Settings > Account had a "Display name" that edited Stalwart's account
description, while mail went out with the identity's name, so changing
it changed nothing people saw. The page now shows "Your name", the
primary address's name, and saves it to that identity. The account
switcher and avatars take the same name; the principal description is
only used for an account without an identity name. The address editor
calls the field "Your name" too, and "identities" are "addresses" in
the Account section and its dialog, said once instead of twice.
Logged-in accounts show the server only for an account in trouble or
one sharing its address with another, with no drag hint or arrows for a
single account. The switcher wraps addresses instead of cutting them and
has no remove button per row; an account you're not in is removed from
Settings > Account.
Changed tests: auth-store-display-name now expects the identity name to
win over the principal; account-switcher-remove expects no remove
button on the rows; settings-editors-unsaved uses the renamed "Add
address" button and the "Your name" label, which has no placeholder.
Settings search knew none of the desktop app's rows, short words matched
a dozen descriptions, and the app's Notifications, Privacy and Backup
pages talked about websites, browsers and Safari.
- Search indexes the app's rows when its bridge is there (tray, start at
sign-in, menu bar, quiet hours, taskbar, default mail app, updates,
developer tools, usage info, crash reports) with translated synonyms,
and the browser-only push rows only in a browser. New synonyms for
threads, block images, dark mode, timezone, reading pane, week start,
empty trash and quiet hours. A single word of up to five letters looks
only in names and synonyms, so "about" finds About.
- In the app, Notifications has no push relay section; one row says the
app tells about new mail while it runs, with a link to General. Its
taskbar and quiet hours section is "On this computer". Privacy has no
relay link there, Backup says "other devices".
- In a browser that can't push, two sentences, and the home screen hint
only on iPhone and iPad.
- Several accounts get one notification switch each instead of a
checklist with "Enable for selected" and "Disable for selected".
- Developer tools show only with advanced settings on.
- "Two-step sign-in" heads its section, "Pictures from company websites"
replaces "Sender favicons", the Privacy relay link no longer points to
a hidden choice, Offline warns about disk encryption once, and the
reset confirm says what stays and whether other devices change. A
reset keeps the choice to sync settings.
Changed assertions: account-security-signin looks for the heading by its
new name, settings-search expects the renamed rows, multi-account-push
tests the switches that replace the checklist.
The contact menus offered "Duplicate", which made more copies. They now
offer "Merge with…", the selection bar has "Merge…" for two or more
contacts, and a "Possible duplicates (n)" line over the list opens a view
that groups cards with the same name, email address or phone. The test
that expected "Duplicate" in both menus now expects "Merge with…", and
the test for a failed duplicate became tests for merging.
An upload over a name that is taken in the target folder used to add
"name (1)" without a word. Every upload path (picker, drag and drop, the
drop overlay, folder upload) now asks per name, with "Do this for all n
conflicts" when there are several:
- Replace gives the existing node the new blob, so it keeps its id,
shares and links; for a folder it merges into the existing one and
replaces files of the same name.
- Keep both numbers the new one, as before.
- Skip leaves it out; Cancel stops the whole upload.
Also in Files:
- A file with no preview and no office editor opens a pane with its
icon, size and Download instead of downloading at once, and in the
desktop app also Open in default app (the attachment Edit path). The
item menu gets Open for such files, and Open in default app in the
desktop app.
- Enter opens the row Tab put the focus on.
- After sharing with someone new, a toast offers Send a message, which
opens the composer to them with a link to the file.
- The empty folder's buttons read Upload files... and New folder..., as
the menus do.
The settings pass hid each calendar's CalDAV address behind "Use in
other apps"; pim-26 lists the address once per account. The list now
waits behind one "Use in other apps" button, and the wording test
clicks the new Edit… button instead of the old pencil.
A window snapped to half the screen (640-800 px) or a 1366x768 laptop
at 150 % (911 px) got the phone and tablet layout: bottom tab bar,
folders in a drawer, Settings as a phone list with a Back arrow. The
layout switched at the 64rem (1024 px) breakpoint.
Now the phone layout starts below 600 px. From 600 to 1024 px the app
is a compact desktop: app rail at the side, folder sidebar folded to
its icons (the existing collapsed state, opened per session with its
toggle), Settings with its two panes and a narrower page list. Below
840 px the split layout opens a message in the list's place, as the
focused layout does. This holds in the browser and the desktop app,
in the Pro shell (which now runs from 600 px) and under Mountain View.
- `hooks/use-media-query.ts`: classifyWidth, PHONE_BELOW 600,
FULL_DESKTOP 1024; the tablet class (`isTablet`) is gone, the store
has `isCompact` instead. Plugins still see "tablet" for it.
- `app/globals.css`: a `desk:` breakpoint at 37.5rem for the layout
classes, and a `tap:` variant for 44px rows on phones and touch
screens below 1024 px (was every window below 1024 px).
- Touch screens below 1024 px keep swiping list rows (was phones only).
- The boot skeletons, boot script, mail app, sidebar, reader, admin
shell and calendar, contacts and files follow the new widths.
