch({ [THIS_DEVICE]: true });
+
+    await resyncWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+
+    expect(browserSub.unsubscribe).not.toHaveBeenCalled();
+  });
+
+  it('keeps it when the relay cannot be asked', async () => {
+    const { browserSub } = installPushBrowser();
+    const client = registered();
+    const calls: string[] = [];
+    vi.stubGlobal('fetch', vi.fn(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      calls.push(url);
+      if (url.includes('/api/push/active/')) throw new TypeError('blip');
+      const json = (body: unknown) => ({ ok: true, status: 200, json: async () => body }) as Response;
+      return url.endsWith('/vapid-public-key') ? json({ publicKey: 'QUJD' }) : json({});
+    }));
+
+    await resyncWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+
+    expect(calls.some((url) => url.includes('/api/push/active/'))).toBe(true);
+    expect(browserSub.unsubscribe).not.toHaveBeenCalled();
+  });
+
+  it('only registers when another account already moved the browser to a new endpoint', async () => {
+    const { browserSub } = installPushBrowser();
+    const client = registered();
+    localStorage.setItem(ENDPOINT_KEY, 'https://fcm.example/older');
+    installFetch({});
+
+    await resyncWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+
+    expect(browserSub.unsubscribe).not.toHaveBeenCalled();
+    expect(localStorage.getItem(ENDPOINT_KEY)).toBe('https://fcm.example/endpoint');
+  });
+
+  it('does not mistake a move to another relay for a dead endpoint', async () => {
+    const { browserSub } = installPushBrowser();
+    const client = registered();
+    localStorage.setItem(RELAY_BASE_KEY, 'https://old-relay.example');
+    installFetch({});
+
+    await resyncWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+
+    expect(browserSub.unsubscribe).not.toHaveBeenCalled();
+  });
+});
+
+describe('a subscription id the server gave to another device', () => {
+  // Stalwart hands out the lowest free id: this browser's subscription expired,
+  // and the phone that registered next got the same id.
+  it('creates its own instead of taking over the other device\'s', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'b');
+    const client = makeClient([sub('b', OTHER_DEVICE)]);
+    installFetch({ [OTHER_DEVICE]: true });
+
+    await enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+
+    expect(client.updatePushSubscription).not.toHaveBeenCalled();
+    expect(client.createPushSubscription).toHaveBeenCalledTimes(1);
+    expect(client.destroyed).toEqual([]);
+    expect(localStorage.getItem(SUB_KEY)).toBe('push-new');
+  });
+
+  it('leaves it alone when turning off', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'b');
+    const client = makeClient([sub('b', OTHER_DEVICE)]);
+    installFetch({});
+
+    await disableWebPush({ client, relayBaseUrl: RELAY });
+
+    expect(client.destroyed).toEqual([]);
+  });
+
+  it('leaves it alone on Re-register', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'b');
+    const client = makeClient([sub('b', OTHER_DEVICE)]);
+    installFetch({ [OTHER_DEVICE]: true });
+
+    await enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false, forceRecreate: true });
+
+    expect(client.destroyed).toEqual([]);
+  });
+});
+
+describe('a setup that gets stuck', () => {
+  afterEach(() => {
+    vi.useRealTimers();
+    delete (navigator as unknown as { locks?: unknown }).locks;
+  });
+
+  it('fails in the end and lets the next one through', async () => {
+    vi.useFakeTimers();
+    let tail: Promise<unknown> = Promise.resolve();
+    Object.defineProperty(navigator, 'locks', {
+      configurable: true,
+      value: { request: (_n: string, run: () => Promise<unknown>) => { const next = tail.then(run, run); tail = next.catch(() => undefined); return next; } },
+    });
+    const { registration } = installPushBrowser();
+    (registration.pushManager.getSubscription as ReturnType<typeof vi.fn>).mockResolvedValueOnce(null);
+    (registration.pushManager.subscribe as ReturnType<typeof vi.fn>).mockReturnValueOnce(new Promise(() => {}));
+    const client = makeClient([]);
+    installFetch({});
+
+    const stuck = enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false }).then(() => 'done', () => 'failed');
+    await vi.advanceTimersByTimeAsync(1_000);
+    const second = enableWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false }).then(() => 'done', () => 'failed');
+    await vi.advanceTimersByTimeAsync(200_000);
+
+    expect(await stuck).toBe('failed');
+    expect(await second).toBe('done');
+  });
+
+  it('turns off for the account it was asked about, even if the client disconnected while waiting', async () => {
+    let tail: Promise<unknown> = Promise.resolve();
+    let release = () => {};
+    tail = new Promise<void>((resolve) => { release = resolve; });
+    Object.defineProperty(navigator, 'locks', {
+      configurable: true,
+      value: { request: (_n: string, run: () => Promise<unknown>) => { const next = tail.then(run, run); tail = next.catch(() => undefined); return next; } },
+    });
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-mine');
+    localStorage.setItem(RELAY_BASE_KEY, RELAY);
+    const client = makeClient([sub('push-mine', THIS_DEVICE)]);
+    let accountId = ACCOUNT_ID;
+    (client as unknown as { getAccountId: () => string }).getAccountId = () => accountId;
+    const calls = installFetch({});
+
+    const off = disableWebPush({ client, relayBaseUrl: RELAY }).catch(() => undefined);
+    accountId = '';
+    release();
+    await off;
+
+    expect(localStorage.getItem(SUB_KEY)).toBeNull();
+    expect(calls).toContainEqual({ url: `${RELAY}/api/push/register/${THIS_DEVICE}`, method: 'DELETE' });
+  });
+});
+
+describe('a re-sync waiting its turn', () => {
+  afterEach(() => { delete (navigator as unknown as { locks?: unknown }).locks; });
+
+  it('does not bring back what another tab turned off meanwhile', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-mine');
+    localStorage.setItem(RELAY_BASE_KEY, RELAY);
+    const client = makeClient([sub('push-mine', THIS_DEVICE)]);
+    installFetch({ [THIS_DEVICE]: true });
+    let turn: Promise<unknown> = Promise.resolve();
+    let release = () => {};
+    turn = new Promise<void>((resolve) => { release = resolve; });
+    Object.defineProperty(navigator, 'locks', {
+      configurable: true,
+      value: { request: (_n: string, run: () => Promise<unknown>) => { const next = turn.then(run, run); turn = next.catch(() => undefined); return next; } },
+    });
+
+    const resync = resyncWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+    await vi.waitFor(() => expect((navigator as unknown as { locks: unknown }).locks).toBeTruthy());
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    localStorage.removeItem(SUB_KEY); // The other tab, holding the lock.
+    release();
+    await resync;
+
+    expect(client.updatePushSubscription).not.toHaveBeenCalled();
+    expect(client.createPushSubscription).not.toHaveBeenCalled();
+    expect(localStorage.getItem(SUB_KEY)).toBeNull();
+  });
+});
+
+describe('a registration from before the relay was remembered', () => {
+  it('gets the relay noted when it is refreshed', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-mine');
+    const client = makeClient([sub('push-mine', THIS_DEVICE)]);
+    installFetch({ [THIS_DEVICE]: true });
+
+    await resyncWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+
+    expect(localStorage.getItem(RELAY_BASE_KEY)).toBe(RELAY);
+    expect(client.createPushSubscription).not.toHaveBeenCalled();
+  });
+});
+
 describe('resyncWebPush when the relay changed (#903)', () => {
   afterEach(() => setNoThirdPartyTraffic(false));
 
