@eduwork/dsh-mail 0.1.1 → 0.2.0

package/docs/release-checklist.md

@@ -1,53 +1,11 @@
-# 公开发布检查表
+# 包发布检查表
 
 **简体中文** | [English](release-checklist.en.md)
 
-发布 Pull Request 或发布记录应记维护者决策、日期、命令输出链接、独立技术复核证据和例外。项目初期由单一维护者负责发布；不得虚构尚不存在的第二位人工批准人。任何适用且未完成的安全或发布检查都会阻止稳定发布；未来增加替补和多人审查作为治理目标记录。
+源码与发布入口统一在 EduWork；遵循[公共包发布流程](https://github.com/ecnu/EduWork/blob/main/docs/PACKAGES.md)，本包保留独立的 npm 名称和 SemVer。
 
-## 授权与元数据
-
-- [ ] 当前维护者确认公开发布和 MIT 许可证，并记录技术复核证据与剩余风险。
-- [ ] GitHub 仓库、npm 包名、主页、Issue 和安全报告地址准确。
-- [ ] 版本、Changelog、兼容性和安装命令一致。
-- [ ] 默认文档为中文，每份 Markdown 文档都有英文镜像和双向入口。
-- [ ] Git 历史和发布内容不含真实邮箱、邮件、授权码、服务器、个人路径或未授权品牌。
-
-## 邮件与权限边界
-
-- [ ] IMAP mailbox lock 仍固定为只读，代码没有 `STORE`、`COPY`、`MOVE`、`EXPUNGE` 或 flags 写入。
-- [ ] 读信和发信能力默认关闭，并且彼此独立。
-- [ ] `mail_send` 在读取凭据、附件和访问 SMTP 前进入 DSH 权限通路。
-- [ ] 普通权限逐次审批；Full Access 只免除逐次弹窗，不能自动开启发信能力。
-- [ ] 无 Agent 会话、拒绝、取消和不可用审批通路均失败关闭。
-- [ ] 邮件数据持续标记为不可信，不能成为发信授权、密钥请求或系统指令。
-- [ ] SMTP DATA 阶段的不确定结果返回 `unknown`，不会自动重试。
-
-## 凭据、传输和附件
-
-- [ ] 授权码只进入 DSH Credential Provider，浏览器只能看到配置状态。
-- [ ] 每次工具调用重新解析凭据，不跨操作缓存。
-- [ ] 只允许隐式 TLS 或 STARTTLS，证书校验不可关闭，协议日志关闭。
-- [ ] 地址拒绝 CR/LF 注入；正文、消息和附件大小上限有效。
-- [ ] 发送附件限定为当前会话工作区普通文件。
-- [ ] 下载附件使用随机名、独占写和真实路径包含性复核；符号链接/目录联接逃逸测试通过。
-- [ ] Source map 和错误归一化不泄露凭据、邮件内容、服务器响应或个人路径。
-
-## 功能验收
-
-- [ ] 使用 manifest 声明的当前 DSH 精确版本运行 `npm run accept:dsh-015-rc1`，并确认 Runtime 没有混入旧版 DSH 包。
-- [ ] `mail_list_folders` 返回真实目录且不修改状态。
-- [ ] `mail_find` 的正序/倒序、多页、日期、目录、UIDVALIDITY 失效和 `hasMore=false` 均测试。
-- [ ] `mail_read` 不改变已读状态，正文截断和 HTML 降级符合文档。
-- [ ] `mail_get_attachment` 在本地 FS 成功，在远程/不共享 Host 路径时明确失败。
-- [ ] 普通权限下发信批准/拒绝、Full Access 发信、工作区外附件拒绝均通过真实测试邮箱验收。
-- [ ] 不支持的 OAuth2、多账号、Sent 副本和复杂 MIME 行为仍清楚记录。
-
-## 供应链与发布
-
-- [ ] Windows 与 Linux 使用 Node 22/24 完成干净 `npm ci` 和 `npm run check`。
-- [ ] `npm audit`、CodeQL、直接/间接许可证和安装脚本已人工审查。
-- [ ] GitHub Actions 固定到不可变 commit，Dependabot 与分支保护有效。
-- [ ] `npm pack --dry-run` 和解压后的 tarball 只包含预期文件；Host bundle 没有外部 IMAP/SMTP 裸导入。
-- [ ] tag、发布说明、tarball checksum、弃用和回滚方案已准备。
-- [ ] 已现场验证 npm Trusted Publisher 绑定本仓库、`.github/workflows/release.yml` 与 Environment `npm` 后，才启用 OIDC/provenance 发布路径。
-- [ ] Trusted Publisher 未验证时，从经复核的冻结包使用 npm CLI 和浏览器 2FA 发布，不声明 provenance，也不保存长期 Token。
+- 核对变更行为、版本、变更记录、兼容范围和依赖锁。
+- 在当前包目录执行 npm ci、npm run check；有行为变化时补对应 Host 或浏览器实测，使用合成测试数据。
+- 检查实际 tarball、公开文档、许可证和导出入口，不携带凭据或用户数据。
+- 在 packages-release.yml 中选择本包；publish=false 仅产出候选。明确发布时从匹配包版本的 tag 运行，使用 npm environment 与本仓库的 Trusted Publisher。
+- 核验 registry 中的实际字节后再更新产品锁。发布 npm 不会发布桌面 Release 或替换客户端。

