@eduwork/dsh-mail 0.1.2 → 0.2.1

package/CHANGELOG.en.md

@@ -2,6 +2,17 @@
 
 [简体中文](CHANGELOG.md) | **English**
 
+## 0.2.1 — 2026-10-22
+
+- Show email-send and attachment-save approval prompts in the active DSH UI language (Chinese or English), using the official approval panel.
+- Preserve existing permission decisions, original reasons and per-call approval behavior.
+
+## 0.2.0 — 2026-10-19
+
+- Require DSH 0.2.1-rc.2 or a compatible 0.2.x stable Host; use the official configForms settings surface in standalone builds.
+- Include the locale-service integration and scoped session/permission compatibility fixes already used by EduWork.
+- Preserve disabled-by-default reading/sending, read-only IMAP, credential references and per-send approval.
+
 ## 0.1.1 - 2026-09-11
 
 - Added exact peer support for official DeepSeek Harness `0.1.5-rc.1` and accepted the Tool/Agent, Session, Permission Presets, Filesystem, Credentials, Settings, and Web Client seams.

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 **简体中文** | [English](CHANGELOG.en.md)
 
+## 0.2.1 — 2026-10-22
+
+- 发信和附件保存的审批提示随 DSH 界面语言显示中英文，继续使用官方审批面板。
+- 保留现有权限判断、原始原因和逐次审批行为。
+
+## 0.2.0 — 2026-10-19
+
+- 最低宿主升级为 DSH 0.2.1-rc.2，兼容同一 API 系列的 0.2.x 正式版；独立设置页接入官方 configForms。
+- 同步已在 EduWork 使用的语言服务、会话与权限兼容修正。
+- 保留默认关闭的收发开关、只读 IMAP、凭据引用和逐次发信审批。
+
 ## 0.1.1 - 2026-09-11
 
 - 新增官方 DeepSeek Harness `0.1.5-rc.1` 的精确 peer 支持，并完成 Tool/Agent、Session、Permission Presets、Filesystem、Credentials、Settings 与 Web Client 接缝验收。

package/README.md

@@ -1,12 +1,12 @@
 # DSH Mail Assistant
 
-> npm 包：`@eduwork/dsh-mail@0.1.1`。旧无作用域包仅供迁移；安装切换与数据兼容见 [迁移说明](docs/EDUWORK-MIGRATION.md)。
+> npm 包：`@eduwork/dsh-mail@0.2.0`。旧无作用域包仅供迁移；安装切换与数据兼容见 [迁移说明](docs/EDUWORK-MIGRATION.md)。
 
 **简体中文** | [English](README_EN.md)
 
 面向 [DeepSeek Harness（DSH）](https://github.com/deepseek-ai/deepseek-harness) 的安全型邮件助手插件。它通过标准 IMAP 读取邮件、通过标准 SMTP 发送纯文本邮件，但刻意不成为另一个邮箱客户端。
 
-版本 `0.1.1` 面向 DeepSeek Harness `0.1.5-rc.1`，支持范围见[兼容性](docs/compatibility.md)。
+版本 `0.2.0` 面向 DeepSeek Harness `0.2.1-rc.2`，支持范围见[兼容性](docs/compatibility.md)。
 
 ## 定位与边界
 
@@ -37,12 +37,12 @@
 
 ## 安装
 
-要求：Node.js 22+、DSH `0.1.5-rc.1`，且所用 Profile 已包含 Settings、Credentials、Tools、Filesystem、Permission Presets、Approval 和 Web Client 官方能力。
+要求：Node.js 24.18+、DSH `0.2.1-rc.2`，且所用 Profile 已包含 Settings、Credentials、Tools、Filesystem、Permission Presets、Approval 和 Web Client 官方能力。
 
 普通使用请固定经过复核的 npm 精确版本：
 
 ```bash
-dsh plugin --profile web add @eduwork/dsh-mail@0.1.1
+dsh plugin --profile web add @eduwork/dsh-mail@0.2.0
 ```
 
 需要审计、开发或验证尚未发布的改动时，再从源码安装：

package/README_EN.md

@@ -1,12 +1,12 @@
 # DSH Mail Assistant
 
-> npm package: `@eduwork/dsh-mail@0.1.1`. The previous unscoped package is retained only for migration. See [migration and data compatibility](docs/EDUWORK-MIGRATION.en.md).
+> npm package: `@eduwork/dsh-mail@0.2.0`. The previous unscoped package is retained only for migration. See [migration and data compatibility](docs/EDUWORK-MIGRATION.en.md).
 