@@ -504,6 +1034,48 @@ describe('resyncWebPush when the relay changed (#903)', () => {
     expect(client.destroyed).toContain('push-old');
   });
 
+  it('leaves no record on the relay it moved away from', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-old');
+    localStorage.setItem(RELAY_BASE_KEY, 'https://old-relay.example');
+    const client = makeClient([sub('push-old', THIS_DEVICE)]);
+    const calls = installFetch({});
+
+    expect(await resyncWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false })).toBe(true);
+
+    expect(calls).toContainEqual({ url: `https://old-relay.example/api/push/register/${THIS_DEVICE}`, method: 'DELETE' });
+    expect(calls).not.toContainEqual({ url: `${RELAY}/api/push/register/${THIS_DEVICE}`, method: 'DELETE' });
+    expect(localStorage.getItem(RELAY_BASE_KEY)).toBe(RELAY);
+    expect(client.destroyed).toEqual(['push-old']);
+  });
+
+  it('keeps the old relay until the new subscription is verified', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-old');
+    localStorage.setItem(RELAY_BASE_KEY, 'https://old-relay.example');
+    const client = makeClient([sub('push-old', THIS_DEVICE)]);
+    const calls = installFetch({});
+    (client.verifyPushSubscription as ReturnType<typeof vi.fn>).mockRejectedValueOnce(new Error('nope'));
+
+    await resyncWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+
+    expect(calls.some((c) => c.method === 'DELETE')).toBe(false);
+    expect(localStorage.getItem(RELAY_BASE_KEY)).toBe('https://old-relay.example');
+  });
+
+  it('does not contact the built-in relay to clean up when third-party traffic is off', async () => {
+    setNoThirdPartyTraffic(true);
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-old');
+    localStorage.setItem(RELAY_BASE_KEY, DEFAULT_RELAY_BASE_URL);
+    const client = makeClient([sub('push-old', THIS_DEVICE)]);
+    const calls = installFetch({});
+
+    await resyncWebPush({ client, relayBaseUrl: RELAY, inboxOnly: false });
+
+    expect(calls.filter((c) => c.url.startsWith(DEFAULT_RELAY_BASE_URL))).toEqual([]);
+  });
+
   it('re-registers inside the daily limit when the admin switched relays, and only once', async () => {
     localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
     localStorage.setItem(SUB_KEY, 'push-old');
@@ -1388,6 +1960,18 @@ describe('disableWebPush', () => {
     expect(localStorage.getItem(REFUSED_KEY)).toBeNull();
   });
 
+  it('drops the record on the relay it was registered with, not only the current one', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-tracked');
+    localStorage.setItem(RELAY_BASE_KEY, 'https://old-relay.example');
+    const client = makeClient([sub('push-tracked', THIS_DEVICE)]);
+    const calls = installFetch({});
+
+    await disableWebPush({ client, relayBaseUrl: RELAY });
+
+    expect(calls).toContainEqual({ url: `https://old-relay.example/api/push/register/${THIS_DEVICE}`, method: 'DELETE' });
+  });
+
   it('drops the relay registration for this device', async () => {
     localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
     const client = makeClient([]);
@@ -1402,6 +1986,84 @@ describe('disableWebPush', () => {
   });
 });
 
+describe('endWebPushForSignOut', () => {
+  it('takes everything down for a login with push on, using the relay it registered with', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-mine');
+    localStorage.setItem(RELAY_BASE_KEY, RELAY);
+    const client = makeClient([sub('push-mine', THIS_DEVICE)]);
+    const calls = installFetch({});
+
+    await endWebPushForSignOut(client);
+
+    expect(client.destroyed).toEqual(['push-mine']);
+    expect(calls).toEqual([{ url: `${RELAY}/api/push/register/${THIS_DEVICE}`, method: 'DELETE' }]);
+    expect(localStorage.getItem(SUB_KEY)).toBeNull();
+  });
+
+  it('does nothing and calls nobody for a login without push', async () => {
+    const client = makeClient([]);
+    const calls = installFetch({});
+
+    await endWebPushForSignOut(client);
+
+    expect(calls).toEqual([]);
+    expect(client.listPushSubscriptions).not.toHaveBeenCalled();
+  });
+
+  it('never throws: signing out goes on', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-mine');
+    localStorage.setItem(RELAY_BASE_KEY, RELAY);
+    const client = makeClient([sub('push-mine', THIS_DEVICE)]);
+    vi.stubGlobal('fetch', vi.fn(async () => { throw new TypeError('offline'); }));
+    (client.destroyPushSubscription as ReturnType<typeof vi.fn>).mockRejectedValue(new Error('offline'));
+
+    await expect(endWebPushForSignOut(client)).resolves.toBeUndefined();
+    expect(localStorage.getItem(SUB_KEY)).toBeNull();
+  });
+
+  it('forgets the key material with nobody left', async () => {
+    localStorage.setItem(DEVICE_KEY, THIS_DEVICE);
+    localStorage.setItem(SUB_KEY, 'push-mine');
+    localStorage.setItem(RELAY_BASE_KEY, RELAY);
+    const { browserSub } = installPushBrowser();
+    const client = makeClient([sub('push-mine', THIS_DEVICE)]);
+    installFetch({});
+
+    await endWebPushForSignOut(client);
+
+    expect(browserSub.unsubscribe).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('dropAllWebPushRegistrations', () => {
+  it('takes down every login this browser registered, connected or not, and calls no relay it did not use', async () => {
+    const { browserSub } = installPushBrowser();
+    localStorage.setItem('bulwark.push.subscriptionId.v1.a', 'x');
+    localStorage.setItem('bulwark.push.deviceClientId.v1.a', 'device-a');
+    localStorage.setItem('bulwark.push.relayBase.v1.a', RELAY);
+    localStorage.setItem('bulwark.push.subscriptionId.v1.b', 'y');
+    localStorage.setItem('bulwark.push.deviceClientId.v1.b', 'device-b');
+    const calls = installFetch({});
+
+    await dropAllWebPushRegistrations();
+
+    expect(calls).toEqual([{ url: `${RELAY}/api/push/register/device-a`, method: 'DELETE' }]);
+    expect(localStorage.getItem('bulwark.push.subscriptionId.v1.a')).toBeNull();
+    expect(localStorage.getItem('bulwark.push.subscriptionId.v1.b')).toBeNull();
+    expect(browserSub.unsubscribe).toHaveBeenCalledTimes(1);
+  });
+
+  it('does nothing with nothing registered', async () => {
+    const { browserSub } = installPushBrowser();
+    const calls = installFetch({});
+    await dropAllWebPushRegistrations();
+    expect(calls).toEqual([]);
+    expect(browserSub.unsubscribe).not.toHaveBeenCalled();
+  });
+});
+
 describe('listPushDevices', () => {
   it('flags this device and reports the relay status of each registration', async () => {
     localStorage.setItem(DEVICE_KEY, THIS_DEVICE);

