@eduwork/dsh-mail 0.1.0-alpha.5 → 0.1.0

package/CHANGELOG.en.md

@@ -4,6 +4,15 @@
 
 ## Unreleased
 
+## 0.1.0 - 2026-09-06
+
+- Updated the compatibility baseline to DeepSeek Harness `0.1.2-rc.1` while preserving the Host export, Profile row id, settings namespace, security scope, credential reference, and attachment-directory contracts.
+- Migrated the settings page to the DSH Client `settingsScope` API with atomic mutations, revision fencing, and read-only-state handling.
+- Aligned settings schemas with DSH on `@deepseek-ai/schemastery` `3.18.2` and removed the `legacy-peer-deps` install setting that could hide peer conflicts.
+- Expanded CI to Windows/Linux on Node.js 22/24. Added a manual release workflow that checks and packs by default and prepares stable-tag and same-commit CI validation for later npm Trusted Publishing/OIDC enablement.
+- Aligned public documentation with the stable security status, `settingsScope` architecture, current sole-maintainer governance, and the first-release npm CLI plus browser-2FA process. This release makes no provenance claim; Trusted Publishing remains a later path.
+- Included the bilingual contribution, governance, maintainer, support, and code-of-conduct documents in the npm package so README-relative links remain valid after installation.
+
 ## 0.1.0-alpha.5 - 2026-09-05
 
 - Move the npm identity to `@eduwork/dsh-mail`; update installation/module paths and Client registration together.

package/CHANGELOG.md

@@ -4,6 +4,15 @@
 
 ## 未发布
 
+## 0.1.0 - 2026-09-06
+
+- 兼容基线更新为 DeepSeek Harness `0.1.2-rc.1`，并保留 Host 导出名、Profile 行 id、settings namespace、安全作用域、凭据引用和附件目录契约。
+- 设置页迁移到 DSH Client 的 `settingsScope`，使用原子 mutation、revision fence 和只读状态。
+- 设置 Schema 改用与 DSH 基线一致的 `@deepseek-ai/schemastery` `3.18.2`，并移除会掩盖 peer 冲突的 `legacy-peer-deps` 安装配置。
+- CI 扩展为 Windows/Linux 与 Node.js 22/24；新增手动发布工作流，默认只检查和打包，并为后续启用 npm Trusted Publishing/OIDC 预留稳定 tag 与同 commit CI 校验。
+- 公开文档同步稳定版安全声明、`settingsScope` 架构、单一维护者治理现状和首发 npm CLI + 浏览器 2FA 流程；本次不声明 provenance，Trusted Publishing 作为后续路径。
+- npm 包补齐中英文贡献、治理、维护者、支持和行为准则文档，避免 README 的包内相对链接失效。
+
 ## 0.1.0-alpha.5 - 2026-09-05
 
 - npm 包身份改为 `@eduwork/dsh-mail`，同步安装路径、组合模块路径与客户端注册。

package/CODE_OF_CONDUCT.en.md

@@ -0,0 +1,17 @@
+# Code of conduct
+
+[简体中文](CODE_OF_CONDUCT.md) | **English**
+
+We are committed to a professional, inclusive, and harassment-free project.
+
+Participants must:
+
+- discuss ideas, protocols, and code rather than personal characteristics;
+- assume good intent while accepting evidence-based correction;
+- protect private security reports, mail data, account configuration, and personal information;
+- avoid harassment, threats, discriminatory language, sexualized conduct, doxxing, and sustained disruption;
+- respect maintainer decisions made to protect users, the mail boundary, licensing, or supply-chain security.
+
+Maintainers may edit, hide, reject, or remove contributions and may temporarily or permanently restrict participation when conduct threatens contributors or users. Measures should be proportionate and avoid exposing affected people or security-sensitive material.
+
+General conduct concerns may use an issue without personal information. For confidential harassment, threats, doxxing, or another incident, use GitHub [Private Vulnerability Reporting](https://github.com/freedomkk-qfeng/dsh-mail-assistant/security/advisories/new) and prefix the title with “Code of Conduct”.

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,17 @@
+# 行为准则
+
+**简体中文** | [English](CODE_OF_CONDUCT.en.md)
+
+我们致力于维护专业、包容且无骚扰的项目环境。
+
+参与者必须：
+
+- 讨论观点、协议和代码，而不是个人特征；
+- 假设善意，同时接受基于证据的纠正；
+- 保护私有安全报告、邮件数据、账号配置和个人信息；
+- 避免骚扰、威胁、歧视性语言、性化行为、人肉搜索和持续扰乱；
+- 尊重维护者为保护用户、邮件边界、许可证或供应链安全作出的决定。
+
+当行为威胁贡献者或用户时，维护者可以编辑、隐藏、拒绝或删除贡献，也可以临时或永久限制参与。措施应适度，并避免暴露受影响者或安全敏感材料。
+
+一般行为问题可以创建不含个人信息的 Issue。需要保密处理的骚扰、威胁、人肉搜索或其他事件，请使用 GitHub [Private Vulnerability Reporting](https://github.com/freedomkk-qfeng/dsh-mail-assistant/security/advisories/new)，并在标题中标注“Code of Conduct”。

package/CONTRIBUTING.en.md

@@ -0,0 +1,9 @@
+# Contributing
+
+[简体中文](CONTRIBUTING.md) | **English**
+
+This project optimizes for a clear mail security boundary, not tool count.
+
+Run `npm ci` and `npm run check`. Add mailbox-independent automated tests for new behavior; cover cancellation, timeout, bounds, and error normalization for protocol changes; give every mutation an explicit capability, target boundary, and approval policy; update Chinese and English documentation together; and never commit real addresses, messages, app passwords, logs, or personal data.
+
+Use a dedicated test mailbox for interoperability. Do not mix new product boundaries such as delete, move, auto-reply, or polling into corrective pull requests. Report vulnerabilities privately through [SECURITY.en.md](SECURITY.en.md).

