@xmanrui/dsh-im 4.21.2 → 4.23.0

package/plugin-src/client/index.js

@@ -14,6 +14,7 @@ import {
   WeixinLogoGlyph,
   WhatsappLogoGlyph,
   IMessageLogoGlyph,
+  EmailLogoGlyph,
 } from './channel-logos.js';
 import { DINGTALK_RPC_CHANNEL } from './channels/dingtalk/api.js';
 import { DingtalkSettingsTab } from './channels/dingtalk/index.js';
@@ -48,8 +49,11 @@ import { WHATSAPP_RPC_CHANNEL } from './channels/whatsapp/api.js';
 import { WhatsappSettingsTab } from './channels/whatsapp/index.js';
 import { installWhatsappStyles } from './channels/whatsapp/styles.js';
 import { IMESSAGE_RPC_CHANNEL } from './channels/imessage/api.js';
+import { EMAIL_RPC_CHANNEL } from './channels/email/api.js';
 import { IMessageSettingsTab } from './channels/imessage/index.js';
+import { EmailSettingsTab, useEmailChannelEnabled } from './channels/email/index.js';
 import { installIMessageStyles } from './channels/imessage/styles.js';
+import { installEmailStyles } from './channels/email/styles.js';
 import { en, h, IM_LOCALE_NAMESPACE, setImTranslator, zh } from './i18n.js';
 import {
   HOST_LANGUAGE_RPC_CHANNEL,
@@ -74,6 +78,7 @@ import { installImStyles } from './styles.js';
 import { installSessionChannelLogos } from './session-channel-logos.js';
 import { UpdatePanel, UPDATE_RPC_CHANNEL } from './update-panel.js';
 import { WorkspaceDirectoryPickerContext } from './workspace-editor.js';
+import { IMPanelErrorBoundary } from './panel-error-boundary.js';
 
 export const name = 'im-settings';
 export const inject = ['slots', 'connection', 'locale', 'workspaces'];
@@ -101,6 +106,7 @@ const CHANNELS = Object.freeze([
   { id: 'whatsapp', label: 'WhatsApp' },
   { id: 'wecomApp', label: '企业微信应用', note: '（实验功能）' },
   { id: 'imessage', label: 'iMessage', note: '（实验功能）' },
+  { id: 'email', label: '邮箱', note: '（实验功能）' },
   { id: 'office', label: 'AI Office', note: '（实验功能）' },
 ]);
 
@@ -156,6 +162,11 @@ function IMessageLogo() {
     h(IMessageLogoGlyph));
 }
 
+function EmailLogo() {
+  return h('span', { className: 'dim-logo dim-logoEmail', 'aria-hidden': 'true' },
+    h(EmailLogoGlyph));
+}
+
 function OfficeLogo() {
   return h('span', { className: 'dim-logo dim-logoOffice', 'aria-hidden': 'true' },
     h(OfficeLogoGlyph));
@@ -173,6 +184,7 @@ function ChannelLogo({ channel }) {
   if (channel === 'discord') return h(DiscordLogo);
   if (channel === 'whatsapp') return h(WhatsappLogo);
   if (channel === 'imessage') return h(IMessageLogo);
+  if (channel === 'email') return h(EmailLogo);
   return h(OfficeLogo);
 }
 