lib/admin/password.ts

@@ -6,6 +6,7 @@ import { assertWritable, isConfigReadOnly } from './paths';
 import { adminConfigDocs, adminStateDocs, isStoreUnavailable } from './admin-store';
 import type { AdminConfigData, AdminStateData } from './types';
 import { readFileEnv } from '../read-file-env';
+import { desktopServerSecret } from '@/lib/desktop/server-secrets';
 
 const SCRYPT_KEYLEN = 64;
 const SCRYPT_COST = 16384; // 2^14
@@ -269,7 +270,7 @@ export async function initAdminPassword(): Promise<boolean> {
     return true;
   }
 
-  const envPassword = process.env.ADMIN_PASSWORD;
+  const envPassword = desktopServerSecret('adminPassword') || process.env.ADMIN_PASSWORD;
   if (!envPassword) {
     if (!cache.initialized) logger.info('Admin dashboard disabled (no ADMIN_PASSWORD set)');
     cache.initialized = true;

lib/admin/types.ts

@@ -300,6 +300,9 @@ export const CONFIG_ENV_MAP: Record<string, { envVar: string; fileEnvVar?: strin
   // password. For JMAP servers that hand out API tokens, such as Fastmail,
   // whose API accepts no passwords at all.
   loginShowTokenLogin: { envVar: 'LOGIN_SHOW_TOKEN_LOGIN', type: 'boolean', defaultValue: false },
+  // The desktop app's "Sign in with your browser". Turn off on a terminal server: another
+  // user there can bind a loopback port and send a link that asks for someone's sign-in.
+  desktopBrowserSignIn: { envVar: 'DESKTOP_BROWSER_SIGN_IN', type: 'boolean', defaultValue: true },
   // Show the "Remember me" box on the login form. Off (the default) remembers
   // every sign-in, as long as a SESSION_SECRET makes that possible.
   loginShowRememberMe: { envVar: 'LOGIN_SHOW_REMEMBER_ME', type: 'boolean', defaultValue: false },

lib/app-lock/__tests__/controller.test.ts

@@ -19,16 +19,20 @@ import {
   setReloadForTests,
   startAppLock,
   STAY_RETRY_MS,
+  storeKeyLayers,
   unlockWithOs,
   unlockWithPin,
 } from '../controller';
-import { LOCK_LAYER } from '../crypto';
+import { importLockKey, LOCK_LAYER, lockLayer } from '../crypto';
 import { appLockRequired, effectiveTimeout } from '../policy';
 import { APP_LOCK_KEY, appLockBootScript, isAppLockedNow, readAppLockFile, setLockedHere } from '../state';
-import { createVault, deleteVault, readVault, sealDraft, VaultExistsError } from '../vault';
+import { createVault, deleteVault, openVaultWithPin, readVault, rotateVaultKey, sealDraft, VaultExistsError, WrongPinError } from '../vault';
 
 const PIN = 'correct-pin';
 
+// Setting a PIN and unlocking each run PBKDF2 at 600,000 rounds: over 5 s on a busy machine.
+vi.setConfig({ testTimeout: 30_000 });
+
 class FakeChannel {
   static open = new Set<FakeChannel>();
   onmessage: ((event: MessageEvent) => void) | null = null;
@@ -84,6 +88,7 @@ function bridge(overrides: Record<string, unknown> = {}) {
     prove: vi.fn(async () => true),
     disable: vi.fn(async () => true),
     forget: vi.fn(async () => true),
+    clearOrphan: vi.fn(async () => true),
     osEnroll: vi.fn(async () => true),
     osRemove: vi.fn(async () => {}),
     osUnlock: vi.fn(async () => ({ ok: false as const, reason: 'denied' as const })),
@@ -438,7 +443,128 @@ describe('the store when a tab inherits it without the key', () => {
   });
 });
 