package/docs/security-model.en.md

@@ -23,6 +23,10 @@ The canonical body field is `untrustedText`. Rendering adds a fixed warning and
 
 Warnings are defense in depth. The actual mutation boundary is enforced by the separate `sendEnabled` capability, argument validation, workspace fencing, and DSH's native `tools/pre-execute` permission path. Even if the model mishandles text, the mail body cannot bypass those mechanisms.
 
+## Attachment downloads
+
+`mail_get_attachment` checks the session's effective write policy before accessing credentials or downloading. Workspace-write permits saving attachments; read-only or unknown modes require approval for this call. Rejection, cancellation or unavailable approval prevents the download. Path and size limits remain enforced; download permission does not grant permission to send mail.
+
 ## Send approval
 
 `mail_send` enters DSH permission handling before credentials, attachments, or SMTP access:

package/docs/security-model.md

@@ -23,6 +23,10 @@
 
 这些提示不是唯一防线。真正的写操作依赖独立机制：`mail_send` 的能力开关、参数验证、工作区附件 fence，以及 DSH 原生 `tools/pre-execute` 权限通路。即使模型忽略提示，邮件正文仍不能绕过它们。
 
+## 附件下载
+
+`mail_get_attachment` 在访问凭据和下载附件之前检查会话当前生效的写入权限。工作区写入权限允许保存附件；只读或未知权限仍请求本次审批。拒绝、取消或审批不可用时不执行下载。路径边界和文件大小限制继续生效；下载权限不会授予发信权限。
+
 ## 发信审批
 