 [简体中文](README.md) | **English**
 
 A security-focused mail assistant plugin for [DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness). It reads through standard IMAP and sends through standard SMTP, while deliberately refusing to become another full mail client.
 
-Current version: `0.1.1`, reviewed against the public interfaces and an actual runtime of DeepSeek Harness `0.1.5-rc.1`. Complete your own security and compliance review before connecting a critical mailbox. See [compatibility](docs/compatibility.en.md) for the full support matrix.
+Current version: `0.2.0`, reviewed against the public interfaces and an actual runtime of DeepSeek Harness `0.2.1-rc.2`. Complete your own security and compliance review before connecting a critical mailbox. See [compatibility](docs/compatibility.en.md) for the full support matrix.
 
 ## Scope
 
@@ -37,12 +37,12 @@ See the complete [security model](docs/security-model.en.md).
 
 ## Install
 
-Prerequisites: Node.js 22+, DSH `0.1.5-rc.1`, and a Profile with the official Settings, Credentials, Tools, Filesystem, Permission Presets, Approval, and Web Client capabilities.
+Prerequisites: Node.js 24.18+, DSH `0.2.1-rc.2`, and a Profile with the official Settings, Credentials, Tools, Filesystem, Permission Presets, Approval, and Web Client capabilities.
 
 For normal use, pin the reviewed exact npm version:
 
 ```bash
-dsh plugin --profile web add @eduwork/dsh-mail@0.1.1
+dsh plugin --profile web add @eduwork/dsh-mail@0.2.0
 ```
 
 Use a source checkout for auditing, development, or unpublished changes:
@@ -100,7 +100,7 @@ Approval for `mail_send` controls one execution; it does not validate the recipi
 
 The plugin uses official DSH seams: `ctx.credentials`, `ctx.settings`, `settings.section`, `ctx.tools`, `ctx.permissionPresets`, `tools/pre-execute`, `ctx.fs`, and the Client Loader. Ordinary permissions route sends through the composed Approval service; Full Access proceeds without a prompt. It does not fork the upstream Web client.
 
-DSH `0.1.5-rc.1` has bounded binary reads but no binary-write filesystem seam. `mail_get_attachment` therefore uses `ctx.fs` to resolve and fence the local destination before an exclusive local write. A remote/non-local FS Provider may not support that one tool. See [compatibility](docs/compatibility.en.md).
+DSH `0.2.1-rc.2` has bounded binary reads but no binary-write filesystem seam. `mail_get_attachment` therefore uses `ctx.fs` to resolve and fence the local destination before an exclusive local write. A remote/non-local FS Provider may not support that one tool. See [compatibility](docs/compatibility.en.md).
 
 ## Documentation
 

package/THIRD_PARTY_NOTICES.en.md

@@ -13,3 +13,5 @@
 The project was informed by the MIT-licensed integration approach in [`STARDUSTLC666/dsh-email`](https://github.com/STARDUSTLC666/dsh-email), but redesigns the permission, credential, read-only IMAP, workspace, untrusted-content, and approval boundaries. No third-party project endorses this plugin.
 
