Keep settings with the account, not the browser

Every setting lived in localStorage, so none of them travelled between
devices. The sharpest edge is the default identity: with none set the
address that sorts first wins, so mail goes out from an address the
recipient may not recognise -- and someone who sets it at work finds it
unset at home, with nothing to say so. Reported in #54.

They now live in a settings.json in the account's own JMAP Files, beside
the signature images already kept there. ihasmail itself stays stateless:
no volume, no database, nothing to back up separately, and the settings
are covered by whatever backs up the mail store.

localStorage stays as a cache rather than the source of truth, so the
first frame is painted from it and the file corrects it a moment later.
A private window has no cache and shows defaults for that one frame,
which is the trade for not gating the whole app on a network round trip.

Not everything should follow the account. A list-pane width picked on a
27" monitor is wrong on a laptop, and the notification toggles track a
permission the browser grants per-device, so claiming it elsewhere would
be a lie. Those stay local, written as a list of exceptions so that a
setting added later syncs by default -- which is what adding one almost
always means.

Writes are coalesced: update() fires on every frame of a splitter drag,
so a change waits 3s and the newest value wins. A tab going away flushes
first, as does signing out, so a setting changed seconds before either
is not lost.

The ihasmail folder is now hidden from the Files view, contents and all.
Hiding the folder alone would have been worse than showing it: the tree
attaches a node whose parent is missing to the root, so the signature
images would have spilled into the top level as if the user had put them
there. Those images have been visible since signatures shipped.

Requires 0.16 -- FileNode/query cannot see directories before that. On
0.15 settings stay local exactly as they were.

Verified against the mock end to end: folder create, blob upload, node
create, read back, update, re-read. Not yet exercised against the live
0.16.19.

web/src/store/__tests__/app-folder-hidden.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, it } from "vitest";
+import { withoutAppFolder } from "../files";
+import type { FileNode } from "@/jmap/types";
+
+/**
+ * The `ihasmail` folder holds signature images and the synced settings file.
+ * They are real nodes in the account — that is what makes them travel — but
+ * they are the client's housekeeping, so Files does not show them.
+ *
+ * Hiding the folder alone is worse than showing it: the tree attaches a node
+ * whose parent is missing to the root, so the signature images would spill out
+ * into the top level looking like the user's own files.
+ */
+
+const node = (id: string, name: string, parentId: string | null, nodeType: "file" | "directory"): FileNode =>
+  ({ id, name, parentId, nodeType, size: null, blobId: null, type: null }) as unknown as FileNode;
+
+describe("hiding the client's folder", () => {
+  it("removes the folder and everything in it", () => {
+    const nodes = [
+      node("f1", "ihasmail", null, "directory"),
+      node("f2", "signature-1.html", "f1", "file"),
+      node("f3", "settings.json", "f1", "file"),
+      node("d1", "Documents", null, "directory"),
+      node("d2", "notes.txt", "d1", "file"),
+    ];
+    expect(withoutAppFolder(nodes).map((n) => n.id)).toEqual(["d1", "d2"]);
+  });
+
+  it("removes nested contents, not just direct children", () => {
+    const nodes = [
+      node("f1", "ihasmail", null, "directory"),
+      node("f2", "images", "f1", "directory"),
+      node("f3", "logo.png", "f2", "file"),
+    ];
+    expect(withoutAppFolder(nodes)).toEqual([]);
+  });
+
+  it("leaves a folder of the same name that the user made inside another", () => {
+    const nodes = [node("d1", "Projects", null, "directory"), node("d2", "ihasmail", "d1", "directory")];
+    expect(withoutAppFolder(nodes).map((n) => n.id)).toEqual(["d1", "d2"]);
+  });
+
+  it("leaves a top-level file that happens to be called ihasmail", () => {
+    const nodes = [node("x1", "ihasmail", null, "file")];
+    expect(withoutAppFolder(nodes).map((n) => n.id)).toEqual(["x1"]);
+  });
+
+  it("returns the list untouched when there is no such folder", () => {
+    const nodes = [node("d1", "Documents", null, "directory")];
+    expect(withoutAppFolder(nodes)).toBe(nodes);
+  });
+});

web/src/store/files.ts

@@ -1,6 +1,7 @@
 import { create } from "zustand";
 import { CAP, JmapMethodError, client, setErrorMessage } from "@/jmap/client";
 import { directoryCreate, fileCreate, fileNodeProps, normalizeFileNodes, queryOmitsDirectories } from "@/lib/filenode";
+import { isAppFolder } from "@/lib/appFolder";
 import type { FileNode, GetResponse, Id, QueryResponse, SetResponse } from "@/jmap/types";
 import { useSession } from "./session";
 