 `mail_send` 在接触凭据、附件或 SMTP 之前进入 DSH 原生权限 waterfall：

package/lib/client.js

@@ -29,126 +29,133 @@ window.__ModuleLoader__.load({
 		let react = require("react");
 		react = __toESM(react, 1);
 		let react_jsx_runtime = require("react/jsx-runtime");
+		//#region src/client/locale.ts
+		const LOCALE_NS = "settings.mailAssistant";
+		const dictionaries = {
+			"zh": {
+				"nav": "邮件助手",
+				"title": "邮件助手",
+				"description": "让 Agent 通过标准 IMAP 只读检索邮件，并按当前权限模式通过 SMTP 发信。它不是邮箱客户端，不会移动、删除、归档或修改邮件状态。",
+				"loading": "正在读取配置…",
+				"save": "保存",
+				"saving": "正在保存…",
+				"saved": "配置已保存，新调用立即生效。",
+				"readPermission": "允许 Agent 读信",
+				"readHint": "可列出目录、分页查找、读取邮件和下载附件；IMAP 始终只读。",
+				"sendPermission": "允许 Agent 发信",
+				"sendHint": "可发送纯文本邮件；普通权限逐次确认，Full Access 不再弹窗。",
+				"identity": "邮箱账号",
+				"identityHint": "先填写日常使用的邮箱信息。多数邮箱要求使用客户端授权码，而不是网页登录密码。",
+				"email": "邮箱地址",
+				"emailHint": "用于收信和发信。",
+				"username": "登录用户名",
+				"usernameHint": "仅当服务商要求时填写；留空则使用邮箱地址。",
+				"fromName": "发件人显示名称",
+				"fromNameHint": "收件人看到的名称；可留空。",
+				"inbox": "收件箱目录",
+				"inboxHint": "通常保持 INBOX。",
+				"password": "密码 / 客户端授权码",
+				"passwordHint": "安全写入本机凭据存储，不会写进 settings.yaml，也不会回显。",
+				"configured": "已保存",
+				"missing": "未填写",
+				"credentialPlaceholder": "输入授权码；已保存时留空不会改变",
+				"clearPassword": "清除授权码",
+				"servers": "邮箱服务器",
+				"serversHint": "选择常见服务商可自动填写；单位邮箱或自建邮箱请选择“手动配置”。",
+				"preset": "邮箱服务商",
+				"custom": "手动配置",
+				"imap": "收信（IMAP）",
+				"smtp": "发信（SMTP）",
+				"host": "服务器地址",
+				"port": "端口",
+				"tls": "加密",
+				"implicit": "隐式 TLS",
+				"starttls": "STARTTLS",
+				"advanced": "高级设置",
+				"advancedHint": "登录用户名、收件箱目录和安全上限通常不需要修改。",
+				"collapse": "收起",
+				"agentAccess": "开放给 Agent",
+				"agentAccessHint": "账号和服务器保存好后，再按需要分别开放读信或发信。",
+				"permissionNeedsSetup": "请先填写邮箱地址、授权码和相应的服务器。",
+				"limits": "安全上限",
+				"bodyLimit": "正文字符",
+				"messageLimit": "整封邮件字节",
+				"attachmentLimit": "附件总字节",
+				"usage": "保存后，在对话里让 Agent“查一下最近邮件”即可验证。插件不会在启动或保存时主动连接邮箱。",
+				"error": "保存失败",
+				"reload": "重新加载",
+				"unavailable": "当前连接未提供此设置命名空间。",
+				"readOnly": "当前连接为只读模式，无法保存设置。",
+				"credentialPartial": "授权码已经保存，但其他配置保存失败；请修正后再次保存。"
+			},
+			"en": {
+				"nav": "Mail assistant",
+				"title": "Mail assistant",
+				"description": "Let the agent search mail through read-only IMAP and send through SMTP under the current permission preset. This is not a mail client: it never moves, deletes, archives, or changes message state.",
+				"loading": "Loading configuration…",
+				"save": "Save",
+				"saving": "Saving…",
+				"saved": "Saved. New calls use the configuration immediately.",
+				"readPermission": "Allow the agent to read mail",
+				"readHint": "List folders, page through searches, read messages, and download attachments. IMAP always stays read-only.",
+				"sendPermission": "Allow the agent to send mail",
+				"sendHint": "Send plain-text messages. Ordinary permissions ask each time; Full Access does not prompt.",
+				"identity": "Mailbox account",
+				"identityHint": "Start with the mailbox information you normally use. Most providers require an app password instead of the web-login password.",
+				"email": "Email address",
+				"emailHint": "Used for both incoming and outgoing mail.",
+				"username": "Login username",
+				"usernameHint": "Only set this when required by your provider; otherwise the email address is used.",
+				"fromName": "Sender display name",
+				"fromNameHint": "The name recipients see; optional.",
+				"inbox": "Inbox folder",
+				"inboxHint": "Usually keep INBOX.",
+				"password": "Password / app password",
+				"passwordHint": "Stored securely in the local credential store. It is never written to settings.yaml or returned to this page.",
+				"configured": "Saved",
+				"missing": "Missing",