 Exact direct and transitive versions are recorded in `package-lock.json`. Review the lockfile, license-check output, and final npm tarball before every public release.
+
+The development-only official DSH Host includes LibreOffice Kit (MPL-2.0) and sharp/libvips native packages (Apache-2.0 / LGPL-3.0-or-later). They are not bundled in the mail plugin archive; their license files remain with their own packages.

package/THIRD_PARTY_NOTICES.md

@@ -13,3 +13,5 @@
 项目参考了 MIT 许可的社区项目 [`STARDUSTLC666/dsh-email`](https://github.com/STARDUSTLC666/dsh-email) 在 ImapFlow、Nodemailer、MailParser 与 DSH 之间的组合思路，但重新设计了权限、凭据、只读 IMAP、工作区、邮件不可信内容和审批边界。没有任何第三方项目为本插件背书。
 
 直接和间接依赖的精确版本记录在 `package-lock.json`。每次公开发布前必须重新审查锁文件、许可证检查结果和最终 npm tarball。
+
+仅开发使用的官方 DSH Host 包含 LibreOffice Kit（MPL-2.0）与 sharp/libvips 原生包（Apache-2.0 / LGPL-3.0-or-later）。它们不打入邮件插件压缩包，许可证随各自的包保留。

package/docs/EDUWORK-MIGRATION.en.md

@@ -2,12 +2,12 @@
 
 [简体中文](EDUWORK-MIGRATION.md) | **English**
 
-Starting with `0.1.0`, the npm package is `@eduwork/dsh-mail`, replacing `dsh-mail-assistant`. The current installation example pins `0.1.1`. Source is maintained under `EduWork/packages/dsh-mail`.
+Starting with `0.1.0`, the npm package is `@eduwork/dsh-mail`, replacing `dsh-mail-assistant`. The current installation example pins `0.2.0`. Source is maintained under `EduWork/packages/dsh-mail`.
 
 ## Installation and migration
 
 ```sh
-dsh plugin --profile web add @eduwork/dsh-mail@0.1.1
+dsh plugin --profile web add @eduwork/dsh-mail@0.2.0
 ```
 
 Back up an existing Profile's package.json and cordis.patch.yml, then update its dependency and dsh.profile.bundles entries. Update module name paths in custom patches too. Do not enable both package identities together; restart the Host after switching. These are separate npm packages, so updating the old package cannot migrate an installation automatically.

package/docs/EDUWORK-MIGRATION.md

@@ -2,12 +2,12 @@
 
 **简体中文** | [English](EDUWORK-MIGRATION.en.md)
 
-从 `0.1.0` 起，npm 包使用 `@eduwork/dsh-mail`，替代旧的 `dsh-mail-assistant`。当前安装示例固定为 `0.1.1`。源码位于 EduWork 的 `packages/dsh-mail`。
+从 `0.1.0` 起，npm 包使用 `@eduwork/dsh-mail`，替代旧的 `dsh-mail-assistant`。当前安装示例固定为 `0.2.0`。源码位于 EduWork 的 `packages/dsh-mail`。
 
 ## 安装与迁移
 
 ```sh
-dsh plugin --profile web add @eduwork/dsh-mail@0.1.1
+dsh plugin --profile web add @eduwork/dsh-mail@0.2.0
 ```
 
 已有 Profile 先备份 package.json 与 cordis.patch.yml，再更新依赖和 dsh.profile.bundles；手写 patch 的模块路径 name 也需切换。不要同时启用新旧两份插件，切换后重启 Host。旧版本和新作用域版本是不同 npm 包，旧包的更新不会自动迁移安装。