package/CONTRIBUTING.md

@@ -0,0 +1,23 @@
+# 贡献指南
+
+**简体中文** | [English](CONTRIBUTING.en.md)
+
+感谢参与。这个项目优先保证邮件安全边界，不以工具数量为目标。
+
+## 开始开发
+
+```bash
+npm ci
+npm run check
+```
+
+提交前请保证：
+
+1. 新行为有无真实邮箱即可运行的自动化测试；
+2. 涉及协议的改动同时覆盖取消、超时、大小上限和错误归一化；
+3. 任何写操作都有清晰的能力开关、工作区/目标边界和人工确认策略；
+4. 中英文文档同步；
+5. 不提交邮箱地址、邮件样本、授权码、真实服务器日志或个人信息；
+6. 不把删除、移动、自动回复、后台轮询等新边界混进修复型 PR。
+
+真实互操作测试请使用专用测试邮箱，并只提交脱敏后的结论和可复现的协议事实。安全问题不要走公开 issue，见 [SECURITY.md](SECURITY.md)。

package/GOVERNANCE.en.md

@@ -0,0 +1,30 @@
+# Governance
+
+[简体中文](GOVERNANCE.md) | **English**
+
+## Project ownership
+
+`dsh-mail-assistant` is initiated and hosted by [@freedomkk-qfeng](https://github.com/freedomkk-qfeng). It remains provider- and institution-neutral: public code must not embed private servers, accounts, branding, or message samples.
+
+## Roles and decisions
+
+- **Maintainers** merge normal changes, triage issues, and manage DSH and protocol compatibility.
+- **Security maintainers** review credentials, read-only IMAP, SMTP sending, attachment paths, and supply-chain changes, and handle private reports.
+- **Release managers** control protected tags, npm publishing, provenance, deprecation, and rollback.
+
+The roster is in [Maintainers](MAINTAINERS.en.md). Ordinary decisions use pull requests. Capability boundaries, trust models, dependency strategy, and incompatible changes require a record under `docs/decisions/`. Unresolved credential disclosure, unauthorized sending, message mutation, or workspace escape blocks a release.
+
+## Review and merge
+
+- During the project's initial single-maintainer stage, the current maintainer decides merges and releases and records the decision, CI/regression results, independent technical-review evidence, and remaining risk in the pull request or release record.
+- Credential, send-authorization, IMAP mutation, attachment-path, workflow, dependency, and release changes require technical review proportionate to their risk; unresolved security defects still block publication.
+- After additional maintainers join, those security-sensitive changes should receive approval from a second human maintainer. This is a future governance goal and does not claim current backup coverage or a second approver.
+- The public repository should enable CI, CodeQL, branch protection, and Private Vulnerability Reporting.
+
+## Releases
+
+Release managers create tags and npm releases only after the [public release checklist](docs/release-checklist.en.md). npm Trusted Publishing is not configured for the first stable release, so the current maintainer publishes the frozen package with the npm CLI and confirms browser 2FA; that release makes no provenance claim. After the repository, workflow, and environment binding is configured and verified, later stable releases migrate to OIDC/provenance. No long-lived publish token belongs in the repository or workstation. Unsafe releases are deprecated and users are notified under the [security policy](SECURITY.en.md).
+
+## Product boundary
+
+The project assists with reading and explicit sending; it is not a mail client. Delete, move, archive, flag mutation, background polling, auto-reply, and scheduled sending are separate high-risk boundaries that require their own design and review.

package/GOVERNANCE.md

@@ -0,0 +1,30 @@
+# 治理规则
+
+**简体中文** | [English](GOVERNANCE.en.md)
+
+## 项目所有权
+
+`dsh-mail-assistant` 由 [@freedomkk-qfeng](https://github.com/freedomkk-qfeng) 发起并托管。项目保持服务商和机构中立：公共代码不得内置私有服务器、账号、品牌或邮件样本。
+
+## 角色与决策
+
+- **维护者**：合并普通变更、处理 Issue、维护 DSH 与协议兼容性。
+- **安全维护者**：审查凭据、IMAP 只读性、SMTP 发信、附件路径和供应链变更，并处理私密报告。
+- **发布经理**：管理受保护 tag、npm 发布、provenance、弃用和回滚。
+
+维护者名单见[维护者](MAINTAINERS.md)。普通实现通过 Pull Request 决策；能力边界、信任模型、依赖策略或不兼容变更应写入 `docs/decisions/`。未解决的凭据泄露、越权写信、邮件状态修改或工作区逃逸问题会阻止发布。
+
+## 审查与合并
+
+- 项目初期由当前单一维护者决定合并与发布，并在 PR 或发布记录中保留决策、CI/回归结果、独立技术复核证据和剩余风险。
+- 凭据、发信授权、IMAP 写操作、附件路径、工作流、依赖和发布变更必须完成与风险相称的技术复核；未解决的安全缺陷仍会阻止发布。
+- 增加维护者后，上述安全敏感变更应由第二位人工维护者批准；这是未来治理目标，不代表当前已有替补或第二位批准人。
+- 公共远程仓库应启用 CI、CodeQL、分支保护和 Private Vulnerability Reporting。
+
+## 发布
+
+发布经理只有在完成[公开发布检查表](docs/release-checklist.md)后才能创建 tag 和 npm 版本。首次稳定发布时 npm Trusted Publisher 尚未配置，因此由当前维护者使用 npm CLI 发布冻结包并在浏览器完成 2FA，本次不声明 provenance。完成 Trusted Publishing 的仓库、工作流和 Environment 绑定并验证后，后续稳定发布再迁移到 OIDC/provenance；不在仓库或工作站长期保存发布 Token。发现版本不安全时，应及时弃用、修复并按[安全政策](SECURITY.md)通知用户。
+
+## 产品边界
+
+项目当前只提供辅助读信和显式发信，不追求成为邮箱客户端。删除、移动、归档、标记已读、后台轮询、自动回复和计划发送属于新的高风险边界，必须单独设计和审查，不能作为普通修复顺带加入。