@@ -197,6 +209,7 @@ export function IMSettingsTab({
   discordRpcCall,
   feishuRpcCall,
   imessageRpcCall,
+  emailRpcCall,
   qqRpcCall,
   slackRpcCall,
   telegramRpcCall,
@@ -209,17 +222,30 @@ export function IMSettingsTab({
   deliveryRpcCall,
   globalSettingsRpcCall,
   workspaceDirectoryPicker,
+  preferredSectionId,
   browserLocation = globalThis.location,
   navigateToRecoveryUrl = replacePageLocation,
 }) {
-  const [selected, setSelected] = React.useState('weixin');
+  const [selected, setSelected] = React.useState(() => (
+    preferredSectionId === GLOBAL_SETTINGS_TAB_ID
+      || CHANNELS.some((channel) => channel.id === preferredSectionId)
+      ? preferredSectionId : 'weixin'
+  ));
   const [loopbackRecovery, setLoopbackRecovery] = React.useState(null);
   const [runningVersion, setRunningVersion] = React.useState(IM_PLUGIN_VERSION);
   const [deliverySettings, setDeliverySettings] = React.useState(null);
+  // The Host owns email availability and reports it over RPC. The
+  // mailbox entry point is omitted entirely while it is closed, and the visible
+  // channel list is what every later lookup (active tab, rail) reads from.
+  const emailEnabled = useEmailChannelEnabled(emailRpcCall);
+  const visibleChannels = React.useMemo(
+    () => CHANNELS.filter((channel) => channel.id !== 'email' || emailEnabled),
+    [emailEnabled],
+  );
   const githubTooltipId = React.useId();
   const generalSettingsTooltipId = React.useId();
   const globalSettingsSelected = selected === GLOBAL_SETTINGS_TAB_ID;
-  const active = CHANNELS.find((channel) => channel.id === selected) ?? CHANNELS[0];
+  const active = visibleChannels.find((channel) => channel.id === selected) ?? visibleChannels[0];
   const activeTabId = globalSettingsSelected
     ? 'dim-general-settings-trigger'
     : `dim-tab-${active.id}`;
@@ -248,6 +274,7 @@ export function IMSettingsTab({
     deliveryRpcCall,
     globalSettingsRpcCall,
     imessageRpcCall,
+    emailRpcCall,
   }, {
     location: browserLocation,
     onRecovery: reportLoopbackRecovery,
@@ -259,6 +286,7 @@ export function IMSettingsTab({
     feishuRpcCall,
     globalSettingsRpcCall,
     imessageRpcCall,
+    emailRpcCall,
     officeRpcCall,
     qqRpcCall,
     reportLoopbackRecovery,
@@ -325,7 +353,7 @@ export function IMSettingsTab({
     ),
     h('div', { className: 'dim-layout' },
       h('nav', { className: 'dim-rail', role: 'tablist', 'aria-label': 'IM 设置导航' },
-        CHANNELS.map((channel) => h('button', {
+        visibleChannels.map((channel) => h('button', {
           key: channel.id,
           type: 'button',
           role: 'tab',
@@ -389,6 +417,8 @@ export function IMSettingsTab({
                           ? h(WhatsappSettingsTab, { rpcCall: rpcCalls.whatsappRpcCall })
                           : active.id === 'imessage'
                             ? h(IMessageSettingsTab, { rpcCall: rpcCalls.imessageRpcCall })
+                          : active.id === 'email'
+                            ? h(EmailSettingsTab, { rpcCall: rpcCalls.emailRpcCall })
                           : h(OfficeSettingsTab, { rpcCall: rpcCalls.officeRpcCall }))),
     ),
   ));
@@ -427,6 +457,7 @@ export function apply(ctx) {
       installDiscordStyles(),
       installWhatsappStyles(),
       installIMessageStyles(),
+      installEmailStyles(),
       installOfficeStyles(),
       installImStyles(),
     ];
@@ -455,6 +486,8 @@ export function apply(ctx) {
     callManagementRpc(ctx.connection, WHATSAPP_RPC_CHANNEL, endpoint, payload, signal);
   const imessageRpcCall = (endpoint, payload, signal) =>
     callManagementRpc(ctx.connection, IMESSAGE_RPC_CHANNEL, endpoint, payload, signal);
+  const emailRpcCall = (endpoint, payload, signal) =>
+    callManagementRpc(ctx.connection, EMAIL_RPC_CHANNEL, endpoint, payload, signal);
   const slackRpcCall = (endpoint, payload, signal) =>
     callManagementRpc(ctx.connection, SLACK_RPC_CHANNEL, endpoint, payload, signal);
   const officeRpcCall = (endpoint, payload, signal) =>
@@ -471,29 +504,90 @@ export function apply(ctx) {
     pickDirectory: () => callWorkspaceDirectoryApi(ctx, 'pickDirectory'),
   });
 