@@ -30,6 +31,31 @@ let filtersSupported = true;
 
 const byName = (a: FileNode, b: FileNode) => (a.nodeType === b.nodeType ? a.name.localeCompare(b.name, undefined, { numeric: true, sensitivity: "base" }) : a.nodeType === "directory" ? -1 : 1);
 
+/**
+ * Drop the client's own `ihasmail` folder, and everything inside it, from a
+ * listing. It holds signature images and the synced settings file — real nodes
+ * in the account, but housekeeping rather than anything the user filed.
+ *
+ * The contents have to go too: the tree attaches a node whose parent is missing
+ * to the root, so hiding the folder alone would spill its files into the top
+ * level, which is worse than showing the folder.
+ */
+export function withoutAppFolder(nodes: FileNode[]): FileNode[] {
+  const hidden = new Set<Id>();
+  for (const n of nodes) if (isAppFolder(n)) hidden.add(n.id);
+  if (!hidden.size) return nodes;
+  for (let grew = true; grew; ) {
+    grew = false;
+    for (const n of nodes) {
+      if (!hidden.has(n.id) && n.parentId && hidden.has(n.parentId)) {
+        hidden.add(n.id);
+        grew = true;
+      }
+    }
+  }
+  return nodes.filter((n) => !hidden.has(n.id));
+}
+
 /** Fetch all nodes (paged, no filter) and rebuild the full children map. */
 async function loadAllNodes(accountId: Id, set: (fn: (s: FilesState) => Partial<FilesState>) => void): Promise<void> {
   const all: FileNode[] = [];
@@ -52,14 +78,17 @@ async function loadAllNodes(accountId: Id, set: (fn: (s: FilesState) => Partial<
       if (!q.ids.length || (q.total != null && position >= q.total)) break;
     }
   }
+  // After the whole collection, not per page: the folder and its contents can
+  // land in different pages, and a half-filtered pass would spill the rest.
+  const visible = withoutAppFolder(all);
   const nodes: Record<Id, FileNode> = {};
   const children: Record<string, Id[]> = { root: [] };
-  for (const n of all) nodes[n.id] = n;
-  for (const n of all.sort(byName)) {
+  for (const n of visible) nodes[n.id] = n;
+  for (const n of visible.sort(byName)) {
     const key = n.parentId && nodes[n.parentId] ? n.parentId : "root";
     (children[key] ??= []).push(n.id);
   }
-  for (const n of all) children[n.id] ??= [];
+  for (const n of visible) children[n.id] ??= [];
   set(() => ({ nodes, children, loading: false, error: null }));
 }
 
@@ -95,10 +124,12 @@ export const useFiles = create<FilesState>((set, get) => ({
       ]);
       const q = res.get("q")?.[0] as unknown as QueryResponse;
       const g = res.get("g")?.[0] as unknown as GetResponse<FileNode>;
+      const listed = withoutAppFolder(normalizeFileNodes(g.list));
+      const keep = new Set(listed.map((n) => n.id));
       set((s) => {
         const nodes = { ...s.nodes };
-        for (const n of normalizeFileNodes(g.list)) nodes[n.id] = n;
-        return { nodes, children: { ...s.children, [parentId ?? "root"]: q.ids }, loading: false, error: null };
+        for (const n of listed) nodes[n.id] = n;
+        return { nodes, children: { ...s.children, [parentId ?? "root"]: q.ids.filter((id) => keep.has(id)) }, loading: false, error: null };
       });
     } catch (err) {
       // Older Stalwart releases don't support parentId / isTopLevel filters: fall back to

web/src/store/session.ts

@@ -3,6 +3,7 @@ import { apiFetch, ApiError, CAP, client } from "@/jmap/client";
 import type { Id, JmapSession } from "@/jmap/types";
 import { push, type PushState } from "@/jmap/push";
 import { setServerLocale } from "@/lib/datetime";
+import { flushSettingsPush, stopSettingsSync } from "@/lib/settingsSync";
 
 export type AuthStatus = "loading" | "anonymous" | "authenticated";
 