+describe('the desktop app\'s safeStorage on the store\'s key', () => {
+  const shellBridge = () => bridge({
+    status: vi.fn(async () => ({ locked: false, enrolled: true, os: null, osEnrolled: false, wrap: true })),
+    wrap: vi.fn(async (data: Uint8Array) => Uint8Array.from([9, ...data])),
+    unwrap: vi.fn(async (data: Uint8Array) => (data[0] === 9 ? data.slice(1) : null)),
+  });
+
+  it('wraps with the lock off too', async () => {
+    shellBridge();
+    const layers = await storeKeyLayers();
+    expect(layers.map((layer) => layer.name)).toEqual(['safeStorage']);
+    await openAccountKey('off', layers);
+    expect((await getAccountRecord('off'))?.layers).toEqual(['safeStorage']);
+  });
+
+  it('a browser has no such layer', async () => {
+    expect(await storeKeyLayers()).toEqual([]);
+  });
+
+  it('a shell whose storage only obfuscates has none either', async () => {
+    bridge({ status: vi.fn(async () => ({ locked: false, enrolled: false, os: null, osEnrolled: false, wrap: false })) });
+    expect(await storeKeyLayers()).toEqual([]);
+  });
+
+  it('turning the lock on asks for the mail to be re-encrypted; off again keeps the OS\'s layer', async () => {
+    shellBridge();
+    await openAccountKey('acc', await storeKeyLayers());
+    await enableAppLock(PIN);
+    let stored = await getAccountRecord('acc');
+    expect(stored?.layers).toEqual(['safeStorage', 'applock']);
+    expect(stored?.rekey).toBe(true);
+    await disableAppLock(PIN);
+    stored = await getAccountRecord('acc');
+    expect(stored?.layers).toEqual(['safeStorage']);
+  });
+});
+
+describe('changing the PIN', () => {
+  it('makes a new lock key, so what an old copy of the PIN record opens opens nothing now', async () => {
+    await openAccountKey('acc');
+    await enableAppLock(PIN);
+    const before = await readVault();
+    const oldKey = await importLockKey(await openVaultWithPin(PIN));
+    await changeAppLockPin(PIN, 'next-pin-5521');
+    const record = await getAccountRecord('acc');
+    expect(record?.layers).toEqual(['applock']);
+    expect(record?.rekey).toBe(true);
+    // Under the old lock key the record opens no more.
+    await expect(lockLayer(oldKey).unwrap(record!.wrapped)).rejects.toBeDefined();
+    expect((await readVault())?.pin.data).not.toEqual(before?.pin.data);
+    expect((await readVault())?.previous).toBeUndefined();
+    await expect(openVaultWithPin(PIN)).rejects.toBeInstanceOf(WrongPinError);
+    // The store still opens, in this tab, with the key it holds now.
+    await expect(openAccountKey('acc', appLockKeyLayers())).resolves.toMatchObject({ fresh: false });
+  });
+
+  it('survives a crash halfway: a record under the old key moves over at the next unlock', async () => {
+    await openAccountKey('acc');
+    await enableAppLock(PIN);
+    const oldRaw = await openVaultWithPin(PIN);
+    await rotateVaultKey('next-pin-5521', oldRaw);
+    await lockedAndReloaded();
+    await unlockWithPin('next-pin-5521');
+    expect((await readVault())?.previous).toBeUndefined();
+    await expect(openAccountKey('acc', appLockKeyLayers())).resolves.toMatchObject({ fresh: false });
+    expect((await getAccountRecord('acc'))?.rekey).toBe(true);
+  });
+
+  it('the passkey and the OS\'s unlock wrapped the old key: they go, and the caller hears', async () => {
+    const appLock = bridge({ status: vi.fn(async () => ({ locked: false, enrolled: true, os: 'hello', osEnrolled: true, wrap: false })) });
+    await enableAppLock(PIN);
+    const { reenroll } = await changeAppLockPin(PIN, 'next-pin-5521');
+    expect(reenroll).toBe(true);
+    expect((await readVault())?.prf).toBeUndefined();
+    expect(appLock.disable).toHaveBeenCalledTimes(1);
+    expect(appLock.enroll).toHaveBeenCalledTimes(2);
+  });
+});
+
+describe('the renderer at a lock', () => {
+  it('is replaced in the desktop app: a reload stays in the process with the old heap', async () => {
+    const replaceRenderer = vi.fn();
+    const appLock = bridge();
+    appLock.claim = vi.fn(() => ({ lock: appLock.lock, osUnlock: appLock.osUnlock, replaceRenderer })) as never;
+    setReloadForTests(null);
+    const reload = vi.fn();
+    Object.defineProperty(window, 'location', { configurable: true, value: { ...window.location, reload, href: window.location.href, origin: window.location.origin } });
+    await enableAppLock(PIN);
+    stopTab = startAppLock();
+    lockEverywhere();
+    await vi.waitFor(() => expect(replaceRenderer).toHaveBeenCalledTimes(1));
+    expect(reload).not.toHaveBeenCalled();
+  });
+});
+
 describe('the desktop app', () => {
+  const settled = () => new Promise((resolve) => setTimeout(resolve, 50));
+
+  it('asks main to clear a lock this profile has no PIN for', async () => {
+    const appLock = bridge({ status: vi.fn(async () => ({ locked: true, enrolled: true, os: null, osEnrolled: false })) });
+    bootAppLock();
+    await settled();
+    expect(appLock.clearOrphan).toHaveBeenCalledTimes(1);
+    expect(appLock.forget).not.toHaveBeenCalled();
+  });
+
+  it('leaves main alone when there is a vault, so a real lock is never questioned', async () => {
+    const raw = await createVault(PIN);
+    raw.fill(0);
+    const appLock = bridge({ status: vi.fn(async () => ({ locked: true, enrolled: true, os: null, osEnrolled: false })) });
+    bootAppLock();
+    await settled();
+    expect(appLock.clearOrphan).not.toHaveBeenCalled();
+  });
+
+  it('asks nothing when main has no lock', async () => {
+    const appLock = bridge({ status: vi.fn(async () => ({ locked: false, enrolled: false, os: null, osEnrolled: false })) });
+    bootAppLock();
+    await settled();
+    expect(appLock.clearOrphan).not.toHaveBeenCalled();
+  });
+
   it('a PIN unlock proves itself to main, and nothing can just say unlocked', async () => {
     const appLock = bridge();
     await enableAppLock(PIN);
@@ -622,9 +748,9 @@ describe('the desktop app', () => {
     await enableAppLock(PIN);
     expect((await getAccountRecord('acc'))?.layers).toEqual(['safeStorage', LOCK_LAYER]);
     await expect(openAccountKey('acc', appLockKeyLayers())).resolves.toMatchObject({ keyHex });
-    // Off, nothing asks main at a start, so main's wrap goes too.
+    // Off, only the lock's own layer goes: the OS's stays on with no lock too.
     await disableAppLock(PIN);
-    expect((await getAccountRecord('acc'))?.layers).toEqual([]);
+    expect((await getAccountRecord('acc'))?.layers).toEqual(['safeStorage']);
   });
 
   it('forgetting asks main first: a no changes nothing', async () => {

lib/app-lock/__tests__/vault.test.ts

@@ -1,8 +1,8 @@
 import 'fake-indexeddb/auto';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { getAccountRecord, openAccountKey, rewrapAccountKey, StoreKeyLayerMissingError } from '@/lib/store/client/keys';
-import { importLockKey, lockLayer, mainProof, PBKDF2_ITERATIONS, pinIsObvious, pinLongEnough } from '../crypto';
-import { changeVaultPin, createVault, deleteVault, FREE_FAILURES, LONGEST_WAIT_MS, openSealedDrafts, openVaultWithPin, PinBlockedError, pinBlockedUntil, readVault, sealDraft, waitAfter, WrongPinError } from '../vault';
+import { importLockKey, keyFromPin, lockLayer, mainProof, open, PBKDF2_ITERATIONS, pinIsObvious, pinLongEnough } from '../crypto';
+import { rotateVaultKey, createVault, deleteVault, FREE_FAILURES, LONGEST_WAIT_MS, openSealedDrafts, openVaultWithPin, PinBlockedError, pinBlockedUntil, readVault, sealDraft, waitAfter, WrongPinError } from '../vault';
 
 const PIN = 'correct-pin';
 