+				"credentialPlaceholder": "Enter an app password; leave blank to keep the saved value",
+				"clearPassword": "Clear app password",
+				"servers": "Mail servers",
+				"serversHint": "Choose a common provider to fill these automatically, or use Manual configuration for institutional and self-hosted mail.",
+				"preset": "Mail provider",
+				"custom": "Manual configuration",
+				"imap": "Incoming (IMAP)",
+				"smtp": "Outgoing (SMTP)",
+				"host": "Server address",
+				"port": "Port",
+				"tls": "Encryption",
+				"implicit": "Implicit TLS",
+				"starttls": "STARTTLS",
+				"advanced": "Advanced settings",
+				"advancedHint": "Login username, inbox folder, and safety limits usually need no changes.",
+				"collapse": "Collapse",
+				"agentAccess": "Agent access",
+				"agentAccessHint": "After saving the account and servers, enable reading and sending independently as needed.",
+				"permissionNeedsSetup": "Enter the email address, app password, and corresponding server first.",
+				"limits": "Safety limits",
+				"bodyLimit": "Body characters",
+				"messageLimit": "Whole-message bytes",
+				"attachmentLimit": "Total attachment bytes",
+				"usage": "After saving, ask the agent to find recent mail. The plugin never connects to a mailbox during startup or save.",
+				"error": "Save failed",
+				"reload": "Reload",
+				"unavailable": "This connection does not expose the mail settings namespace.",
+				"readOnly": "This connection exposes settings in read-only mode.",
+				"credentialPartial": "The app password was stored, but the remaining settings failed to save. Fix the form and save again."
+			}
+		};
+		//#endregion
 		//#region src/client/index.tsx
 		const inject = [
 			"slots",
+			"locale",
 			"remote",
 			"remote.credentials",
-			"settingsScope"
+			"configForms"
 		];
 		const NS = "dsh-mail-assistant";
 		const PASSWORD_REF = "DSH_MAIL_ASSISTANT_PASSWORD";
-		const copy = typeof navigator !== "undefined" && navigator.language.toLowerCase().startsWith("zh") ? {
-			nav: "邮件助手",
-			title: "邮件助手",
-			description: "让 Agent 通过标准 IMAP 只读检索邮件，并按当前 DSH 权限模式通过 SMTP 发信。它不是邮箱客户端，不会移动、删除、归档或修改邮件状态。",
-			loading: "正在读取配置…",
-			save: "保存",
-			saving: "正在保存…",
-			saved: "配置已保存，新调用立即生效。",
-			readPermission: "允许 Agent 读信",
-			readHint: "可列出目录、分页查找、读取邮件和下载附件；IMAP 始终只读。",
-			sendPermission: "允许 Agent 发信",
-			sendHint: "可发送纯文本邮件；普通权限逐次确认，Full Access 不再弹窗。",
-			identity: "邮箱账号",
-			identityHint: "先填写日常使用的邮箱信息。多数邮箱要求使用客户端授权码，而不是网页登录密码。",
-			email: "邮箱地址",
-			emailHint: "用于收信和发信。",
-			username: "登录用户名",
-			usernameHint: "仅当服务商要求时填写；留空则使用邮箱地址。",
-			fromName: "发件人显示名称",
-			fromNameHint: "收件人看到的名称；可留空。",
-			inbox: "收件箱目录",
-			inboxHint: "通常保持 INBOX。",
-			password: "密码 / 客户端授权码",
-			passwordHint: "安全写入 DSH 凭据存储，不会写进 settings.yaml，也不会回显。",
-			configured: "已保存",
-			missing: "未填写",
-			credentialPlaceholder: "输入授权码；已保存时留空不会改变",
-			clearPassword: "清除授权码",
-			servers: "邮箱服务器",
-			serversHint: "选择常见服务商可自动填写；单位邮箱或自建邮箱请选择“手动配置”。",
-			preset: "邮箱服务商",
-			custom: "手动配置",
-			imap: "收信（IMAP）",
-			smtp: "发信（SMTP）",
-			host: "服务器地址",
-			port: "端口",
-			tls: "加密",
-			implicit: "隐式 TLS",
-			starttls: "STARTTLS",
-			advanced: "高级设置",
-			advancedHint: "登录用户名、收件箱目录和安全上限通常不需要修改。",
-			collapse: "收起",
-			agentAccess: "开放给 Agent",
-			agentAccessHint: "账号和服务器保存好后，再按需要分别开放读信或发信。",
-			permissionNeedsSetup: "请先填写邮箱地址、授权码和相应的服务器。",
-			limits: "安全上限",
-			bodyLimit: "正文字符",
-			messageLimit: "整封邮件字节",
-			attachmentLimit: "附件总字节",
-			usage: "保存后，在对话里让 Agent“查一下最近邮件”即可验证。插件不会在启动或保存时主动连接邮箱。",
-			error: "保存失败",
-			reload: "重新加载",
-			unavailable: "当前 DSH 连接未提供此设置命名空间。",
-			readOnly: "当前连接为只读模式，无法保存设置。",
-			credentialPartial: "授权码已经保存，但其他配置保存失败；请修正后再次保存。"
-		} : {
-			nav: "Mail assistant",
-			title: "Mail assistant",