@@ -54,6 +55,14 @@ export const useSession = create<SessionState>((set, get) => ({
   async logout() {
     push.stop();
     setServerLocale(null);
+    // Anything still sitting in the debounce is written while the session can
+    // still write it; a setting changed seconds before signing out is not lost.
+    try {
+      await flushSettingsPush();
+    } catch {
+      /* ignore */
+    }
+    stopSettingsSync();
     try {
       await apiFetch("/api/auth/logout", { method: "POST" });
     } catch {
@@ -96,6 +105,7 @@ function applySession(s: JmapSession, set: (p: Partial<SessionState>) => void) {
 
 client.onUnauthenticated(() => {
   push.stop();
+  stopSettingsSync();
   client.session = null;
   useSession.setState({ status: "anonymous", session: null, accountId: null });
 });

web/src/store/settings.ts

@@ -1,6 +1,7 @@
 import { useEffect, useState } from "react";
 import { create } from "zustand";
 import { loadJson, saveJson } from "@/lib/storage";
+import { queueSettingsPush } from "@/lib/settingsSync";
 import { setDateTimePrefs, type DateFormat, type TimeFormat } from "@/lib/datetime";
 
 export type Theme = "system" | "light" | "dark";
@@ -141,12 +142,59 @@ export const DEFAULT_SETTINGS: Settings = {
   defaultIdentityByAccount: {},
 };
 
+/**
+ * Settings that describe *this screen or this browser*, and so stay in
+ * localStorage: a list-pane width picked on a 27" monitor is wrong on a
+ * laptop, and the notification toggles track a permission the browser grants
+ * per-device, so syncing them would claim something untrue elsewhere.
+ *
+ * Everything else follows the account (issue #54). The list is written as the
+ * exceptions rather than the rule so that a setting added later syncs by
+ * default, which is what someone adding one almost always wants.
+ */
+export const DEVICE_KEYS: ReadonlySet<keyof Settings> = new Set<keyof Settings>([
+  "density",
+  "fontSize",
+  "sidebarCollapsed",
+  "desktopNotifications",
+  "notificationSound",
+  "listPaneWidth",
+  "listPaneHeight",
+]);
+
+/** The part of the settings that is written to the account's settings file. */
+export function syncedPart(s: Settings): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const key of Object.keys(s) as Array<keyof Settings>) {
+    if (!DEVICE_KEYS.has(key)) out[key] = s[key];
+  }
+  return out;
+}
+
+/**
+ * What of a settings file we are willing to apply: known keys only, and never
+ * a device one — an older ihasmail wrote the whole object up, and that file
+ * should not now drag another machine's pane width across.
+ */
+export function acceptRemote(remote: Record<string, unknown>): Partial<Settings> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(remote)) {
+    if (!(key in DEFAULT_SETTINGS)) continue;
+    if (DEVICE_KEYS.has(key as keyof Settings)) continue;
+    if (value === undefined) continue;
+    out[key] = value;
+  }
+  return out as Partial<Settings>;
+}
+
 interface SettingsState {
   settings: Settings;
   update(patch: Partial<Settings>): void;
   reset(): void;
   exportJson(): string;
   importJson(json: string): boolean;
+  /** Apply the account's settings file over the cached ones. */
+  hydrate(remote: Record<string, unknown>): void;
 }
 
 const initialSettings = loadJson<Settings>("settings", DEFAULT_SETTINGS);
@@ -160,12 +208,18 @@ export const useSettings = create<SettingsState>((set, get) => ({
     set({ settings });
     applyTheme(settings);
     applyDateTimePrefs(settings);
+    // Dragging a splitter changes a device key on every frame and must not put
+    // a request in the air; anything else is queued and coalesced.
+    if (Object.keys(patch).some((k) => !DEVICE_KEYS.has(k as keyof Settings))) {
+      queueSettingsPush(syncedPart(settings));
+    }
   },
   reset() {
     saveJson("settings", DEFAULT_SETTINGS);
     set({ settings: DEFAULT_SETTINGS });
     applyTheme(DEFAULT_SETTINGS);
     applyDateTimePrefs(DEFAULT_SETTINGS);
+    queueSettingsPush(syncedPart(DEFAULT_SETTINGS));
   },
   exportJson() {
     return JSON.stringify(get().settings, null, 2);
@@ -179,6 +233,14 @@ export const useSettings = create<SettingsState>((set, get) => ({
       return false;
     }
   },
+  hydrate(remote) {
+    const settings = { ...get().settings, ...acceptRemote(remote) };
+    // Cache it, so the next first frame on this browser is already right.
+    saveJson("settings", settings);
+    set({ settings });
+    applyTheme(settings);
+    applyDateTimePrefs(settings);
+  },
 }));
 
 function applyDateTimePrefs(s: Settings): void {