Release v0.0.18 · bchoor/mailcellar

Key takeaways

[Feature] [Security] Always show images from senders you trust: In the message panel, the "Show images" button now has a ▾ menu to always show images from a sender's domain or exact address, but only when Gmail confirmed the message really came from that sender.
[Fix] Gmail sync restarts itself after a dropped run: Background Gmail sync for every connected account now re-schedules its next run if Cloudflare dropped it, so new mail keeps arriving in your archive without you doing anything.
[Fix] Messages page shows all columns again: On the Messages page, the table now shows all seven columns (Date, Sender, Subject, Category, Labels, Size, Attachments) even with the sidebar and message panel open, and scrolls sideways when it is too narrow.
[Improvement] Open tabs pick up new versions: In any MailCellar tab left open across an update, the page reloads onto the new version when its files are gone, or offers a Reload button when a new version is out.
[Fix] People shows "App access": On the People page, the access column is now labeled "App access" instead of "MailCellar", and the Admins tile reads "Can’t remove the last admin".

The message panel's "Show images" menu offers "Always show images from" the sender's main domain (mail.example.com becomes example.com) or the exact address. Shared mail domains such as gmail.com offer the address only.
Mail from an allowed sender opens with images shown, an "Allowed: example.com" label and one icon to stop. Allowing and stopping both show an Undo toast.
Senders Gmail could not confirm get a one-time "Show" only, with a line explaining why.
Every image you choose to show now loads through MailCellar instead of straight from the web. The mail can't reach outside sites directly, and the browser doesn't send cookies or a referrer.
On the Messages page, the open row no longer draws a focus ring over its highlight while you step through messages with ↑ and ↓. A focused row that isn't open keeps its ring.
Requests that hang now show an error after 15 seconds for reads and 60 seconds for writes, instead of waiting forever.
The interface kit is updated, which also keeps the sideways scroll position steady when a row opens so Date doesn't slide out of view.

Remembered image senders count only when Gmail's own check passed for the From domain. A pass on the sender's SPF record alone is not enough.

A scheduled sync that is missing, or more than a minute overdue, is treated as dead and set up again when the mailbox starts or you visit.
If a sync run fails, it now retries an hour later instead of exhausting its retries and being dropped. This is what stopped Gmail sync after Cloudflare's daily free-tier limit was hit.
On the first start after this release, each Gmail account runs a normal incremental sync to catch up. There is no full backfill.
One-time maintenance work (filling labels, refilling search, cleaning Spam and Trash) now runs in small steps after the mailbox starts, so it can't hold up your first request.

Remembered image senders are saved per user, up to 2,000.
Database writes now name their columns, so an older version keeps working after an update adds a column and a rollback is safe.

Telemetry now runs on the shared Lumen ops tooling. It records requests, Durable Object and R2 use, Gmail calls and refusals, and browser views, failed requests, Web Vitals and crashes. Responses also carry Server-Timing.
The old telemetry dataset and its binding are removed. Nothing is lost, and past data stays queryable until it ages out.
Updates are now checked with an upgrade test before merge, plus a live check with rollback after deploy.
CI now runs on OpenShip direct instead of GitHub's job queue, with the same jobs and steps. The CI cache is turned off because OpenShip direct has no cache server, which saves about 3 minutes per run.

#183 infra: run CI on OpenShip direct, not through GitHub's job queue (@bchoor)
#182 fix: Messages shows every column with the sidebar and message panel open; kit 0.1.168 (@bchoor)
#181 feat: remember senders whose images show, only when Gmail confirmed them (@bchoor)
#180 fix: Gmail sync re-arms an alarm Cloudflare dropped; a failed alarm retries in an hour (@bchoor)
#179 infra: drop the old mailcellar_telemetry points; mailcellar_requests is confirmed live (@bchoor)
#178 fix: People's access column reads "App access"; kit 0.1.129 (@bchoor)
#177 infra: telemetry on Lumen ops (mailcellar_requests), Server-Timing, /api/t and /api/client-error (@bchoor)
#176 infra: nothing on start may stall prod; e2e upgrade test before merge; live check with rollback after deploy (@bchoor)
#175 fix: bump the kit to 0.1.126; the open row drops its focus ring (@bchoor)