package/MAINTAINERS.en.md

@@ -0,0 +1,13 @@
+# Maintainers
+
+[简体中文](MAINTAINERS.md) | **English**
+
+| Role | Primary | Backup | Status |
+| --- | --- | --- | --- |
+| Project maintainer | [@freedomkk-qfeng](https://github.com/freedomkk-qfeng) | None (recruiting) | Current sole maintainer |
+| Security maintainer | [@freedomkk-qfeng](https://github.com/freedomkk-qfeng) | None (recruiting) | Current sole maintainer |
+| Release manager | [@freedomkk-qfeng](https://github.com/freedomkk-qfeng) | None (recruiting) | Current sole maintainer |
+
+One maintainer currently holds these responsibilities; no backup exists yet. Use [GitHub Private Vulnerability Reporting](https://github.com/freedomkk-qfeng/dsh-mail-assistant/security/advisories/new) for confidential security reports and [GitHub Issues](https://github.com/freedomkk-qfeng/dsh-mail-assistant/issues) for release-recovery requests that contain no sensitive information. Recruiting at least one backup able to handle private reports and release recovery remains a maintenance recommendation and roadmap item. Until then, the project does not claim backup coverage or institutional support. Credential, send-authorization, workspace-boundary, and release-workflow changes should receive independent review whenever possible.
+
+Role responsibilities and review thresholds are defined in [Governance](GOVERNANCE.en.md).

package/MAINTAINERS.md

@@ -0,0 +1,13 @@
+# 维护者
+
+**简体中文** | [English](MAINTAINERS.en.md)
+
+| 角色 | 主要负责人 | 替补 | 状态 |
+| --- | --- | --- | --- |
+| 项目维护者 | [@freedomkk-qfeng](https://github.com/freedomkk-qfeng) | 无（待招募） | 当前唯一维护者 |
+| 安全维护者 | [@freedomkk-qfeng](https://github.com/freedomkk-qfeng) | 无（待招募） | 当前唯一维护者 |
+| 发布经理 | [@freedomkk-qfeng](https://github.com/freedomkk-qfeng) | 无（待招募） | 当前唯一维护者 |
+
+项目目前由一名维护者承担上述职责，尚无替补。私密安全报告请使用 [GitHub Private Vulnerability Reporting](https://github.com/freedomkk-qfeng/dsh-mail-assistant/security/advisories/new)；不含敏感信息的发布恢复请求请使用 [GitHub Issues](https://github.com/freedomkk-qfeng/dsh-mail-assistant/issues)。招募至少一名能够处理私密报告和发布恢复的替补是维护建议与待办；在此之前，不宣称已具备替补能力或机构支持。邮件凭据、发信授权、工作区边界和发布工作流的变更应尽可能获得独立复核。
+
+角色职责和审查门槛见[治理规则](GOVERNANCE.md)。

package/README.en.md

@@ -1,12 +1,12 @@
 # dsh-mail-assistant
 
-> npm package: `@eduwork/dsh-mail@0.1.0-alpha.5`. The previous unscoped package remains available during migration. See [migration and data compatibility](docs/EDUWORK-MIGRATION.en.md).
+> npm package: `@eduwork/dsh-mail@0.1.0`. The previous unscoped package remains available during migration. See [migration and data compatibility](docs/EDUWORK-MIGRATION.en.md).
 
 [简体中文](README.md) | **English**
 
 A security-focused mail assistant plugin for [DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness). It reads through standard IMAP and sends through standard SMTP, while deliberately refusing to become another full mail client.
 
-Current version: `0.1.0-alpha.5`. This is a public alpha preview for isolated environments and dedicated test mailboxes. Complete your own security and compliance review before connecting a critical mailbox.
+Current version: `0.1.0`. This release was reviewed against the public DeepSeek Harness `0.1.2-rc.1` interfaces. Complete your own security and compliance review before connecting a critical mailbox.
 
 ## Scope
 
@@ -37,12 +37,12 @@ See the complete [security model](docs/security-model.en.md).
 
 ## Install
 
-Prerequisites: Node.js 22+, DSH `0.1.2-alpha.2`, and a Profile with the official Settings, Credentials, Tools, Filesystem, Permission Presets, Approval, and Web Client capabilities.
+Prerequisites: Node.js 22+, DSH `0.1.2-rc.1`, and a Profile with the official Settings, Credentials, Tools, Filesystem, Permission Presets, Approval, and Web Client capabilities.
 
 For normal use, pin the reviewed exact npm version:
 
 ```bash
-dsh plugin --profile web add @eduwork/dsh-mail@0.1.0-alpha.5
+dsh plugin --profile web add @eduwork/dsh-mail@0.1.0
 ```
 
