[alfirus]

Summary

Fixes the actionable defect behind #142: when IMAP sign-in is rejected during account setup (or the settings "test connection" path, which shares it), the app surfaced the raw protocol rejection (auth failed: imap login: … [AUTHENTICATIONFAILED] …) with nothing actionable. For Apple mailboxes that dead-ends users, because Apple always rejects regular Apple passwords over IMAP — only app-specific passwords work — and the error never says so.

check_imap_smtp now maps an authentication rejection for a recognized Apple mailbox (address @icloud.com/@me.com/@mac.com, or an Apple mail host) to guidance that keeps the server detail and names the fix:

sign-in was rejected (auth failed: …). iCloud needs an app-specific password from your Apple Account settings, not your Apple password, with your full iCloud email address as the username.

Change

• crates/flectar-mail-core/src/lib.rs — explain_imap_sign_in + is_apple_mailbox, wired into check_imap_smtp (covers both new-account setup and the settings retest). Non-auth errors and non-Apple mailboxes pass through byte-identical.
• Unit tests: Apple recognition (address/host, case, noticloud.com negative), guidance content (keeps server detail), pass-through of network errors and other providers.

User-visible effects

iCloud users who hit a credential rejection now get told exactly what Apple requires instead of a protocol dump. No change for any other provider or error class.

Deep-research notes (why this, and not something else)

• Transport, username defaulting (full email → correct for Apple), and password handling (only \r/\n stripped, spaces preserved) all check out in code — the reporter's AUTHENTICATIONFAILED means TLS+IMAP succeeded and only the credential was refused, and the issue self-resolved on retry, so there is no confirmed app-side auth defect to fix. The confirmed gap is the unactionable error.
• The reporter's "back to automatic" toggle has no corresponding IMAP option in the setup UI (only SSL/TLS · STARTTLS · None), so that part looks like re-entry resolving a typo or an Apple-side temporary lock rather than a client state bug; I changed nothing there.
• Pre-existing provider-guidance precedent (gmail_needs_google_sign_in) is followed; core error strings are intentionally untranslated like the rest of CoreError.

Tests

• New apple_sign_in_guidance_tests; existing core suites cover the touched paths.
• Could not run the Rust gate locally: prepared on a host without the Rust toolchain (no cargo/rustc), against a byte-verified copy of main (base blob hash-matched before patching). Relying on CI (cargo fmt --check, clippy, cargo test) as the gate.

Notes

• One logical change, no new dependencies, no third-party material.
• Disclosure: prepared with AI assistance (Hermes agent). I reviewed every line of the diff and confirm it is my own contribution, submitted under AGPL-3.0-only, with no credentials, mailbox data, or personal fixture data included.