@@ -97,13 +97,110 @@ describe('in the desktop app, with main\'s safeStorage', () => {
 
   it('a changed PIN goes through main too', async () => {
     const appLock = shell();
-    await createVault(PIN);
-    await changeVaultPin(PIN, 'next-pin-5521');
+    const raw = await createVault(PIN);
+    await rotateVaultKey('next-pin-5521', raw);
     expect(appLock.wrap).toHaveBeenCalledTimes(2);
     expect((await readVault())!.pin.shell).toBe(true);
     await expect(openVaultWithPin('next-pin-5521')).resolves.toBeInstanceOf(Uint8Array);
   });
 
+  describe('with the calls handed out once, and each guess through main', () => {
+    /** What the real preload does: wrap, unwrap and a PIN step only for whoever claims first. */
+    function realShell(answer: (data: Uint8Array) => PinAnswer = stepWithSecret) {
+      let claimed = false;
+      const step = vi.fn(async (data: Uint8Array) => answer(data));
+      const appLock = {
+        status: vi.fn(async () => ({ locked: false, enrolled: false, os: null, osEnrolled: false, wrap: true })),
+        prove: vi.fn(async () => true),
+        claim: vi.fn(() => {
+          if (claimed) return null;
+          claimed = true;
+          return {
+            lock: () => {},
+            osUnlock: async () => ({ ok: false }),
+            wrap: async (data: Uint8Array) => Uint8Array.from([9, ...data]),
+            unwrap: async (data: Uint8Array) => (data[0] === 9 ? data.slice(1) : null),
+            pinStep: step,
+          };
+        }),
+      };
+      (window as unknown as { bulwarkDesktop: unknown }).bulwarkDesktop = { version: 1, platform: 'win32', appLock };
+      return { appLock, step };
+    }
+
+    type PinAnswer = { ok: true; bytes: Uint8Array } | { ok: false; blockedUntil?: number };
+    /** Main's secret mixed in: the same guess gives the same bytes, and only main can make them. */
+    function stepWithSecret(data: Uint8Array): PinAnswer {
+      return { ok: true, bytes: data.map((byte) => byte ^ 0x5a) };
+    }
+
+    it('nothing on the bridge unwraps: a frame reaching it gets nothing', async () => {
+      realShell();
+      await createVault(PIN);
+      const bridge = (window as unknown as { bulwarkDesktop: { appLock: Record<string, unknown> & { claim(): unknown } } }).bulwarkDesktop.appLock;
+      expect(bridge.wrap).toBeUndefined();
+      expect(bridge.unwrap).toBeUndefined();
+      expect(bridge.claim()).toBeNull();
+    });
+
+    it('the PIN key takes main\'s secret, so the record alone can\'t be guessed at', async () => {
+      const { step } = realShell();
+      const raw = await createVault(PIN);
+      const vault = await readVault();
+      expect(vault?.pin.pepper).toBe(true);
+      expect(step).toHaveBeenCalledTimes(1);
+      await expect(openVaultWithPin('wrong-pin-1')).rejects.toBeInstanceOf(WrongPinError);
+      expect(step).toHaveBeenCalledTimes(2);
+      expect(hex(await openVaultWithPin(PIN))).toBe(hex(raw));
+      expect(step).toHaveBeenCalledTimes(3);
+      // Without main's secret the right PIN opens nothing.
+      const plainKey = await keyFromPin(PIN, vault!.pin.salt, vault!.pin.iterations);
+      await expect(open(plainKey, { iv: vault!.pin.iv, data: vault!.pin.data.slice(1) })).rejects.toBeDefined();
+    });
+
+    it('main refusing a guess reads as blocked, not as a wrong PIN', async () => {
+      realShell();
+      await createVault(PIN);
+      delete (window as unknown as { bulwarkDesktop?: unknown }).bulwarkDesktop;
+      const until = Date.now() + 60_000;
+      realShell(() => ({ ok: false, blockedUntil: until }));
+      await expect(openVaultWithPin(PIN)).rejects.toMatchObject({ name: 'PinBlockedError', until });
+    });
+
+    it('a secret main lost is the shell\'s trouble, not a wrong PIN', async () => {
+      realShell();
+      await createVault(PIN);
+      delete (window as unknown as { bulwarkDesktop?: unknown }).bulwarkDesktop;
+      realShell(() => ({ ok: false }));
+      await expect(openVaultWithPin(PIN)).rejects.toMatchObject({ name: 'VaultShellError' });
+    });
+
+    it('a right PIN tells main, which alone can clear its count', async () => {
+      const { appLock } = realShell();
+      const raw = await createVault(PIN);
+      await openVaultWithPin(PIN);
+      expect(appLock.prove).toHaveBeenCalledTimes(1);
+      expect(Array.from(appLock.prove.mock.calls[0][0 as never] as unknown as Uint8Array)).toEqual(Array.from(await mainProof(raw)));
+    });
+
+    it('a record from before gets main\'s secret at its next right PIN', async () => {
+      shell();
+      const raw = await createVault(PIN);
+      expect((await readVault())?.pin.pepper).toBeUndefined();
+      delete (window as unknown as { bulwarkDesktop?: unknown }).bulwarkDesktop;
+      realShell();
+      expect(hex(await openVaultWithPin(PIN))).toBe(hex(raw));
+      expect((await readVault())?.pin.pepper).toBe(true);
+      expect(hex(await openVaultWithPin(PIN))).toBe(hex(raw));
+    });
+
+    it('a wrap main refuses stops the setup: the PIN record isn\'t left without the OS\'s layer', async () => {
+      shell({ wrap: vi.fn(async () => null) });
+      await expect(createVault(PIN)).rejects.toMatchObject({ name: 'VaultShellError' });
+      expect(await readVault()).toBeNull();
+    });
+  });
+
   it('a shell whose storage only obfuscates: no wrap, and it says so in the record', async () => {
     const appLock = shell({ status: vi.fn(async () => ({ locked: false, enrolled: false, os: null, osEnrolled: false, wrap: false })) });
     await createVault(PIN);