 Use a source checkout for auditing, development, or unpublished changes:
@@ -61,7 +61,7 @@ From the parent directory:
 dsh plugin --profile web add ./dsh-mail-assistant
 ```
 
-DSH links the checkout; it does not scan the invoking directory. Keep a source checkout in place. Use `@eduwork/dsh-mail@alpha` only when intentionally following prerelease updates.
+DSH links the checkout; it does not scan the invoking directory. Keep a source checkout in place. Team deployments should pin the reviewed exact version shown above.
 
 ## Configure and verify
 
@@ -73,7 +73,11 @@ The v0.1 authentication profile is username plus password/app password over stan
 
 The plugin uses official DSH seams: `ctx.credentials`, `ctx.settings`, `settings.section`, `ctx.tools`, `ctx.permissionPresets`, `tools/pre-execute`, `ctx.fs`, and the Client Loader. Ordinary permissions route sends through the composed Approval service; Full Access proceeds without a prompt. It does not fork the upstream Web client.
 
-DSH `0.1.2-alpha.2` has bounded binary reads but no binary-write filesystem seam. `mail_get_attachment` therefore uses `ctx.fs` to resolve and fence the local destination before an exclusive local write. A remote/non-local FS Provider may not support that one tool. See [compatibility](docs/compatibility.en.md).
+DSH `0.1.2-rc.1` has bounded binary reads but no binary-write filesystem seam. `mail_get_attachment` therefore uses `ctx.fs` to resolve and fence the local destination before an exclusive local write. A remote/non-local FS Provider may not support that one tool. See [compatibility](docs/compatibility.en.md).
+
+## Maintainer release
+
+The GitHub Actions `Release package` manual workflow checks, packs, and generates SHA-256 metadata by default. This project has not configured npm Trusted Publishing yet, so the first stable release is published from the reviewed frozen package with the npm CLI and maintainer-confirmed browser 2FA; that release makes no provenance claim. Enable the workflow's `publish` path only after binding npm Trusted Publishing to GitHub repository `freedomkk-qfeng/dsh-mail-assistant`, workflow file `release.yml`, and environment `npm`. That future path also validates a stable tag and successful cross-platform CI for the same commit and uses no long-lived npm token.
 
 ## Documentation
 

package/README.md

@@ -1,12 +1,12 @@
 # dsh-mail-assistant
 
-> npm 包：`@eduwork/dsh-mail@0.1.0-alpha.5`。旧无作用域包保留供迁移；安装切换与数据兼容见 [迁移说明](docs/EDUWORK-MIGRATION.md)。
+> npm 包：`@eduwork/dsh-mail@0.1.0`。旧无作用域包保留供迁移；安装切换与数据兼容见 [迁移说明](docs/EDUWORK-MIGRATION.md)。
 
 **简体中文** | [English](README.en.md)
 
 面向 [DeepSeek Harness（DSH）](https://github.com/deepseek-ai/deepseek-harness) 的安全型邮件助手插件。它通过标准 IMAP 读取邮件、通过标准 SMTP 发送纯文本邮件，但刻意不成为另一个邮箱客户端。
 
-当前版本：`0.1.0-alpha.5`。这是公开 alpha 预览版，适合隔离环境和专用测试邮箱；连接重要邮箱前仍应完成组织自己的安全与合规审查。
+当前版本：`0.1.0`。该版本按 DeepSeek Harness `0.1.2-rc.1` 的公开接口进行了兼容复核；连接重要邮箱前仍应完成组织自己的安全与合规审查。
 
 ## 定位与边界
 
@@ -37,12 +37,12 @@
 
 ## 安装
 
-要求：Node.js 22+、DSH `0.1.2-alpha.2`，且所用 Profile 已包含 Settings、Credentials、Tools、Filesystem、Permission Presets、Approval 和 Web Client 官方能力。
+要求：Node.js 22+、DSH `0.1.2-rc.1`，且所用 Profile 已包含 Settings、Credentials、Tools、Filesystem、Permission Presets、Approval 和 Web Client 官方能力。
 
 普通使用请固定经过复核的 npm 精确版本：
 
 ```bash
-dsh plugin --profile web add @eduwork/dsh-mail@0.1.0-alpha.5
+dsh plugin --profile web add @eduwork/dsh-mail@0.1.0
 ```
 
 需要审计、开发或验证尚未发布的改动时，再从源码安装：
@@ -61,11 +61,7 @@ dsh plugin --profile web add .
 dsh plugin --profile web add ./dsh-mail-assistant
 ```
 
-DSH 会链接本地 checkout，不会扫描当前目录；源码安装后请保留这个目录。明确希望持续跟随预发布更新时可以使用：
-
-```bash
-dsh plugin --profile web add @eduwork/dsh-mail@alpha
-```
+DSH 会链接本地 checkout，不会扫描当前目录；源码安装后请保留这个目录。团队部署应固定上面经复核的精确版本。
 
 ## 配置与首次验证
 
@@ -93,6 +89,10 @@ dsh plugin --profile web add @eduwork/dsh-mail@alpha
 
 二进制写入尚未出现在 DSH `ctx.fs` seam 中，因此 `mail_get_attachment` 在本地 Host 文件系统上通过 `ctx.fs` 完成路径解析与包含性校验后，以独占写方式落盘。远程/非本地 FS Provider 可能不支持该工具；其他读信和发信能力不受影响。详见[兼容性](docs/compatibility.md)。
 
+## 维护者发布
+
+GitHub Actions 的 `Release package` 手动工作流默认只执行检查、打包和 SHA-256 生成。本项目尚未配置 npm Trusted Publisher，因此首次稳定版由维护者使用 npm CLI 发布已复核的冻结包，并在浏览器完成 2FA；本次不声明 provenance。后续完成 Trusted Publisher 绑定后，才启用工作流的 `publish` 路径：绑定 GitHub 仓库 `freedomkk-qfeng/dsh-mail-assistant`、工作流文件 `release.yml` 和 Environment `npm`，校验与 manifest 一致的稳定 tag 及同一 commit 的跨平台 CI，不使用长期 npm Token。
+
 ## 文档
 
 - [快速接入](docs/getting-started.md)

package/SECURITY.en.md

@@ -2,8 +2,8 @@
 
 [简体中文](SECURITY.md) | **English**
 
-`0.1.0-alpha.x` is a prerelease for local testing and should not be connected to a critical mailbox.
+`@eduwork/dsh-mail@0.1.0` is the first stable release reviewed for DeepSeek Harness `0.1.2-rc.1`. Complete your organization's own security, compliance, and recovery review before connecting a critical mailbox.
 
