fix(mail): say so when the password saved for Gmail is not an app password

[JOhnsonKC201]

What this fixes

Settings > Feeds showed saved with a tick for any mail password of eight characters or more. With a Gmail address that is misleading. Gmail accepts only a 16-letter app password over IMAP, so someone who pastes their normal Google password sees a tick, the poll fails quietly, and the alerts never come with nothing to explain why.

Now, when the account resolves to imap.gmail.com and the saved password is not 16 characters:

• next to the field: saved, but 19 characters, not 16
• in the status line, on saving: what that usually means, and where to make an app password

How

• passwordAdvice(len, email, host) in src/mail.js is pure and tested. It reuses imapHostFor, so a @googlemail.com address or a mistyped www.gmail.com host is still recognised.
• email:passwordInfo now hands main the config, since the advice depends on the address and the server.
• Only the length is used. The password is not compared, logged or sent anywhere. The one new thing crossing to the Settings window is a single word of advice, on a channel that already carried the length.

Known limits (from review, not fixed here)

• The sentence is worded as likely, not certain. A Google Workspace account on a custom domain is flagged the same way, and its admin may have app passwords turned off, in which case the link does not help. The wording says so.
• The sentence in the status line is advisory and is not cleared if the address is later changed to another provider; the next Test, save or toggle replaces it. The short note beside the field does update on every render.
• Pressing Test saves the address without waiting, so the note can briefly reflect the previous address.
• The Settings wiring is covered by a source-text test. passwordAdvice itself has a real unit test; passwordInfo(cfg) end to end would need Electron mocked.

Test plan

• npm test: 514 pass, 0 fail, 4 skipped (POSIX only)
• npx eslint . clean
• In the running app: open Settings > Feeds with a non-app password saved for a Gmail address and confirm the note beside the field. Not checked live.
• Save a real 16-letter app password and confirm the tick returns and Test connects.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pixelcat	Ready	Preview	Oct 9, 2026 5:04am UTC

[github-actions]

CI for f47e157: all jobs passed

Job	Result	Log
test	passed	open
packaged-boot (windows-latest)	passed	open
boot (macos-latest)	passed	open
packaged-boot (macos-latest)	passed	open
boot (windows-latest)	passed	open

Tests: 518 passed, 0 failed, 0 skipped, 518 total.

This comment updates itself on every push. Full run.