package/docs/architecture.en.md

@@ -9,7 +9,7 @@
 ```text
 DSH Web Client
   └─ settings.section: Mail assistant
-       ├─ settingsScope        namespaced non-secret settings
+       ├─ configForms        namespaced non-secret settings
        └─ remote.credentials   write-only app password
 
 DSH Host
@@ -30,7 +30,7 @@ The plugin does not provide a Credential, Settings, Filesystem, Permission Prese
 
 Non-secret fields live in the `dsh-mail-assistant` settings namespace. The app password uses the fixed credential reference `DSH_MAIL_ASSISTANT_PASSWORD`. The Host resolves it at the beginning of every tool call and never caches it across operations, so rotation applies to the next call.
 
-The settings page reads and writes non-secret configuration through `settingsScope.bind({ namespace: 'dsh-mail-assistant' })`, using revision-fenced atomic mutations to avoid overwriting concurrent updates. For the app password it only invokes `credentials.describe/set/unset`: it can observe configured/writable state, but it cannot read the credential value back into the browser.
+The settings page reads and writes non-secret configuration through `configForms.get('dsh-mail-assistant')`, using revision-fenced atomic mutations to avoid overwriting concurrent updates. For the app password it only invokes `credentials.describe/set/unset`: it can observe configured/writable state, but it cannot read the credential value back into the browser.
 
 ## Message identity and pagination
 
@@ -58,7 +58,7 @@ Outbound attachments use `ctx.fs`: resolve from the session `cwd`, verify contai
 
 The Host artifact embeds the IMAP/SMTP implementation libraries in `lib/index.js`. Users do not install a second protocol runtime after npm, source-package, or offline-product installation, and plugin dependencies cannot collide with a product's private Node runtime during updates.
 
-DSH `0.1.5-rc.1` does not expose `writeBytes`. Attachment download therefore requires a local Host filesystem. The plugin resolves the logical destination with `ctx.fs`, creates the directory, resolves real workspace and directory paths, rechecks containment to reject pre-existing symlinks or junctions, and finally performs a random-name `wx` exclusive write. Replace this local adapter when DSH provides an official binary-write seam.
+DSH `0.2.1-rc.2` does not expose `writeBytes`. Attachment download therefore requires a local Host filesystem. The plugin resolves the logical destination with `ctx.fs`, creates the directory, resolves real workspace and directory paths, rechecks containment to reject pre-existing symlinks or junctions, and finally performs a random-name `wx` exclusive write. Replace this local adapter when DSH provides an official binary-write seam.
 
 ## Extension rules
 

package/docs/architecture.md

@@ -9,7 +9,7 @@
 ```text
 DSH Web Client
   └─ settings.section: 邮件助手设置页
-       ├─ settingsScope        绑定命名空间的非敏感配置
+       ├─ configForms        绑定命名空间的非敏感配置
        └─ remote.credentials   授权码只写
 
 DSH Host
@@ -30,7 +30,7 @@ DSH Host
 
 非敏感字段保存在 `dsh-mail-assistant` settings namespace。授权码使用固定 Credential Ref `DSH_MAIL_ASSISTANT_PASSWORD`。Host 在每个工具调用开始时重新解析引用，不跨操作缓存密码，因此轮换后的值会在下一次调用生效。
 
-设置页通过 `settingsScope.bind({ namespace: 'dsh-mail-assistant' })` 读写非敏感配置，并使用 revision fence 的原子 mutation 避免覆盖并发更新。它对授权码只能调用 `credentials.describe/set/unset`：可看到“是否配置”和“是否可写”，不能读回实际值。
+设置页通过 `configForms.get('dsh-mail-assistant')` 读写非敏感配置，并使用 revision fence 的原子 mutation 避免覆盖并发更新。它对授权码只能调用 `credentials.describe/set/unset`：可看到“是否配置”和“是否可写”，不能读回实际值。
 
 ## 邮件标识
 
@@ -66,7 +66,7 @@ handle 用于完整性检查和防误用，不是授权令牌，也不包含密
 
 Host 产物会把 IMAP/SMTP 运行依赖编入 `lib/index.js`。因此通过 npm、源码包或产品离线装配安装后，终端用户都不需要再安装 Node 依赖；这也避免了插件依赖与宿主随版本更新的私有 Node 运行时互相覆盖。
 
-DSH `0.1.5-rc.1` 暂无 `writeBytes`。下载附件因此只在本地 Host FS 上可用：插件先用 `ctx.fs` 解析逻辑路径，创建目录后再解析工作区与目标目录的真实路径并重新验证包含关系，最后把随机文件名以 `wx` 独占模式写入。这样会拒绝预置符号链接或目录联接造成的工作区逃逸。未来官方提供二进制写 seam 后，应删除这段本地适配，直接复用官方能力。
+DSH `0.2.1-rc.2` 暂无 `writeBytes`。下载附件因此只在本地 Host FS 上可用：插件先用 `ctx.fs` 解析逻辑路径，创建目录后再解析工作区与目标目录的真实路径并重新验证包含关系，最后把随机文件名以 `wx` 独占模式写入。这样会拒绝预置符号链接或目录联接造成的工作区逃逸。未来官方提供二进制写 seam 后，应删除这段本地适配，直接复用官方能力。
 