lib/app-lock/controller.ts

@@ -21,6 +21,7 @@ import { getDesktopBridge } from '@/lib/desktop/bridge';
 import { setAppLockCheck } from '@/lib/desktop/app-lock-state';
 import { restoreUrlFor } from '@/lib/desktop/window-restore';
 import { IS_LITE } from '@/lib/lite';
+import { useOfflineStore } from '@/lib/offline/state';
 import { keepRescuedDraft } from '@/lib/popout/rescued-drafts';
 import { closePopoutWindow, isPopoutWindow } from '@/lib/popout/window-role';
 import { getStore, type StoreBackend } from '@/lib/store/client/api';
@@ -28,13 +29,13 @@ import { forgetAccountKey, listAccountRecords, rewrapAccountKey, StoreKeyLayerMi
 import { purgeStoreFiles } from '@/lib/store/client/purge';
 import { purgeSignedOutData } from '@/lib/sign-out-cleanup';
 import { OWNER_LOCK } from '@/lib/store/worker/protocol';
-import type { DesktopOsUnlockAnswer } from '@/lib/desktop/types';
 import type { ComposerDraftData } from '@/components/email/email-composer';
-import { importLockKey, LOCK_LAYER, lockLayer, mainProof, SHELL_LAYER } from './crypto';
+import { importLockKey, LOCK_LAYER, lockLayer, mainProof, ObviousPinError, pinIsObvious, randomBytes, SHELL_LAYER } from './crypto';
 import { watchIdle } from './idle';
 import { createPasskey, passkeyPrf, PasskeyNoPrfError } from './passkey';
 import { appLockRequired, effectiveTimeout, onLockPolicyChange } from './policy';
 import { reloadSealedStores, restoreSealedStorage, scrubBrowserStorage } from './scrub';
+import { shellControls, shellHasWrap, shellUnwrapCall, shellWrapCall, resetShellForTests } from './shell';
 import { clearPendingCookies, markCookiesToClear, rememberMainProof, requireFreshLogin } from './sign-out';
 import {
   APP_LOCK_CHANNEL,
@@ -51,14 +52,16 @@ import {
 } from './state';
 import {
   addVaultPrf,
-  changeVaultPin,
+  clearVaultPrevious,
   createVault,
   deleteVault,
   openSealedDrafts,
+  openVaultPrevious,
   openVaultWithPin,
   openVaultWithPrf,
   readVault,
   removeVaultPrf,
+  rotateVaultKey,
   sealDraft,
   vaultExists,
 } from './vault';
@@ -105,18 +108,10 @@ let stopStay: (() => void) | null = null;
 let enabling = false;
 /** Main's wrap for the keys, when it has a real one. Known once asked: unlocking and enabling ask first. */
 let shellWraps = false;
+let shellAsked = false;
 
-/**
- * The two calls a same-origin frame mustn't reach: a frame can get at the parent's bridge, and
- * main can't tell those calls apart (the shell's ipc.ts). The preload hands them out once per
- * document, and this takes them in the first render, before any frame exists.
- */
-let controls: { lock: () => void; osUnlock: () => Promise<DesktopOsUnlockAnswer> } | null | undefined;
-
-function desktopControls() {
-  if (controls === undefined) controls = getDesktopBridge()?.appLock?.claim() ?? null;
-  return controls;
-}
+/** See lib/app-lock/shell.ts. Taken in the first render, before any frame exists. */
+const desktopControls = shellControls;
 
 function setPhase(next: AppLockPhase): void {
   if (phase === next) return;
@@ -191,6 +186,7 @@ export function bootAppLock(): void {
     return;
   }
   markDocument(false);
+  void clearOrphanedDesktopLock();
   // The look already came back empty: nothing to hold back for.
   if (headScriptFoundNoVault() && !setupNeeded()) return;
   hold = newHold();
@@ -203,6 +199,19 @@ export function bootAppLock(): void {
   void settleNoFile();
 }
 
+/**
+ * Main keeps a lock and there is no vault for it: a same-origin plugin frame enrolled one, or
+ * this profile's storage went. Nothing here could ever prove it, so tray, toasts and titles would
+ * stay blank for good. No page can lift main's lock on its word, so main asks the user.
+ */
+async function clearOrphanedDesktopLock(): Promise<void> {
+  const member = getDesktopBridge()?.appLock;
+  if (!member?.clearOrphan) return;
+  const status = await member.status().catch(() => null);
+  if (!status?.enrolled || await vaultExists() || enabling || readAppLockFile().on) return;
+  await member.clearOrphan().catch(() => false);
+}
+
 function lockedFromNow(): void {
   writeAppLockFile({ ...readAppLockFile(), on: true, locked: true });
   setLockedHere(true);
@@ -438,8 +447,18 @@ async function outboxAtRest(): Promise<void> {
 
 let reloadSeam: (() => void) | null = null;
 
+/**
+ * In the desktop app in a new renderer process: what JS can't overwrite is only gone with the
+ * process it's in, and a reload stays in the same one. A browser gives a page no such thing, so
+ * there the old heap is unreachable, not gone.
+ */
 function reloadPage(): void {
-  if (reloadSeam) reloadSeam();
+  if (reloadSeam) {
+    reloadSeam();
+    return;
+  }
+  const replace = desktopControls()?.replaceRenderer;
+  if (replace) replace();
   else window.location.reload();
 }
 
@@ -554,7 +573,8 @@ async function proveToMain(proof: Uint8Array): Promise<void> {
 
 async function askShell(): Promise<void> {
   const member = getDesktopBridge()?.appLock;
-  shellWraps = member?.wrap ? Boolean((await member.status().catch(() => null))?.wrap) : false;
+  shellWraps = member ? await shellHasWrap() : false;
+  shellAsked = true;
 }
 
 async function holdAndOpen(raw: Uint8Array): Promise<void> {
@@ -570,6 +590,7 @@ async function holdAndOpen(raw: Uint8Array): Promise<void> {
   await askShell();
   await becomeHolder();
   const key = heldKey!;
+  await moveFromPreviousKey(key);
   await addLayerWhereMissing(key);
   await storeBackend().unlock?.(OWNER_WAIT_MS);
   // Before the app below starts, and before the others hear: they read it again when they do.
@@ -618,33 +639,61 @@ export async function unlockWithOs(): Promise<boolean> {
 