 Do not open a public issue for authorization bypass, credential disclosure, workspace escape, unexpected message mutation, approval bypass, duplicate sending, or remote-code-execution risk. Use GitHub [Private Vulnerability Reporting](https://github.com/freedomkk-qfeng/dsh-mail-assistant/security/advisories/new).
 
-Include only minimal reproduction steps, affected versions, and sanitized protocol facts. Never attach real app passwords, cookies, full messages, personal addresses, or unsanitized diagnostics. High-impact outbound, credential, and workspace-boundary issues receive priority, although no fixed prerelease SLA is promised.
+Include only minimal reproduction steps, affected versions, and sanitized protocol facts. Never attach real app passwords, cookies, full messages, personal addresses, or unsanitized diagnostics. High-impact outbound, credential, and workspace-boundary issues receive priority, although the project promises no fixed SLA.

package/SECURITY.md

@@ -2,10 +2,10 @@
 
 **简体中文** | [English](SECURITY.en.md)
 
-当前 `0.1.0-alpha.x` 为预发布版本，只接受本地测试，不建议直接接入重要邮箱。
+`@eduwork/dsh-mail@0.1.0` 是面向 DeepSeek Harness `0.1.2-rc.1` 复核的首个稳定版本。连接重要邮箱前，仍应完成组织自己的安全、合规与恢复方案审查。
 
 如发现授权绕过、凭据泄露、工作区逃逸、邮件状态意外修改、审批绕过、重复发信或远程代码执行风险，请不要公开 issue。请通过 GitHub [Private Vulnerability Reporting](https://github.com/freedomkk-qfeng/dsh-mail-assistant/security/advisories/new) 私密报告。
 
 报告请只包含最小复现步骤、受影响版本和脱敏后的协议事实。不要附上真实授权码、Cookie、完整邮件、个人地址或未清理的诊断包。
 
-我们会确认收到、评估影响、准备修复和回归测试，再协商披露时间。预发布阶段不承诺固定 SLA，但会优先处理可导致外发、凭据或工作区越界的问题。
+我们会确认收到、评估影响、准备修复和回归测试，再协商披露时间。项目不承诺固定 SLA，但会优先处理可导致外发、凭据或工作区越界的问题。

package/SUPPORT.en.md

@@ -0,0 +1,15 @@
+# Support
+
+[简体中文](SUPPORT.md) | **English**
+
+Use [GitHub Issues](https://github.com/freedomkk-qfeng/dsh-mail-assistant/issues) for normal installation, compatibility, and protocol questions. Vulnerabilities, app passwords, real messages, and private server information must use the private process in the [security policy](SECURITY.en.md).
+
+For an ordinary defect include:
+
+- `dsh-mail-assistant`, DSH, Node.js, and operating-system versions;
+- Web or desktop host, permission preset, and Filesystem Provider type;
+- IMAP/SMTP class, port, TLS mode, and authentication method without real hosts or accounts;
+- expected behavior, observed behavior, and a minimal reproduction;
+- sanitized logs with addresses, subjects, bodies, Message-IDs, app passwords, and server responses removed.
+
+OAuth2 mailbox authentication, multiple accounts, shared multi-user Web, polling, delete/move, scheduled sending, and unreviewed DSH versions are outside the current support boundary. Provider policy for app passwords or SMTP AUTH is not controlled by this plugin.

package/SUPPORT.md

@@ -0,0 +1,15 @@
+# 支持
+
+**简体中文** | [English](SUPPORT.en.md)
+
+普通安装、兼容性和协议问题请使用 [GitHub Issues](https://github.com/freedomkk-qfeng/dsh-mail-assistant/issues)。漏洞、授权码、真实邮件或私有服务器信息必须走[安全政策](SECURITY.md)规定的私密流程。
+
+普通缺陷报告请提供：
+
+- `dsh-mail-assistant`、DSH、Node.js 和操作系统版本；
+- Web 或桌面宿主、权限预设及 Filesystem Provider 类型；
+- IMAP/SMTP 类型、端口、TLS 模式和认证方式，不要提供真实主机与账号；
+- 预期行为、实际行为和最小复现；
+- 已删除地址、主题、正文、Message-ID、授权码和服务端响应的脱敏日志。
+
+当前不支持 OAuth2 邮箱认证、多账号、共享多用户 Web、后台轮询、删除/移动邮件、计划发送，以及未经复核的 DSH 版本。邮箱服务商是否允许应用密码或 SMTP AUTH 属于其租户策略，不由本插件控制。

package/THIRD_PARTY_NOTICES.en.md

@@ -7,7 +7,7 @@
 - [ImapFlow](https://github.com/postalsys/imapflow) — MIT License — IMAP client;
 - [Nodemailer](https://github.com/nodemailer/nodemailer) — MIT-0 License — SMTP message submission;
 - [MailParser](https://github.com/nodemailer/mailparser) — MIT License — MIME parsing;
-- [Schemastery](https://github.com/shigma/schemastery) — MIT License — DSH-compatible settings schema;
+- [`@deepseek-ai/schemastery`](https://github.com/deepseek-ai/deepseek-harness/tree/main/vendor/schemastery) — MIT License — DSH settings-schema implementation;
 - [React](https://github.com/facebook/react) — MIT License — DSH Client settings surface (peer dependency).
 