 ## 后续扩展规则
 

package/docs/compatibility.en.md

@@ -2,20 +2,19 @@
 
 [简体中文](compatibility.md) | **English**
 
-`@eduwork/dsh-mail@0.1.1` targets official DeepSeek Harness `0.1.5-rc.1` while retaining exact peer ranges for previously accepted baselines. See [migration](EDUWORK-MIGRATION.en.md) for the old unscoped package.
+`@eduwork/dsh-mail@0.2.0` targets official DeepSeek Harness `0.2.1-rc.2` with peer range `>=0.2.1-rc.2 <0.3.0-0`; older DSH Hosts must keep the earlier plugin. See [migration](EDUWORK-MIGRATION.en.md) for the old unscoped package.
 
 ## Reviewed baseline
 
-- DeepSeek Harness `0.1.5-rc.1` (current release baseline);
-- DeepSeek Harness `0.1.2-rc.1`, `0.1.3-alpha.1`, `0.1.3-alpha.2`, and `0.1.5-alpha.1` (previously accepted compatibility baselines);
-- Node.js 22+;
+- DeepSeek Harness `0.2.1-rc.2` (current release baseline);
+- Node.js 24.18+;
 - dynamic Web Client Bundle;
 - local Host filesystem;
 - IMAP4rev1/IMAP4rev2 and SMTP Submission with username plus password/app-password authentication.
 
 The DSH Profile provides `settings`, `credentials`, `tools`, `permissionPresets`, `approval`, and `fs`. The settings page also depends on official Remotes, Renderer, and Settings Client packages. Ordinary sending requires an interactive approval path; Full Access does not prompt.
 
-DSH `0.1.5-rc.1` requires plugins to use the Agent explicitly from tool execution context. Mail reads the current session from each execution's `exec.agent`, uses `agent.session` for permission presets and workspace resolution, does not depend on a global Agent, does not create or resume Sessions, and does not use ordinary subprocess handles. The ToolRuntime, Permission Presets, Credentials, Settings, Renderer, and Settings Client seams are accepted.
+DSH `0.2.1-rc.2` requires plugins to use the Agent explicitly from tool execution context. Mail reads the current session from each execution's `exec.agent`, uses `agent.session` for permission presets and workspace resolution, does not depend on a global Agent, does not create or resume Sessions, and does not use ordinary subprocess handles. The ToolRuntime, Permission Presets, Credentials, Settings, Renderer, and Settings Client seams are accepted.
 
 The official generic-file upload, Workspace Files, and `readByteRange()` can support future large-attachment improvements, but they cannot yet replace the Host binary write needed for IMAP downloads: `ctx.fs` still has no `writeBytes()`. This version therefore retains the local download adapter with workspace containment, real-path revalidation, and exclusive random filenames.
 
@@ -29,7 +28,7 @@ The official generic-file upload, Workspace Files, and `readByteRange()` can sup
 
 ## DSH binary-write limitation
 
-The current DSH `0.1.5-rc.1` release baseline exposes `ctx.fs.readBytes` but no `writeBytes`:
+The current DSH `0.2.1-rc.2` release baseline exposes `ctx.fs.readBytes` but no `writeBytes`:
 
 - outbound local attachments use the official seam end to end;
 - downloads require `ctx.fs.processPath()` and the Host Node process to share one filesystem;

package/docs/compatibility.md

@@ -2,20 +2,19 @@
 
 **简体中文** | [English](compatibility.en.md)
 
-`@eduwork/dsh-mail@0.1.1` 面向官方 DeepSeek Harness `0.1.5-rc.1`，同时保留已验收旧基线的精确 peer 范围。旧无作用域包迁移见[迁移说明](EDUWORK-MIGRATION.md)。
+`@eduwork/dsh-mail@0.2.0` 面向官方 DeepSeek Harness `0.2.1-rc.2`，使用有上下界的 peer 范围 `>=0.2.1-rc.2 <0.3.0-0`；旧 DSH 用户应继续使用旧插件。旧无作用域包迁移见[迁移说明](EDUWORK-MIGRATION.md)。
 