-			description: "Let the agent search mail through read-only IMAP and send through SMTP under the current DSH permission preset. This is not a mail client: it never moves, deletes, archives, or changes message state.",
-			loading: "Loading configuration…",
-			save: "Save",
-			saving: "Saving…",
-			saved: "Saved. New calls use the configuration immediately.",
-			readPermission: "Allow the agent to read mail",
-			readHint: "List folders, page through searches, read messages, and download attachments. IMAP always stays read-only.",
-			sendPermission: "Allow the agent to send mail",
-			sendHint: "Send plain-text messages. Ordinary permissions ask each time; Full Access does not prompt.",
-			identity: "Mailbox account",
-			identityHint: "Start with the mailbox information you normally use. Most providers require an app password instead of the web-login password.",
-			email: "Email address",
-			emailHint: "Used for both incoming and outgoing mail.",
-			username: "Login username",
-			usernameHint: "Only set this when required by your provider; otherwise the email address is used.",
-			fromName: "Sender display name",
-			fromNameHint: "The name recipients see; optional.",
-			inbox: "Inbox folder",
-			inboxHint: "Usually keep INBOX.",
-			password: "Password / app password",
-			passwordHint: "Stored securely in DSH Credentials. It is never written to settings.yaml or returned to this page.",
-			configured: "Saved",
-			missing: "Missing",
-			credentialPlaceholder: "Enter an app password; leave blank to keep the saved value",
-			clearPassword: "Clear app password",
-			servers: "Mail servers",
-			serversHint: "Choose a common provider to fill these automatically, or use Manual configuration for institutional and self-hosted mail.",
-			preset: "Mail provider",
-			custom: "Manual configuration",
-			imap: "Incoming (IMAP)",
-			smtp: "Outgoing (SMTP)",
-			host: "Server address",
-			port: "Port",
-			tls: "Encryption",
-			implicit: "Implicit TLS",
-			starttls: "STARTTLS",
-			advanced: "Advanced settings",
-			advancedHint: "Login username, inbox folder, and safety limits usually need no changes.",
-			collapse: "Collapse",
-			agentAccess: "Agent access",
-			agentAccessHint: "After saving the account and servers, enable reading and sending independently as needed.",
-			permissionNeedsSetup: "Enter the email address, app password, and corresponding server first.",
-			limits: "Safety limits",
-			bodyLimit: "Body characters",
-			messageLimit: "Whole-message bytes",
-			attachmentLimit: "Total attachment bytes",
-			usage: "After saving, ask the agent to find recent mail. The plugin never connects to a mailbox during startup or save.",
-			error: "Save failed",
-			reload: "Reload",
-			unavailable: "This DSH connection does not expose the mail settings namespace.",
-			readOnly: "This connection exposes settings in read-only mode.",
-			credentialPartial: "The app password was stored, but the remaining settings failed to save. Fix the form and save again."
-		};
 		const defaults = {
 			readEnabled: false,
 			sendEnabled: false,
@@ -221,7 +228,7 @@ window.__ModuleLoader__.load({
 			for (const [key, candidate] of Object.entries(presets)) if (Object.entries(candidate).every(([field, expected]) => value[field] === expected)) return key;
 			return "custom";
 		}
-		function MailSettings({ service }) {
+		function MailSettings({ t, service }) {
 			const [draft, setDraft] = (0, react.useState)(null);
 			const [passwordConfigured, setPasswordConfigured] = (0, react.useState)(false);
 			const [credentialWritable, setCredentialWritable] = (0, react.useState)(false);
@@ -282,10 +289,10 @@ window.__ModuleLoader__.load({
 						path: [field],
 						value
 					}));
-					await service.scope.mutate(ops, snapshot.revision);
-					setNotice(copy.saved);
+					if (await service.scope.mutate(ops, snapshot.revision) === false) throw new Error(t("error"));