 The project was informed by the MIT-licensed integration approach in [`STARDUSTLC666/dsh-email`](https://github.com/STARDUSTLC666/dsh-email), but redesigns the permission, credential, read-only IMAP, workspace, untrusted-content, and approval boundaries. No third-party project endorses this plugin.

package/THIRD_PARTY_NOTICES.md

@@ -7,7 +7,7 @@
 - [ImapFlow](https://github.com/postalsys/imapflow) — MIT License — IMAP 客户端；
 - [Nodemailer](https://github.com/nodemailer/nodemailer) — MIT-0 License — SMTP 邮件提交；
 - [MailParser](https://github.com/nodemailer/mailparser) — MIT License — MIME 解析；
-- [Schemastery](https://github.com/shigma/schemastery) — MIT License — DSH 兼容的设置 Schema；
+- [`@deepseek-ai/schemastery`](https://github.com/deepseek-ai/deepseek-harness/tree/main/vendor/schemastery) — MIT License — DSH 的设置 Schema 实现；
 - [React](https://github.com/facebook/react) — MIT License — DSH Client 设置界面（peer dependency）。
 
 项目参考了 MIT 许可的社区项目 [`STARDUSTLC666/dsh-email`](https://github.com/STARDUSTLC666/dsh-email) 在 ImapFlow、Nodemailer、MailParser 与 DSH 之间的组合思路，但重新设计了权限、凭据、只读 IMAP、工作区、邮件不可信内容和审批边界。没有任何第三方项目为本插件背书。

package/docs/EDUWORK-MIGRATION.en.md

@@ -2,12 +2,12 @@
 
 [简体中文](EDUWORK-MIGRATION.md) | **English**
 
-Starting with this version, the npm package is `@eduwork/dsh-mail@0.1.0-alpha.5`, replacing `dsh-mail-assistant`. The npm `eduwork` organization exists. The GitHub repository and checkout directory remain `dsh-mail-assistant`. Consult the npm registry for current publication status.
+Starting with this version, the stable npm installation is `@eduwork/dsh-mail@0.1.0`, replacing `dsh-mail-assistant`. The npm `eduwork` organization exists. The GitHub repository and checkout directory remain `dsh-mail-assistant`. Consult the npm registry for current publication status.
 
 ## Installation and migration
 
 ```sh
-dsh plugin --profile web add @eduwork/dsh-mail@0.1.0-alpha.5
+dsh plugin --profile web add @eduwork/dsh-mail@0.1.0
 ```
 
 Back up an existing Profile's package.json and cordis.patch.yml, then update its dependency and dsh.profile.bundles entries. Update module name paths in custom patches too. Do not enable both package identities together; restart the Host after switching. These are separate npm packages, so updating the old package cannot migrate an installation automatically.
@@ -20,4 +20,4 @@ Storage directories and user configuration content do not change. Product-manage
 
 ## Release scope
 
-This is an alpha package-identity migration retaining the declared DSH peer baseline. Build, tests, documentation, license and tarball checks cover this change. It adds no claims of real institutional sign-in, real email delivery or production acceptance. Stable releases still require the complete deployment checks. Keep previous versions installable and add a migration notice only after the new package passes installation validation.
+This is the first stable package version reviewed for DSH `0.1.2-rc.1`. Build, tests, documentation, licensing, no-network mail-flow simulation, and tarball checks cover this change. It does not claim real institutional sign-in or real email delivery. Previous packages remain installable with their migration notice and are not withdrawn.

package/docs/EDUWORK-MIGRATION.md

@@ -2,12 +2,12 @@
 
 **简体中文** | [English](EDUWORK-MIGRATION.en.md)
 
-从本版本起，npm 包使用 `@eduwork/dsh-mail@0.1.0-alpha.5`，替代旧的 `dsh-mail-assistant`。npm `eduwork` 组织已创建；GitHub 仓库和本地 checkout 目录继续使用 `dsh-mail-assistant`。包的当前发布状态以 npm registry 为准。
+从本版本起，npm 包的稳定安装版本为 `@eduwork/dsh-mail@0.1.0`，替代旧的 `dsh-mail-assistant`。npm `eduwork` 组织已创建；GitHub 仓库和本地 checkout 目录继续使用 `dsh-mail-assistant`。包的当前发布状态以 npm registry 为准。
 
 ## 安装与迁移
 
 ```sh
-dsh plugin --profile web add @eduwork/dsh-mail@0.1.0-alpha.5
+dsh plugin --profile web add @eduwork/dsh-mail@0.1.0
 ```
 
 已有 Profile 先备份 package.json 与 cordis.patch.yml，再更新依赖和 dsh.profile.bundles；手写 patch 的模块路径 name 也需切换。不要同时启用新旧两份插件，切换后重启 Host。旧版本和新作用域版本是不同 npm 包，旧包的更新不会自动迁移安装。
@@ -20,4 +20,4 @@ dsh plugin --profile web add @eduwork/dsh-mail@0.1.0-alpha.5
 
 ## 发布范围
 
-此版本为 alpha 包身份迁移，沿用声明的 DSH peer 基线。构建、测试、文档、开源和 tarball 检查针对本次变更执行；不新增真实学校登录、真实邮件发送或生产部署验收结论。稳定发布仍须完成公开发布检查表中的完整部署验收。旧包保持可安装，新包安装验证通过后添加迁移提示，不撤回旧版本。
+此版本是面向 DSH `0.1.2-rc.1` 的首个稳定包版本。构建、测试、文档、开源、无网络邮件流程模拟和 tarball 检查针对本次变更执行；不宣称已完成真实学校登录或真实邮件发送。旧包保持可安装并保留迁移提示，不撤回旧版本。