 ## 已验证基线
 
-- DeepSeek Harness `0.1.5-rc.1`（当前发布基线）；
-- DeepSeek Harness `0.1.2-rc.1`、`0.1.3-alpha.1`、`0.1.3-alpha.2`、`0.1.5-alpha.1`（保留兼容的历史验收基线）；
-- Node.js 22+；
+- DeepSeek Harness `0.2.1-rc.2`（当前发布基线）；
+- Node.js 24.18+；
 - Web Client 动态 Bundle；
 - 本地 Host 文件系统；
 - IMAP4rev1/IMAP4rev2 服务器与 SMTP Submission 服务的用户名 + 密码/应用密码认证。
 
 插件依赖 DSH Profile 提供 `settings`、`credentials`、`tools`、`permissionPresets`、`approval` 和 `fs`。设置页还依赖官方 Web Client 的 Remotes、Renderer 与 Settings 插槽；普通权限下发信需要交互式审批通路，Full Access 下不会弹出审批。
 
-DSH `0.1.5-rc.1` 要求插件从工具执行上下文显式使用 Agent。Mail 从每次执行的 `exec.agent` 读取当前会话，通过 `agent.session` 获取权限预设和工作区，不依赖全局 Agent，不创建或恢复 Session，也不使用普通 subprocess handle。ToolRuntime、Permission Presets、Credentials、Settings、Renderer 和 Settings Client 接缝均已验收。
+DSH `0.2.1-rc.2` 要求插件从工具执行上下文显式使用 Agent。Mail 从每次执行的 `exec.agent` 读取当前会话，通过 `agent.session` 获取权限预设和工作区，不依赖全局 Agent，不创建或恢复 Session，也不使用普通 subprocess handle。ToolRuntime、Permission Presets、Credentials、Settings、Renderer 和 Settings Client 接缝均已验收。
 
 官方通用文件上传、Workspace Files 和 `readByteRange()` 可供后续大附件体验复用，但当前不能替代 IMAP 下载所需的 Host 二进制写入：`ctx.fs` 仍没有 `writeBytes()`。因此本版本继续保留受工作区约束、重新校验真实路径并使用独占随机文件名的本地下载适配。
 
@@ -29,7 +28,7 @@ DSH `0.1.5-rc.1` 要求插件从工具执行上下文显式使用 Agent。Mail
 
 ## DSH 二进制写限制
 
-当前发布基线 DSH `0.1.5-rc.1` 提供 `readBytes`，没有 `writeBytes`。因此：
+当前发布基线 DSH `0.2.1-rc.2` 提供 `readBytes`，没有 `writeBytes`。因此：
 
 - 发送本地附件可完整复用官方 seam；
 - 下载附件只能在 `ctx.fs.processPath()` 与 Host Node 进程指向同一文件系统时工作；插件会在创建目录后解析真实路径并再次验证工作区包含关系；

package/docs/getting-started.en.md

@@ -4,8 +4,8 @@
 
 ## Requirements
 
-- Node.js 22+;
-- DeepSeek Harness `0.1.5-rc.1`;
+- Node.js 24.18+;
+- DeepSeek Harness `0.2.1-rc.2`;
 - a Profile with Settings, Credentials, Tools, Filesystem, Permission Presets, Approval, and Web Client;
 - an IMAP/SMTP-enabled mailbox and provider-issued app password.
 