+					setNotice(t("saved"));
 				} catch (cause) {
-					setError(passwordStored ? copy.credentialPartial : cause?.message || `${copy.error}`);
+					setError(passwordStored ? t("credentialPartial") : cause?.message || `${t("error")}`);
 				} finally {
 					setBusy(false);
 				}
@@ -298,7 +305,7 @@ window.__ModuleLoader__.load({
 					await unwrap(service.credentials.unset(PASSWORD_REF));
 					setPasswordConfigured(false);
 					setPassword("");
-					setNotice(copy.saved);
+					setNotice(t("saved"));
 				} catch (cause) {
 					setError(cause?.message || String(cause));
 				} finally {
@@ -369,10 +376,10 @@ window.__ModuleLoader__.load({
 			};
 			if (!draft) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				style: styles.root,
-				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: error || (snapshot.status === "unavailable" ? copy.unavailable : copy.loading) }), error && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: error || (snapshot.status === "unavailable" ? t("unavailable") : t("loading")) }), error && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 					style: styles.button,
 					onClick: () => load(),
-					children: copy.reload
+					children: t("reload")
 				})]
 			});
 			const credentialReady = passwordConfigured || password !== "";
@@ -420,7 +427,7 @@ window.__ModuleLoader__.load({
 							color: "#a82332",
 							fontSize: 11
 						},
-						children: copy.permissionNeedsSetup
+						children: t("permissionNeedsSetup")
 					})
 				] })]
 			});
@@ -453,20 +460,20 @@ window.__ModuleLoader__.load({
 						marginTop: 10
 					},
 					children: [
-						field(copy.host, `${prefix}Host`),
-						field(copy.port, `${prefix}Port`, "number"),
+						field(t("host"), `${prefix}Host`),
+						field(t("port"), `${prefix}Port`, "number"),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
 							style: styles.label,
-							children: [copy.tls, /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+							children: [t("tls"), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
 								value: draft[`${prefix}Tls`],
 								onChange: (event) => set(`${prefix}Tls`, event.currentTarget.value),
 								style: styles.input,
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
 									value: "implicit",
-									children: copy.implicit
+									children: t("implicit")
 								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
 									value: "starttls",
-									children: copy.starttls
+									children: t("starttls")
 								})]
 							})]
 						})
@@ -481,7 +488,7 @@ window.__ModuleLoader__.load({
 							margin: 0,
 							fontSize: 21
 						},
-						children: copy.title
+						children: t("title")
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 						style: {
@@ -490,7 +497,7 @@ window.__ModuleLoader__.load({
 							fontSize: 12,
 							lineHeight: 1.65
 						},
-						children: copy.description
+						children: t("description")
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 						style: styles.card,
@@ -500,7 +507,7 @@ window.__ModuleLoader__.load({
 									margin: 0,
 									fontSize: 15
 								},
-								children: copy.identity
+								children: t("identity")
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 								style: {
@@ -509,12 +516,12 @@ window.__ModuleLoader__.load({
 									fontSize: 11,
 									lineHeight: 1.55
 								},
-								children: copy.identityHint
+								children: t("identityHint")
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								style: styles.grid,
 								children: [
-									field(copy.email, "email", "email", copy.emailHint),
+									field(t("email"), "email", "email", t("emailHint")),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
 										style: styles.label,
 										children: [
@@ -524,7 +531,7 @@ window.__ModuleLoader__.load({