package/docs/architecture.en.md

@@ -9,7 +9,7 @@
 ```text
 DSH Web Client
   └─ settings.section: Mail assistant
-       ├─ remote.settings      non-secret account/server settings
+       ├─ settingsScope        namespaced non-secret settings
        └─ remote.credentials   write-only app password
 
 DSH Host
@@ -30,7 +30,7 @@ The plugin does not provide a Credential, Settings, Filesystem, Permission Prese
 
 Non-secret fields live in the `dsh-mail-assistant` settings namespace. The app password uses the fixed credential reference `DSH_MAIL_ASSISTANT_PASSWORD`. The Host resolves it at the beginning of every tool call and never caches it across operations, so rotation applies to the next call.
 
-The settings page only invokes `credentials.describe/set/unset`. It can observe configured/writable state, but it cannot read the credential value back into the browser.
+The settings page reads and writes non-secret configuration through `settingsScope.bind({ namespace: 'dsh-mail-assistant' })`, using revision-fenced atomic mutations to avoid overwriting concurrent updates. For the app password it only invokes `credentials.describe/set/unset`: it can observe configured/writable state, but it cannot read the credential value back into the browser.
 
 ## Message identity and pagination
 
@@ -58,7 +58,7 @@ Outbound attachments use `ctx.fs`: resolve from the session `cwd`, verify contai
 
 The Host artifact embeds the IMAP/SMTP implementation libraries in `lib/index.js`. Users do not install a second protocol runtime after npm, source-package, or offline-product installation, and plugin dependencies cannot collide with a product's private Node runtime during updates.
 
-DSH `0.1.2-alpha.2` does not expose `writeBytes`. Attachment download therefore requires a local Host filesystem. The plugin resolves the logical destination with `ctx.fs`, creates the directory, resolves real workspace and directory paths, rechecks containment to reject pre-existing symlinks or junctions, and finally performs a random-name `wx` exclusive write. Replace this local adapter when DSH provides an official binary-write seam.
+DSH `0.1.2-rc.1` does not expose `writeBytes`. Attachment download therefore requires a local Host filesystem. The plugin resolves the logical destination with `ctx.fs`, creates the directory, resolves real workspace and directory paths, rechecks containment to reject pre-existing symlinks or junctions, and finally performs a random-name `wx` exclusive write. Replace this local adapter when DSH provides an official binary-write seam.
 
 ## Extension rules
 

package/docs/architecture.md

@@ -9,7 +9,7 @@
 ```text
 DSH Web Client
   └─ settings.section: 邮件助手设置页
-       ├─ remote.settings      非敏感账号和服务器配置
+       ├─ settingsScope        绑定命名空间的非敏感配置
        └─ remote.credentials   授权码只写
 
 DSH Host
@@ -30,7 +30,7 @@ DSH Host
 
 非敏感字段保存在 `dsh-mail-assistant` settings namespace。授权码使用固定 Credential Ref `DSH_MAIL_ASSISTANT_PASSWORD`。Host 在每个工具调用开始时重新解析引用，不跨操作缓存密码，因此轮换后的值会在下一次调用生效。
 
-设置页只能调用 `credentials.describe/set/unset`：它能看到“是否配置”和“是否可写”，不能读回实际值。
+设置页通过 `settingsScope.bind({ namespace: 'dsh-mail-assistant' })` 读写非敏感配置，并使用 revision fence 的原子 mutation 避免覆盖并发更新。它对授权码只能调用 `credentials.describe/set/unset`：可看到“是否配置”和“是否可写”，不能读回实际值。
 
 ## 邮件标识
 
@@ -64,9 +64,9 @@ handle 用于完整性检查和防误用，不是授权令牌，也不包含密
 
 发送附件完全走 `ctx.fs`：以会话 `cwd` 解析、验证包含关系、检查普通文件、累计大小，再通过 `readBytes` 有界读取。
 
-Host 产物会把 IMAP/SMTP 运行依赖编入 `lib/index.js`。因此通过 npm、源码包或 ChatECNU Work 离线装配安装后，终端用户都不需要再安装 Node 依赖；这也避免了插件依赖与宿主随版本更新的私有 Node 运行时互相覆盖。
+Host 产物会把 IMAP/SMTP 运行依赖编入 `lib/index.js`。因此通过 npm、源码包或产品离线装配安装后，终端用户都不需要再安装 Node 依赖；这也避免了插件依赖与宿主随版本更新的私有 Node 运行时互相覆盖。
 
-DSH `0.1.2-alpha.2` 暂无 `writeBytes`。下载附件因此只在本地 Host FS 上可用：插件先用 `ctx.fs` 解析逻辑路径，创建目录后再解析工作区与目标目录的真实路径并重新验证包含关系，最后把随机文件名以 `wx` 独占模式写入。这样会拒绝预置符号链接或目录联接造成的工作区逃逸。未来官方提供二进制写 seam 后，应删除这段本地适配，直接复用官方能力。
+DSH `0.1.2-rc.1` 暂无 `writeBytes`。下载附件因此只在本地 Host FS 上可用：插件先用 `ctx.fs` 解析逻辑路径，创建目录后再解析工作区与目标目录的真实路径并重新验证包含关系，最后把随机文件名以 `wx` 独占模式写入。这样会拒绝预置符号链接或目录联接造成的工作区逃逸。未来官方提供二进制写 seam 后，应删除这段本地适配，直接复用官方能力。
 
 ## 后续扩展规则
 

package/docs/compatibility.en.md

@@ -2,11 +2,11 @@
 
 [简体中文](compatibility.md) | **English**
 
-Package `@eduwork/dsh-mail@0.1.0-alpha.5` retains the alpha.4 runtime and settings contracts. See [migration](EDUWORK-MIGRATION.en.md).
+Package `@eduwork/dsh-mail@0.1.0` retains the published preview runtime and settings contracts. See [migration](EDUWORK-MIGRATION.en.md).
 