-  ctx.slots.inject('settings.section', () => ctx.slots.register({
-    name: 'settings.section',
-    id: 'xmanrui-dsh-im',
-    order: 21,
-    label: () => t('IM机器人'),
-    locale: IM_LOCALE_NAMESPACE,
-    inject: () => ({
-      dingtalkRpcCall,
-      discordRpcCall,
-      feishuRpcCall,
-      qqRpcCall,
-      slackRpcCall,
-      telegramRpcCall,
-      wecomRpcCall,
-      wecomAppRpcCall,
-      weixinRpcCall,
-      whatsappRpcCall,
-      imessageRpcCall,
-      officeRpcCall,
-      updateRpcCall,
-      deliveryRpcCall,
-      globalSettingsRpcCall,
-      workspaceDirectoryPicker,
-    }),
-  }, IMSettingsTab));
+  const panelDependencies = {
+    dingtalkRpcCall,
+    discordRpcCall,
+    feishuRpcCall,
+    qqRpcCall,
+    slackRpcCall,
+    telegramRpcCall,
+    wecomRpcCall,
+    wecomAppRpcCall,
+    weixinRpcCall,
+    whatsappRpcCall,
+    imessageRpcCall,
+    officeRpcCall,
+    emailRpcCall,
+    updateRpcCall,
+    deliveryRpcCall,
+    globalSettingsRpcCall,
+    workspaceDirectoryPicker,
+  };
+  const subscribeLocale = (listener) => typeof ctx.on === 'function'
+    ? ctx.on('locale/change', listener) : () => {};
+  const localeSnapshot = () => ctx.locale.getLocale?.()?.active ?? '';
+
+  // Stable for this plugin lifetime: creating an element must not create a
+  // new component type and reset the reader's selected tab or unsaved input.
+  function IMPanel({ preferredSectionId }) {
+    React.useSyncExternalStore(subscribeLocale, localeSnapshot, localeSnapshot);
+    return h(IMPanelErrorBoundary, null,
+      h(IMSettingsTab, { ...panelDependencies, preferredSectionId }));
+  }
+  const buildPanelElement = (props = {}) => h(IMPanel, {
+    preferredSectionId: props.preferredSectionId,
+  });
+
+  ctx.effect(() => {
+    let disposed = false;
+    let stopSettings = null;
+    let registered = false;
+    const setSettingsVisible = (visible) => {
+      if (disposed) return;
+      if (typeof visible !== 'boolean') throw new TypeError('visible must be a boolean');
+      if (visible === (stopSettings !== null)) return;
+      if (!visible) {
+        const stop = stopSettings;
+        stopSettings = null;
+        stop();
+        return;
+      }
+      // The existing slot controller owns late declarations, withdrawal and
+      // re-declaration. Cancelling it also cancels a pending registration.
+      stopSettings = ctx.slots.inject('settings.section', () => {
+        const unregister = ctx.slots.register({
+          name: 'settings.section',
+          id: 'xmanrui-dsh-im',
+          order: 21,
+          label: () => t('IM机器人'),
+          locale: IM_LOCALE_NAMESPACE,
+          inject: () => panelDependencies,
+        }, buildPanelElement);
+        registered = true;
+        return () => {
+          registered = false;
+          unregister();
+        };
+      });
+    };
+
+    // Publish only after the default registration is established, so a
+    // consumer hiding it during service discovery cannot be overridden.
+    setSettingsVisible(true);
+    if (typeof ctx.provide === 'function') {
+      ctx.provide('dshImClient', Object.freeze({
+        version: 1,
+        render: (props) => disposed ? null : buildPanelElement(props),
+        setSettingsVisible,
+        settingsVisible: () => !disposed && registered,
+      }));
+    }
+    return () => {
+      disposed = true;
+      const stop = stopSettings;
+      stopSettings = null;
+      registered = false;
+      stop?.();
+    };
+  }, 'im-settings: client panel service');
 }

package/plugin-src/client/last-message-error.js

@@ -1,3 +1,4 @@
+import { diagnosticFields } from '../../src/channels/shared/diagnostic-details.mjs';
 function text(value, maxLength) {
   if (typeof value !== 'string') return null;
   const trimmed = value.trim();
@@ -12,6 +13,6 @@ export function normalizeLastMessageError(value) {
   const referenceId = text(value.referenceId, 40);
   const at = Number.isFinite(value.at) ? value.at : null;
   return code && reason && message && referenceId && at !== null
-    ? { code, reason, message, referenceId, at }
+    ? { code, reason, message, referenceId, at, ...(value.details ? diagnosticFields(value) : {}) }
     : null;
 }