 													alignItems: "center",
 													gap: 7
 												},
-												children: [copy.password, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												children: [t("password"), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 													style: {
 														borderRadius: 999,
 														padding: "2px 7px",
@@ -532,7 +539,7 @@ window.__ModuleLoader__.load({
 														color: passwordConfigured ? "#32724e" : "#9d2f3f",
 														background: passwordConfigured ? "#eaf6ef" : "#f8e9ec"
 													},
-													children: passwordConfigured ? copy.configured : copy.missing
+													children: passwordConfigured ? t("configured") : t("missing")
 												})]
 											}),
 											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
@@ -540,11 +547,11 @@ window.__ModuleLoader__.load({
 												autoComplete: "new-password",
 												value: password,
 												disabled: busy || !credentialWritable,
-												placeholder: copy.credentialPlaceholder,
+												placeholder: t("credentialPlaceholder"),
 												onChange: (event) => setPassword(event.currentTarget.value),
 												style: styles.input
 											}),
-											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: copy.passwordHint }),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("passwordHint") }),
 											passwordConfigured && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 												type: "button",
 												disabled: busy || !credentialWritable,
@@ -554,11 +561,11 @@ window.__ModuleLoader__.load({
 													color: "#a82332"
 												},
 												onClick: clearPassword,
-												children: copy.clearPassword
+												children: t("clearPassword")
 											})
 										]
 									}),
-									field(copy.fromName, "fromName", "text", copy.fromNameHint)
+									field(t("fromName"), "fromName", "text", t("fromNameHint"))
 								]
 							})
 						]
@@ -578,7 +585,7 @@ window.__ModuleLoader__.load({
 									margin: 0,
 									fontSize: 15
 								},
-								children: copy.servers
+								children: t("servers")
 							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 								style: {
 									margin: "6px 0 0",
@@ -586,20 +593,20 @@ window.__ModuleLoader__.load({
 									fontSize: 11,
 									lineHeight: 1.55
 								},
-								children: copy.serversHint
+								children: t("serversHint")
 							})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
 								style: {
 									...styles.label,
 									minWidth: 210
 								},
-								children: [copy.preset, /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+								children: [t("preset"), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
 									value: preset,
 									onChange: (event) => applyPreset(event.currentTarget.value),
 									style: styles.input,
 									children: [
 										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
 											value: "custom",
-											children: copy.custom
+											children: t("custom")
 										}),
 										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
 											value: "gmail",
@@ -629,7 +636,7 @@ window.__ModuleLoader__.load({
 								display: "grid",
 								gap: 11
 							},
-							children: [server("imap", copy.imap), server("smtp", copy.smtp)]
+							children: [server("imap", t("imap")), server("smtp", t("smtp"))]
 						})]
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
@@ -651,7 +658,7 @@ window.__ModuleLoader__.load({
 									display: "block",
 									fontSize: 13
 								},
-								children: copy.advanced
+								children: t("advanced")
 							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 								style: {
 									display: "block",
@@ -659,28 +666,28 @@ window.__ModuleLoader__.load({
 									color: colors.secondary,