 ## Reviewed baseline
 
-- DeepSeek Harness `0.1.2-alpha.2`;
+- DeepSeek Harness `0.1.2-rc.1` (source-review baseline commit `a66e4702047846cdaa10c66c9d3df3951f5ea70d`);
 - Node.js 22+;
 - dynamic Web Client Bundle;
 - local Host filesystem;
@@ -24,7 +24,7 @@ The DSH Profile provides `settings`, `credentials`, `tools`, `permissionPresets`
 
 ## DSH binary-write limitation
 
-DSH `0.1.2-alpha.2` exposes `ctx.fs.readBytes` but no `writeBytes`:
+DSH `0.1.2-rc.1` exposes `ctx.fs.readBytes` but no `writeBytes`:
 
 - outbound local attachments use the official seam end to end;
 - downloads require `ctx.fs.processPath()` and the Host Node process to share one filesystem;
@@ -34,4 +34,4 @@ DSH `0.1.2-alpha.2` exposes `ctx.fs.readBytes` but no `writeBytes`:
 
 ## Version policy
 
-During `0.x`, a DSH alpha may change the Client Loader, settings slots, or tool schemas. For every upgrade, run the full automated suite and real IMAP/SMTP acceptance in an isolated Profile. Compilation alone is insufficient.
+During `0.x`, a DSH prerelease may change the Client Loader, settings slots, or tool schemas. For every upgrade, run the full automated suite and IMAP/SMTP acceptance in an isolated Profile. Compilation alone is insufficient.

package/docs/compatibility.md

@@ -2,11 +2,11 @@
 
 **简体中文** | [English](compatibility.en.md)
 
-`@eduwork/dsh-mail@0.1.0-alpha.5` 保留 alpha.4 的运行时和设置契约。详见[迁移说明](EDUWORK-MIGRATION.md)。
+`@eduwork/dsh-mail@0.1.0` 保留已公开预览版的运行时和设置契约。详见[迁移说明](EDUWORK-MIGRATION.md)。
 
 ## 已验证基线
 
-- DeepSeek Harness `0.1.2-alpha.2`；
+- DeepSeek Harness `0.1.2-rc.1`（源码审查基线 commit `a66e4702047846cdaa10c66c9d3df3951f5ea70d`）；
 - Node.js 22+；
 - Web Client 动态 Bundle；
 - 本地 Host 文件系统；
@@ -24,7 +24,7 @@
 
 ## DSH 二进制写限制
 
-`ctx.fs` 在 `0.1.2-alpha.2` 提供 `readBytes`，没有 `writeBytes`。因此：
+`ctx.fs` 在 `0.1.2-rc.1` 提供 `readBytes`，没有 `writeBytes`。因此：
 
 - 发送本地附件可完整复用官方 seam；
 - 下载附件只能在 `ctx.fs.processPath()` 与 Host Node 进程指向同一文件系统时工作；插件会在创建目录后解析真实路径并再次验证工作区包含关系；
@@ -33,4 +33,4 @@
 
 ## 版本策略
 
-在 `0.x` 阶段，DSH alpha 的 Client Loader、settings slots 或 tool schema 变化可能要求插件同步更新。每次升级先运行 `npm run check`，再在隔离 Profile 中完成真实 IMAP/SMTP 验收，不应只依赖编译通过。
+在 `0.x` 阶段，DSH 预发布版的 Client Loader、settings slots 或 tool schema 变化可能要求插件同步更新。每次升级先运行 `npm run check`，再在隔离 Profile 中完成 IMAP/SMTP 验收，不应只依赖编译通过。

package/docs/decisions/0001-mail-assistant-boundary.en.md

@@ -20,7 +20,7 @@ Delete, move, archive, flag mutation, contacts, rules, polling, auto-reply, HTML
 
 ## Consequences
 
-- The plugin can be open-sourced and composed by Web or desktop DSH without depending on ChatECNU Work.
+- The plugin can be open-sourced and composed by Web or desktop DSH without depending on a particular product composition.
 - Users keep a professional mail client for mailbox-state management; the Agent focuses on retrieval, understanding, and authorized sending.
 - Full Access matches other DSH write tools and skips per-call approval, while the independent sending capability remains mandatory.
 - Any future background or mutation boundary requires another ADR, threat model, and migration plan.

package/docs/decisions/0001-mail-assistant-boundary.md

@@ -20,7 +20,7 @@ Gmail 等专用 OAuth2 API 与通用 IMAP/SMTP 的认证、权限和审计模型
 
 ## 结果
 
-- 插件可以独立开源并被 Web 或桌面 DSH 组合复用，不绑定 ChatECNU Work。
+- 插件可以独立开源并被 Web 或桌面 DSH 组合复用，不绑定任何特定产品。
 - 用户仍使用专业邮箱客户端管理邮箱状态，Agent 聚焦检索、理解和经授权的发信。
 - Full Access 与 DSH 其他写工具保持一致，会跳过逐次审批；独立的发信开关仍是必要条件。
 - 未来扩展若改变写操作或后台授权，必须新增 ADR、威胁模型和迁移说明。

package/docs/getting-started.en.md

@@ -5,7 +5,7 @@
 ## Requirements
 
 - Node.js 22+;
-- DeepSeek Harness `0.1.2-alpha.2`;
+- DeepSeek Harness `0.1.2-rc.1`;
 - a Profile with Settings, Credentials, Tools, Filesystem, Permission Presets, Approval, and Web Client;
 - an IMAP/SMTP-enabled mailbox and provider-issued app password.
 
@@ -14,7 +14,7 @@
 For normal use, pin the reviewed exact npm version:
 
 ```bash
-dsh plugin --profile web add @eduwork/dsh-mail@0.1.0-alpha.5
+dsh plugin --profile web add @eduwork/dsh-mail@0.1.0
 ```
 
 For auditing, development, or unpublished changes, use a source checkout:
@@ -27,7 +27,7 @@ npm run check
 dsh plugin --profile web add .
 ```
 
-Installation adds one Bundle to the Profile. Empty configuration is valid: the plugin performs no server probe or runtime installation during install, startup, or save. A source installation links the checkout into the Profile, so keep that directory available. Team deployments should pin an exact npm version; use `@eduwork/dsh-mail@alpha` only when intentionally following prereleases.
+Installation adds one Bundle to the Profile. Empty configuration is valid: the plugin performs no server probe or runtime installation during install, startup, or save. A source installation links the checkout into the Profile, so keep that directory available. Team deployments should pin the reviewed exact npm version.
 
 ## Configuration