Tests changed with the behaviour: the tablet cases in pro-gate,
mail-app-mv-composer-move, mail-app-compose-handoff,
mail-app-thread-expand-mark-read, mobile-tour-end and
thread-list-item-columns now run on a phone or a compact desktop, as
those widths no longer exist as a tablet. mail-app-short-window-tab-bar
is replaced by mail-app-compact-layout: a phone on its side is a
compact desktop with the rail at the side, so the short-window tab bar
rule is gone. Class and media-query assertions follow desk:/tap: and
37.5rem; the 32px-text test uses 1100 px, since 1440 px at 32px is now
a compact desktop.
With two accounts signed in, Calendar showed only the active one's
calendars. Now, as in the Pro interface, the sidebar lists each
account's calendars under its name, each with its own checkbox, ticked
by default, and the grid shows the ticked ones together. Creating,
editing, moving, deleting and answering an event of the other account
go through that account; tasks of all accounts are listed and change in
their own account.
- a calendar one account sees as shared and the other owns shows once
- a load or push that names one account keeps the merged list
- an event made in the other account's calendar no longer takes the id
of the active account's event with the same raw id
- a change to an event the store no longer holds still goes to the
account its id names
The tasks view filtered tasks by the grid's calendar selection, which
never holds a task-only list such as "To-do". Those tasks never showed
while the sidebar counted them, and a task moved into To-do vanished on
save. The tasks view now has its own task lists in the sidebar, ticked
by default, and the grid's selection is left alone.
- tasks are on by default; an "off" the user never chose turns on, one
they chose stays
- new tasks go to the first task-only list
- "Add a task…" reads a date at the end of the title (tomorrow, Friday,
12.11.) into the due date and shows it as a chip first
- the task status says "Not started" and "In progress"
filterTasksForList now takes the unticked task lists instead of the
selected calendars, so task-plugin-surfaces passes the unticked list and
task-list-dates no longer passes selectedCalendarIds.
The #1327 store test now serves its optional plugin with defaultOn false:
it checks that every plugin is listed when IndexedDB fails, and a plugin
the admin didn't force is on by default now.
The plain-language test asserted that the normal strings show while the switch is off and that changing the switch swaps them live. With no switch left, it now asserts the plain strings show from the first render and through a language change.
The policy-defaults test now expects the new build default of 5 seconds
for an invalid admin value, and the settings-search tests look for the
row under its new label "Undo send".
Two sidebar tests asserted the old unread-count button (it filtered the
folder to unread without opening it, in a 24px target); they now check
that the count is plain text and opens the folder.
The default layout's switcher listed accounts without their unread, so an
existing test asserted that (account-switcher-mountain-view, 'unread-free');
it now expects each account's count. The idle-outside-Pro hook test now
uses one account, since a second connected account loads in every layout.
The review found the store key readable from a copy of the disk. The
desktop app only added its OS layer with the lock on, the record from
before a lock stayed in LevelDB and opened the mail with no PIN, any
frame could unwrap the PIN record and guess at it, a lock left the key
in the renderer's memory, and a store waiting after a refused login went
to whoever signed in next under the same username@host.
- The desktop app wraps the store key with safeStorage, lock or no lock.
A record without the layer gets it at its next open. A refusal is said
out loud, and only a computer with no key store goes without, which
settings say. So do they for a browser, which has no such layer.
- A record that gained layers, and every record after a changed PIN, asks
for a new key: `sqlite3_backup` into a new file under a new key while
the store keeps working, one write to the record, then the old file
goes. A changed PIN makes a new lock key, since the old PIN's record
stays on disk too. The passkey and OS unlock go with the old key.
- `wrap` and `unwrap` come through `claim()`, and the key under the PIN
takes a secret from main, one counted trip per guess.
- A lock on the desktop ends the renderer rather than reload in it.
- A sign-in compares the waiting store's JMAP account and server first,
and wipes on a mismatch. The account id keeps its form: every store,
setting and server record of an account is keyed by it.
- The 30 days also run in an app that stays open.
Changes an existing assertion: turning the lock off now keeps the
safeStorage layer, by decision, so that test expects it to stay.
The shell now takes a message's signed attributes where it took a digest,
so a page can't get a login or TLS digest signed. A quiet option lets a
plugin answer from what's allowed, for anything the user didn't ask for.
An admin's install no longer covers the certificates on someone's own
computer: a managed plugin gets `keystore` when that person says yes, also
when an update adds it, and it's forgotten once everyone has signed out.
Changed test assertions: the fixture plugin needs a grant now, as managed
alone is no longer enough, and the bridge gets an options argument.
The hand-off parked a password before its question, for up to five
minutes, and on a shared computer another local user could ask for
someone's sign-in with a link of their own. Now nothing leaves the page
before the yes, and the instance has a switch for such machines.
- `/check` tests a password and keeps nothing, `/park` runs on the yes and
hands over tokens wherever the server allows, a password as a last
resort
- `/discard` and a timer take out what SSO has to park first, and a no
revokes the refresh token, and the shared store's TTL is the real expiry
- `DESKTOP_BROWSER_SIGN_IN`, default on, closes the routes, the page's
hand-off and the app's button; the question says which device asked
- tokens from a typed password stay a password account under the name
typed (#1432)
- redeem refuses a server of the user's own when the device's rule says
no
- the park budget is reserved before going upstream, and only failures
count
- "Not now" ends the flow in the app at once, and the question names the
account
`desktop-handoff-routes.test.ts` now tests the two-step flow against the
real budgets. `sso-start-route.test.ts`'s config mock answers the new
setting, and the SSO test's expected answer has the account in it.
Linus Rath