 // ---- The account keys ----
 
-/** A store record made when the lock was off, or before a crash: it gets the layer now. */
+/**
+ * A store record made when the lock was off, or before a crash: it gets the layer now. Whatever
+ * wraps it already has to come off to get at the key, and goes back on under the lock. One that
+ * can't (a copied profile) doesn't keep the others shut, and the app says so.
+ */
 async function addLayerWhereMissing(key: CryptoKey): Promise<void> {
   const layer = lockLayer(key);
   const shell = shellLayer();
+  const wanted = shell ? [shell, layer] : [layer];
   for (const record of await listAccountRecords().catch(() => [] as AccountRecord[])) {
-    if (record.layers.includes(LOCK_LAYER)) continue;
-    // Whatever wraps it already has to come off to get at the key, and goes back on under the lock.
-    await rewrapAccountKey(record.account, shell ? [shell] : [], shell ? [shell, layer] : [layer]).catch((error: unknown) => {
-      // One account's record that can't open here (a copied profile) doesn't keep the others shut.
+    if (record.layers.join() === wanted.map((entry) => entry.name).join()) continue;
+    await rewrapAccountKey(record.account, wanted, wanted).catch((error: unknown) => {
       console.warn('[app-lock] A record stays without the layer:', (error as Error)?.name);
+      useOfflineStore.setState({ keyUnprotected: true });
     });
   }
 }
 
-/** Off again, and main's wrap with it: with the lock off nothing asks main, and a start must not need it. */
+/** Off again. The OS's layer stays: it's there with the lock off as well. */
 async function removeLayerEverywhere(key: CryptoKey): Promise<void> {
   const layer = lockLayer(key);
   const shell = shellLayer();
   for (const record of await listAccountRecords().catch(() => [] as AccountRecord[])) {
-    if (record.layers.length > 0) await rewrapAccountKey(record.account, shell ? [shell, layer] : [layer], []);
+    if (record.layers.includes(LOCK_LAYER)) await rewrapAccountKey(record.account, shell ? [shell, layer] : [layer], shell ? [shell] : []);
   }
 }
 
-/** The desktop's safeStorage around the database key (the build prompt's second layer), while the lock is on. */
+/** A changed PIN made a new lock key. Every store key moves over before the old one goes. */
+async function moveFromPreviousKey(key: CryptoKey): Promise<void> {
+  const old = await openVaultPrevious(key).catch(() => null);
+  if (!old) return;
+  const oldKey = await importLockKey(old);
+  old.fill(0);
+  const shell = shellLayer();
+  const layers = (lock: CryptoKey) => (shell ? [shell, lockLayer(lock)] : [lockLayer(lock)]);
+  let allMoved = true;
+  for (const record of await listAccountRecords().catch(() => [] as AccountRecord[])) {
+    if (!record.layers.includes(LOCK_LAYER)) continue;
+    try {
+      await rewrapAccountKey(record.account, layers(oldKey), layers(key), { rekey: true });
+    } catch {
+      // Under the new key already, from a try that stopped halfway? Then this goes through.
+      await rewrapAccountKey(record.account, layers(key), layers(key), { rekey: true }).catch(() => {
+        allMoved = false;
+      });
+    }
+  }
+  if (allMoved) await clearVaultPrevious();
+}
+
+/** The desktop's safeStorage around the database key (the build prompt's second layer), lock or no lock. */
 function shellLayer(): WrapLayer | null {
-  const member = getDesktopBridge()?.appLock;
-  if (!shellWraps || !member?.wrap || !member.unwrap) return null;
+  const wrap = shellWrapCall();
+  const unwrap = shellUnwrapCall();
+  if (!shellWraps || !wrap || !unwrap) return null;
   const through = async (run: (data: Uint8Array) => Promise<Uint8Array | null>, data: Uint8Array) => {
     const out = await run(data);
     if (!out) throw new StoreKeyLayerMissingError(SHELL_LAYER);
@@ -652,19 +701,25 @@ function shellLayer(): WrapLayer | null {
   };
   return {
     name: SHELL_LAYER,
-    wrap: (data) => through(member.wrap, data),
-    unwrap: (data) => through(member.unwrap, data),
+    wrap: (data) => through(wrap, data),
+    unwrap: (data) => through(unwrap, data),
   };
 }
 
 /** What the store's key handling uses. Throws while this tab has no key, so nothing opens or gets written unwrapped. */
 export function appLockKeyLayers(): readonly WrapLayer[] {
-  if (!readAppLockFile().on) return [];
-  if (!heldKey) throw new StoreKeyLayerMissingError(LOCK_LAYER);
   const shell = shellLayer();
+  if (!readAppLockFile().on) return shell ? [shell] : [];
+  if (!heldKey) throw new StoreKeyLayerMissingError(LOCK_LAYER);
   return shell ? [shell, lockLayer(heldKey)] : [lockLayer(heldKey)];
 }
 
+/** The same, for a start that hasn't asked main yet whether it has a real key store. */
+export async function storeKeyLayers(): Promise<readonly WrapLayer[]> {
+  if (!shellAsked) await askShell();
+  return appLockKeyLayers();
+}
+
 /** This tab inherited the store and has no key for it. */
 export function onStoreKeyMissing(): void {
   lockEverywhere();
@@ -718,6 +773,7 @@ async function enable(pin: string): Promise<void> {
   openUp();
   // Another tab has the store open and no key for what comes next. Everyone starts over.
   if (await ownerIsElsewhere()) lockEverywhere();
+  else void storeBackend().rekeyPending?.();
 }
 
 /** Off again. The PIN proves it's the owner of the lock, in this tab or any other. */
@@ -764,8 +820,44 @@ function afterOff(): void {
   hold = null;
 }
 
