fix: lock-screen, confirm-tier, and mail-folder audit bugs

Lock screen: slock is X11-only and never grabbed the Wayland session, so C-; ! l silently did nothing. On Wayland the locker now runs loginctl lock-session, which logind turns into a Lock signal that hypridle handles by running hyprlock, the same path idle and before-sleep locking already use. X11 keeps slock. system-commands.el now also requires host-environment, which it used at load time but never declared.

Confirmation tier: the global (fset 'yes-or-no-p 'y-or-n-p) plus use-short-answers t both flattened yes-or-no-p to a single keystroke, so the deliberate strong-confirm tier for irreversible actions was dead. A stray space could power off the machine or destroy files. I added cj/confirm-strong, which binds use-short-answers nil for one call to force a typed "yes", and routed the six irreversible sites through it (shutdown/reboot, permanent file destruction, file overwrites). I dropped the redundant fset and kept use-short-answers t so ordinary prompts stay single-key.

Mail folders: the cmail context set no trash folder, so D fell back to a nonexistent /trash, and no context set a refile folder, so r targeted a nonexistent /archive everywhere. Accepting mu4e's offer to create the maildir stranded mail where mbsync never syncs it. cmail now trashes to /cmail/Trash. Refile is computed per message rather than per context, because mu4e context :vars are sticky and a per-context refile would leak one account's archive folder into another. cmail archives to /cmail/Archive. The Gmail-backed accounts have no synced archive maildir, so they signal rather than move mail into an unsynced folder.

Lock and confirm-tier need a daemon restart to fully take effect. The mail changes apply on next mu4e open.

1 files changed, 33 insertions, 1 deletions

diff --git a/modules/mail-config.el b/modules/mail-config.el
index f71d6eeb5..dfc0c4e0c 100644
--- a/modules/mail-config.el
+++ b/modules/mail-config.el
@@ -48,6 +48,31 @@
 (defvar message-send-mail-function nil)
 (defvar message-sendmail-envelope-from nil)
 
+(declare-function mu4e-message-field "mu4e-message")
+
+;; Refile (archive) target dispatch.  A per-context `mu4e-refile-folder' string
+;; is unsafe: mu4e context :vars are sticky, so a value set when one context is
+;; active leaks into a later context that doesn't set its own -- archiving one
+;; account's mail into another's folder.  A single function evaluated per
+;; message at refile time avoids that.  Only cmail has a real synced Archive
+;; folder; the Gmail-backed accounts (gmail, dmail) sync no archive maildir, so
+;; refiling them would move mail into an unsynced, server-invisible folder
+;; (silent loss) -- signal instead.
+(defun cj/mu4e--refile-folder-for-maildir (maildir)
+  "Return the refile (archive) folder for MAILDIR, or signal when none exists.
+MAILDIR is a mu4e :maildir string such as \"/cmail/INBOX\"."
+  (cond
+   ((not (stringp maildir))
+    (user-error "Cannot refile: message has no maildir"))
+   ((string-prefix-p "/cmail" maildir) "/cmail/Archive")
+   (t
+    (user-error "No archive folder syncs for this account; refile disabled to avoid moving mail into an unsynced folder"))))
+
+(defun cj/mu4e--refile-folder (msg)
+  "Refile-folder function for `mu4e-refile-folder'.
+Dispatch on MSG's maildir via `cj/mu4e--refile-folder-for-maildir'."
+  (cj/mu4e--refile-folder-for-maildir (and msg (mu4e-message-field msg :maildir))))
+
 (defcustom cj/smtpmail-debug-enabled nil
   "Non-nil means enable verbose SMTP transport debug logging.
 
@@ -217,7 +242,8 @@ Prompts user for the action when executing."
           :vars '((user-mail-address    . "c@cjennings.net")
                   (user-full-name       . "Craig Jennings")
                   (mu4e-drafts-folder   . "/cmail/Drafts")
-                  (mu4e-sent-folder     . "/cmail/Sent")))
+                  (mu4e-sent-folder     . "/cmail/Sent")
+                  (mu4e-trash-folder    . "/cmail/Trash")))
 
          (make-mu4e-context
           :name "deepsat.com"
@@ -232,6 +258,12 @@ Prompts user for the action when executing."
                   (mu4e-starred-folder      . "/dmail/Starred")
                   (mu4e-trash-folder        . "/dmail/Trash")))))
 
+  ;; Refile target is computed per message (see `cj/mu4e--refile-folder'), not
+  ;; set per context, because mu4e context :vars are sticky and would leak one
+  ;; account's archive folder into another.  cmail archives to /cmail/Archive;
+  ;; gmail/dmail signal rather than move mail into an unsynced folder.
+  (setq mu4e-refile-folder #'cj/mu4e--refile-folder)
+
   (setq mu4e-maildir-shortcuts
         '(("/cmail/Inbox"       . ?i)
           ("/cmail/Sent"        . ?s)