@@ -14,7 +14,7 @@
 For normal use, pin the reviewed exact npm version:
 
 ```bash
-dsh plugin --profile web add @eduwork/dsh-mail@0.1.1
+dsh plugin --profile web add @eduwork/dsh-mail@0.2.0
 ```
 
 For auditing, development, or unpublished changes, use a source checkout:
@@ -63,10 +63,10 @@ npm ci
 npm run check
 ```
 
-To verify the real DSH `0.1.5-rc.1` contract, point `DSH_RUNTIME_ROOT` at a clean runtime of that exact version and run:
+To verify the DSH `0.2.1-rc.2` API contract in the development lock, run:
 
 ```bash
-npm run accept:dsh-015-rc1
+npm run check:dsh
 ```
 
-This uses a no-network delivery simulator to cover Agent-session, rejection, one-time approval, and Full Access paths without a real mailbox. Run real IMAP/SMTP interoperability only with a dedicated test account in an isolated Profile.
+This checks public APIs and client settings integration. `npm test` uses synthetic data for permissions, attachments and mail parsing; it does not establish real mailbox delivery. Run real IMAP/SMTP interoperability only with a dedicated test account in an isolated Profile.

package/docs/getting-started.md

@@ -4,8 +4,8 @@
 
 ## 前置条件
 
-- Node.js 22+；
-- DeepSeek Harness `0.1.5-rc.1`；
+- Node.js 24.18+；
+- DeepSeek Harness `0.2.1-rc.2`；
 - Profile 中已经有 Settings、Credentials、Tools、Filesystem、Permission Presets、Approval 和 Web Client；
 - 一个开启了 IMAP/SMTP 的邮箱账号，以及邮箱服务商签发的客户端授权码或应用专用密码。
 
@@ -14,7 +14,7 @@
 普通使用固定经过复核的 npm 精确版本：
 
 ```bash
-dsh plugin --profile web add @eduwork/dsh-mail@0.1.1
+dsh plugin --profile web add @eduwork/dsh-mail@0.2.0
 ```
 
 需要审计、开发或验证尚未发布的改动时，使用源码 checkout：
@@ -65,10 +65,10 @@ npm ci
 npm run check
 ```
 
-要复核 DSH `0.1.5-rc.1` 的真实运行时契约，把 `DSH_RUNTIME_ROOT` 指向该版本的干净 Runtime 后运行：
+要复核开发锁中的 DSH `0.2.1-rc.2` API 契约，运行：
 
 ```bash
-npm run accept:dsh-015-rc1
+npm run check:dsh
 ```
 
-此验收使用无网络发送模拟器检查 Agent 会话、审批拒绝、单次允许与 Full Access 路径，不需要真实邮箱。真实 IMAP/SMTP 互操作只在专用测试账号和隔离 Profile 中执行。
+该检查核对公开 API 和客户端设置接入；`npm test` 使用合成数据覆盖权限、附件和邮件解析，不代表真实邮箱投递验收。真实 IMAP/SMTP 互操作只在专用测试账号和隔离 Profile 中执行。

package/docs/security-model.en.md

@@ -23,6 +23,10 @@ The canonical body field is `untrustedText`. Rendering adds a fixed warning and
 
 Warnings are defense in depth. The actual mutation boundary is enforced by the separate `sendEnabled` capability, argument validation, workspace fencing, and DSH's native `tools/pre-execute` permission path. Even if the model mishandles text, the mail body cannot bypass those mechanisms.
 
+## Attachment downloads
+
+`mail_get_attachment` checks the session's effective write policy before accessing credentials or downloading. Workspace-write permits saving attachments; read-only or unknown modes require approval for this call. Rejection, cancellation or unavailable approval prevents the download. Path and size limits remain enforced; download permission does not grant permission to send mail.
+
 ## Send approval
 
 `mail_send` enters DSH permission handling before credentials, attachments, or SMTP access:

package/docs/security-model.md

@@ -23,6 +23,10 @@
 
 这些提示不是唯一防线。真正的写操作依赖独立机制：`mail_send` 的能力开关、参数验证、工作区附件 fence，以及 DSH 原生 `tools/pre-execute` 权限通路。即使模型忽略提示，邮件正文仍不能绕过它们。
 
+## 附件下载
+
+`mail_get_attachment` 在访问凭据和下载附件之前检查会话当前生效的写入权限。工作区写入权限允许保存附件；只读或未知权限仍请求本次审批。拒绝、取消或审批不可用时不执行下载。路径边界和文件大小限制继续生效；下载权限不会授予发信权限。
+
 ## 发信审批
 
 `mail_send` 在接触凭据、附件或 SMTP 之前进入 DSH 原生权限 waterfall：