-export function changeAppLockPin(currentPin: string, newPin: string): Promise<void> {
-  return changeVaultPin(currentPin, newPin);
+/**
+ * A new PIN takes a new lock key and, in the background, new store keys: the old PIN's record can
+ * stay in the browser's files, and must not open anything any more. Main hears first, so that
+ * wherever this stops the vault can still be opened. `reenroll`: the passkey and the OS's unlock
+ * held the old key, and have to be set up again.
+ */
+export async function changeAppLockPin(currentPin: string, newPin: string): Promise<{ reenroll: boolean }> {
+  if (pinIsObvious(newPin)) throw new ObviousPinError();
+  const member = getDesktopBridge()?.appLock;
+  const hadOther = Boolean((await readVault())?.prf) || Boolean((await member?.status().catch(() => null))?.osEnrolled);
+  const oldRaw = await openVaultWithPin(currentPin);
+  const newRaw = randomBytes(32);
+  try {
+    const hadKey = heldKey !== null;
+    const newProof = await mainProof(newRaw);
+    if (member) {
+      await letMainGo(await mainProof(oldRaw));
+      if (!(await member.enroll(newProof))) throw new Error('The desktop app refused the lock');
+    }
+    await rotateVaultKey(newPin, oldRaw, newRaw);
+    // Setting the new PIN went through main's count too.
+    await member?.prove(newProof).catch(() => false);
+    const key = await importLockKey(newRaw);
+    await askShell();
+    await moveFromPreviousKey(key);
+    if (!hadKey) {
+      // Another tab holds the old key: everyone starts over with the new one.
+      lockEverywhere();
+      return { reenroll: hadOther };
+    }
+    heldKey = key;
+    rememberMainProof(newProof);
+    void storeBackend().rekeyPending?.();
+    return { reenroll: hadOther };
+  } finally {
+    oldRaw.fill(0);
+    newRaw.fill(0);
+  }
 }
 
 export function setAppLockTimeout(minutes: number): void {
@@ -972,9 +1064,10 @@ export function resetAppLockForTests(): void {
   stopIdle?.();
   stopIdle = null;
   stopStay?.();
-  controls = undefined;
+  resetShellForTests();
   enabling = false;
   shellWraps = false;
+  shellAsked = false;
   rememberMainProof(null);
   listeners.clear();
   setLockedHere(false);

lib/app-lock/crypto.ts

@@ -18,6 +18,7 @@ export const MIN_PIN_LENGTH = 6;
 const AES = { name: 'AES-GCM', length: 256 } as const;
 const PRF_INFO = new TextEncoder().encode('bulwark-app-lock-prf-v1');
 const PROOF_INFO = new TextEncoder().encode('bulwark-app-lock-main-proof-v1');
+const PIN_STEP_INFO = new TextEncoder().encode('bulwark-app-lock-pin-step-v1');
 
 export interface WrappedBytes {
   iv: Uint8Array;
@@ -89,6 +90,24 @@ export async function keyFromPin(pin: string, salt: Uint8Array, iterations: numb
   );
 }
 
+/** What goes to main for a PIN guess: the slow part, done here. Nobody needs to see the PIN itself. */
+export async function bitsFromPin(pin: string, salt: Uint8Array, iterations: number): Promise<Uint8Array> {
+  const base = await crypto.subtle.importKey('raw', buffer(pinBytes(pin)), 'PBKDF2', false, ['deriveBits']);
+  return new Uint8Array(await crypto.subtle.deriveBits({ name: 'PBKDF2', hash: 'SHA-256', salt: buffer(salt), iterations }, base, 256));
+}
+
+/** The key under the PIN from what main made of a guess, with a secret only it has. */
+export async function keyFromPinStep(bytes: Uint8Array): Promise<CryptoKey> {
+  const base = await crypto.subtle.importKey('raw', buffer(bytes), 'HKDF', false, ['deriveKey']);
+  return crypto.subtle.deriveKey(
+    { name: 'HKDF', hash: 'SHA-256', salt: new ArrayBuffer(0), info: PIN_STEP_INFO },
+    base,
+    AES,
+    false,
+    ['encrypt', 'decrypt'],
+  );
+}
+
 /** A key from what an authenticator's PRF gave: 32 bytes that only it can make again. */
 export async function keyFromPrf(output: ArrayBuffer | Uint8Array): Promise<CryptoKey> {
   const bytes = output instanceof Uint8Array ? output : new Uint8Array(output);

lib/app-lock/shell.ts

@@ -0,0 +1,51 @@
+/**
+ * The calls only the page itself may make to the desktop app's main process. A same-origin frame
+ * reaches `bulwarkDesktop` through `parent`, and main can't tell its calls from the page's. So the
+ * preload hands these out once per document, and the page takes them in its first render, before
+ * any frame exists. Imports next to nothing, for lib/app-lock/vault.ts and controller.ts alike.
+ */
+
+import { getDesktopBridge } from '@/lib/desktop/bridge';
+import type { DesktopAppLockBridge, DesktopAppLockControls } from '@/lib/desktop/types';
+
+let claimedFrom: DesktopAppLockBridge | null = null;
+let claimed: DesktopAppLockControls | null = null;
+
+export function shellControls(): DesktopAppLockControls | null {
+  const member = getDesktopBridge()?.appLock ?? null;
+  if (member !== claimedFrom) {
+    claimedFrom = member;
+    claimed = member?.claim?.() ?? null;
+  }
+  return claimed;
+}
+
+/** A shell older than the webmail it loads has these on the bridge. */
+function olderShell(): Pick<DesktopAppLockControls, 'wrap' | 'unwrap'> {
+  return (getDesktopBridge()?.appLock ?? {}) as unknown as Pick<DesktopAppLockControls, 'wrap' | 'unwrap'>;
+}
+
+export function shellWrapCall(): DesktopAppLockControls['wrap'] {
+  return shellControls()?.wrap ?? olderShell().wrap;
+}
+
+export function shellUnwrapCall(): DesktopAppLockControls['unwrap'] {
+  return shellControls()?.unwrap ?? olderShell().unwrap;
+}
+
+/**
+ * Whether this computer has a real key store the app can use. No: a browser, or Linux with no secret
+ * service, and settings say so. A shell that doesn't answer isn't a no: this rejects, so nobody
+ * writes a key without the layer because of it.
+ */
+export async function shellHasWrap(): Promise<boolean> {
+  const member = getDesktopBridge()?.appLock;
+  if (!member || !shellWrapCall()) return false;
+  return Boolean((await member.status()).wrap);
+}
+
+/** Tests only. */
+export function resetShellForTests(): void {
+  claimedFrom = null;
+  claimed = null;
+}