 									fontSize: 11
 								},
-								children: copy.advancedHint
-							})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: advancedOpen ? copy.collapse : "›" })]
+								children: t("advancedHint")
+							})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: advancedOpen ? t("collapse") : "›" })]
 						}), advancedOpen && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							style: { marginTop: 14 },
 							children: [
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 									style: styles.grid,
-									children: [field(copy.username, "username", "text", copy.usernameHint), field(copy.inbox, "inboxFolder", "text", copy.inboxHint)]
+									children: [field(t("username"), "username", "text", t("usernameHint")), field(t("inbox"), "inboxFolder", "text", t("inboxHint"))]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h4", {
 									style: {
 										margin: "17px 0 10px",
 										fontSize: 13
 									},
-									children: copy.limits
+									children: t("limits")
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 									style: styles.grid,
 									children: [
-										field(copy.bodyLimit, "maxBodyChars", "number"),
-										field(copy.messageLimit, "maxMessageBytes", "number"),
-										field(copy.attachmentLimit, "maxAttachmentBytes", "number")
+										field(t("bodyLimit"), "maxBodyChars", "number"),
+										field(t("messageLimit"), "maxMessageBytes", "number"),
+										field(t("attachmentLimit"), "maxAttachmentBytes", "number")
 									]
 								})
 							]
@@ -694,7 +701,7 @@ window.__ModuleLoader__.load({
 									margin: 0,
 									fontSize: 15
 								},
-								children: copy.agentAccess
+								children: t("agentAccess")
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 								style: {
@@ -703,11 +710,11 @@ window.__ModuleLoader__.load({
 									fontSize: 11,
 									lineHeight: 1.55
 								},
-								children: copy.agentAccessHint
+								children: t("agentAccessHint")
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								style: styles.grid,
-								children: [permission("readEnabled", copy.readPermission, copy.readHint, readReady), permission("sendEnabled", copy.sendPermission, copy.sendHint, sendReady)]
+								children: [permission("readEnabled", t("readPermission"), t("readHint"), readReady), permission("sendEnabled", t("sendPermission"), t("sendHint"), sendReady)]
 							})
 						]
 					}),
@@ -717,7 +724,7 @@ window.__ModuleLoader__.load({
 							fontSize: 11,
 							lineHeight: 1.55
 						},
-						children: copy.usage
+						children: t("usage")
 					}),
 					!snapshot.writable && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 						role: "status",
@@ -725,7 +732,7 @@ window.__ModuleLoader__.load({
 							color: colors.secondary,
 							fontSize: 12
 						},
-						children: copy.readOnly
+						children: t("readOnly")
 					}),
 					error && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 						role: "alert",
@@ -748,21 +755,24 @@ window.__ModuleLoader__.load({
 						disabled: busy || !snapshot.writable,
 						onClick: save,
 						style: styles.primary,
-						children: busy ? copy.saving : copy.save
+						children: busy ? t("saving") : t("save")
 					})
 				]
 			});
 		}
 		function apply(ctx) {
+			ctx.effect(() => ctx.locale.register(LOCALE_NS, dictionaries), "mail: dictionaries");
+			const t = ctx.locale.bind(LOCALE_NS);
 			const service = {
-				scope: ctx.settingsScope.bind({ namespace: NS }),
+				scope: ctx.configForms.get(NS),
 				credentials: ctx.remote.credentials
 			};
 			ctx.slots.inject("settings.section", () => ctx.slots.register({
 				name: "settings.section",
 				id: "mail-assistant",
+				locale: LOCALE_NS,
 				order: 25,
-				label: () => copy.nav,
+				label: () => t("nav"),
 				inject: () => ({ service })
 			}, MailSettings));
 		}