feat(sync): sync only the accounts with unsynced edits

A sync ran mbsync -a regardless of what changed, so tagging mail in one
account fetched all of them. The account set was not a parameter anywhere
on the path: MailSync::start() took no arguments and the script hardcoded
-a, so nothing between a tag edit and mbsync carried which account changed.

Track which accounts have edits and pass their mbsync channels through to
the script, which now takes channel names and falls back to -a when given
none. An empty set means all accounts, per the request: a sync with nothing
pending is a fetch, and narrowing that to wherever the last edit landed
would quietly stop collecting mail everywhere else.

The channel is a new optional per-account key rather than the section key.
The two names genuinely diverge, because a QSettings section key may carry
dots that the channel does not, and mbsync treats an unknown channel as
fatal rather than skipping it, so key-as-channel would fail those accounts'
syncs outright rather than degrade. It defaults to the key, so accounts
whose two names already agree need no config change.

The edited-account set is deliberately not netted the way the pending-edit
map is: that map tracks the index, where a tag removed and re-added leaves
nothing outstanding, while this tracks the mail store, where both writes
have already renamed files that mbsync still has to propagate. It is also
snapshotted before flushHeldEdits(), which inserts into it synchronously
rather than on a queued reply, so a successful sync cannot clear accounts
whose edits it never carried.

Closes item 49.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 52 insertions, 0 deletions

diff --git a/tests/test_mailsync.cpp b/tests/test_mailsync.cpp
index 6c93e8d..e91de3e 100644
--- a/tests/test_mailsync.cpp
+++ b/tests/test_mailsync.cpp
@@ -43,6 +43,9 @@ private slots:
     void missingBinaryReportsFailureNotSilence();
     void startDoesNotBlock();
     void argumentsAreNotShellInterpreted();
+    void channelsAreAppendedToTheCommand();
+    void noChannelsMeansNoExtraArguments();
+    void channelNamesAreNotShellInterpreted();
 
     void phaseStartsAsMbsync();
     void notmuchLineSwitchesPhase();
@@ -262,6 +265,55 @@ void TestMailSync::argumentsAreNotShellInterpreted()
     QVERIFY(sync.log().contains(QStringLiteral("; touch")));
 }
 
+void TestMailSync::channelsAreAppendedToTheCommand()
+{
+    // Item 49: a sync that knows which accounts were touched passes their
+    // channel names, and they must reach the script as separate arguments
+    // after whatever the config line already carries.
+    const QString script = makeScript(QStringLiteral("chan.sh"),
+                                      QStringLiteral("echo \"[$@]\""));
+
+    MailSync sync(script);
+    QSignalSpy spy(&sync, &MailSync::finished);
+    QVERIFY(sync.start({ QStringLiteral("work"), QStringLiteral("personal") }));
+    QVERIFY(spy.wait(5000));
+
+    QVERIFY(sync.log().contains(QStringLiteral("[work personal]")));
+}
+
+void TestMailSync::noChannelsMeansNoExtraArguments()
+{
+    // Empty means "sync everything", which is the script's own default. It must
+    // not become an empty string argument: mbsync would read that as a channel
+    // named "" and fail the run.
+    const QString script = makeScript(QStringLiteral("nochan.sh"),
+                                      QStringLiteral("echo \"count=$#\""));
+
+    MailSync sync(script);
+    QSignalSpy spy(&sync, &MailSync::finished);
+    QVERIFY(sync.start());
+    QVERIFY(spy.wait(5000));
+
+    QVERIFY(sync.log().contains(QStringLiteral("count=0")));
+}
+
+void TestMailSync::channelNamesAreNotShellInterpreted()
+{
+    // Channel names are derived from config, same trust boundary as the command
+    // itself, and reach the same QProcess argument list. The injection test
+    // above covers the command; this covers the half added for item 49.
+    const QString script = makeScript(QStringLiteral("chanargs.sh"),
+                                      QStringLiteral("echo \"$1\""));
+
+    MailSync sync(script);
+    QSignalSpy spy(&sync, &MailSync::finished);
+    QVERIFY(sync.start({ QStringLiteral("; touch %1/chanpwned")
+                             .arg(m_dir.path()) }));
+    QVERIFY(spy.wait(5000));
+
+    QVERIFY(!QFile::exists(m_dir.filePath(QStringLiteral("chanpwned"))));
+}
+
 void TestMailSync::phaseStartsAsMbsync()
 {
     // A fresh tracker has nothing to report until it is fed, and a run is