Mobile:
- Add useLongPress hook (500ms, movement cancellation, press feedback)
- Disable drag-and-drop on mobile in useEmailDrag
- Wire long-press context menu to all email list item components
- Add select-none and visual press feedback (scale + ring)
Settings:
- Add logout button to settings page sidebar
- Add 'extra-compact' density level that hides avatars and preview
text, showing only sender and subject for maximum information density
- Add visual density preview in appearance settings showing a 3-row
email list mockup that reflects each density option
- Fix global font size setting only changing line height by moving
font-size from body to :root so rem-based Tailwind classes scale
- Apply extra-compact behavior to email list items, thread list items,
thread email items, and thread conversation view (EmailCard)
- Update email list virtualizer size estimates for extra-compact
- Add extra-compact translations for all 8 locales
Rename "List Density" to "Density" and apply spacing changes globally
instead of only to email list item heights.
- Replace hardcoded padding/gap values with CSS custom properties
(--density-item-py, --density-item-gap, --density-header-py,
--density-card-p, --density-sidebar-py) set via JS on :root
- Apply density-responsive spacing to email list items, thread views,
email viewer, sidebar, navigation rail, contacts, and calendar
- Use inline styles instead of Tailwind arbitrary value classes to
avoid Turbopack compilation hangs
- Rename listDensity → density in store, types, and components
- Add persist migration (v1 → v2) and onRehydrateStorage callback
- Update all 8 locale files with broadened labels/descriptions
Inline CID images were replaced with raw JMAP download URLs that require authentication. When the browser loaded these as <img src>, the server responded with WWW-Authenticate: Basic, triggering a native login popup.
- Add fetchBlobAsObjectUrl() to JMAPClient that fetches blobs via authenticated request and returns blob: object URLs
- Update email-viewer and thread-conversation-view to fetch CID images asynchronously with auth, using blob: URLs instead of raw server URLs
- Add ALLOWED_URI_REGEXP to DOMPurify config so blob: URLs are not stripped during sanitization
- Add tests for fetchBlobAsObjectUrl and CID/blob URL sanitization
- Display Bulwark logo on the login page, with theme-aware switching
between light and dark variants based on the resolved theme
- Add LOGIN_LOGO_LIGHT_URL and LOGIN_LOGO_DARK_URL env variables to
allow custom logo overrides (defaults to bundled Bulwark branding)
- Expose logo config through /api/config endpoint and useConfig hook
- Add logo URL prompts to the setup.sh installer branding step
- Rename branding assets to use underscores instead of spaces
- Replace all Unicode symbols (─, █, ░, ●, ✓, ✗, ➜, braille spinners)
with ASCII-safe equivalents that render correctly when piped via
curl | bash
- Add contextual TIP/NOTE hints to every input field explaining what
each setting does and showing examples
- Redesign progress bar to show labeled step names
(Server > Auth > Security > Logging > Branding > Deploy > Confirm)
with color-coded completion state
- Replace BG_BLUE block header with ASCII box() function
- Add section headers with subtitles to each step
- Add deployment method recommendations and requirement notes
- Add "Next steps" checklist to completion screen
- Show existing .env.local detection notice on welcome screen
- Use dotted-line separators in summary for cleaner alignment
- Fix shell injection vulnerability: replace eval with printf -v
in prompt_value and prompt_yesno helpers
Linus Rath