package/plugin-src/client/panel-error-boundary.js

@@ -0,0 +1,21 @@
+import * as React from 'react';
+import { h } from './i18n.js';
+
+/** Keep a broken IM subtree local when a shell renders it outside a slot. */
+export class IMPanelErrorBoundary extends React.Component {
+  state = { failed: false };
+
+  static getDerivedStateFromError() {
+    return { failed: true };
+  }
+
+  render() {
+    if (!this.state.failed) return this.props.children;
+    return h('section', { className: 'dim-page', role: 'alert' },
+      h('p', null, 'IM 面板加载失败'),
+      h('button', {
+        type: 'button',
+        onClick: () => this.setState({ failed: false }),
+      }, '重试'));
+  }
+}

package/plugin-src/client/styles.js

@@ -1,6 +1,12 @@
 export const IM_STYLE_ID = 'xmanrui-dsh-im-settings';
 
 const CSS = String.raw`
+.dim-connectionDiagnostic { min-width: 0; width: 100%; color: var(--dsw-alias-label-secondary, #646a73); overflow-wrap: anywhere; font-size: 13px; line-height: 1.6; }
+.dim-connectionDiagnostic[data-warning="true"] { color: var(--dsw-alias-state-warn-primary, #d97706); }
+.dim-connectionDiagnostic p { margin: 4px 0; }
+.dim-connectionDiagnostic button { border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 6px; padding: 6px 10px; color: inherit; background: var(--dsw-alias-bg-layer-1, #fff); font: inherit; cursor: pointer; }
+.dim-connectionDiagnostic button:focus-visible, .dim-connectionDiagnostic summary:focus-visible { outline: 2px solid var(--dsw-alias-state-business-primary, #3370ff); outline-offset: 2px; }
+
 .dim-aliasName { display: flex; align-items: center; gap: 4px; min-width: 0; }
 .dim-aliasName h3 { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .dim-aliasName h3:focus-visible { outline: 2px solid var(--dsw-alias-state-business-primary, #3370ff); outline-offset: 2px; border-radius: 3px; }

package/plugin-src/host/build.mjs

@@ -14,7 +14,11 @@ const externalRuntimePackages = [
   '@tencent-connect/qqbot-nodejs',
   '@wecom/aibot-node-sdk',
   'dingtalk-stream',
+  'imapflow',
+  'mailparser',
+  'nodemailer',
   'qrcode',
+  'sharp',
   'undici',
 ];
 const external = externalRuntimePackages.flatMap((name) => [name, `${name}/*`]);

package/plugin-src/host/channels/dingtalk/production.mjs

@@ -1,3 +1,4 @@
+import { getImageInputSettingsStore } from '../../../../src/channels/shared/image-input-settings-store.mjs';
 import { unlink } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
@@ -14,6 +15,7 @@ import {
   createWorkspaceAwareController,
   observeBotWorkspaceRemovals,
 } from '../../../../src/channels/shared/bot-workspace-store.mjs';
+import { prepareBotWorkspace } from '../../../../src/channels/shared/default-workspace.mjs';
 import { listAgentPresetCatalog } from '../../../../src/channels/shared/agent-preset.mjs';
 import { listModelCatalog } from '../../../../src/channels/shared/model-setting.mjs';
 import { createDeliveryAdapter } from '../../delivery-adapter.mjs';
@@ -58,7 +60,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   const agentPresetCatalog = () => listAgentPresetCatalog(ctx);
   const paths = pluginPaths(config);
   const configStore = await new ConfigStore(paths.config).load();
-  const defaultWorkspace = resolve(config.workspace ?? process.cwd());
+  const { defaultWorkspace, ungroupedWorkspace } = await prepareBotWorkspace(config);
   const WorkspaceStore = internals.WorkspaceStore ?? BotWorkspaceStore;
   const workspaces = internals.workspaces
     ?? await new WorkspaceStore(paths.workspaces, { defaultWorkspace }).load();
@@ -105,12 +107,14 @@ export async function createProductionController(ctx, config = {}, internals = {
   const harness = new Harness({
     ...connection,
     workspace: defaultWorkspace,
+    ungroupedWorkspace,
     autostart: false,
     dshBin: config.dshBin ?? 'dsh',
     ...(commandExecutor ? { commandExecutor } : {}),
     ...(controlExecutor ? { controlExecutor } : {}),
     ...(sessionMaintenanceExecutor ? { sessionMaintenanceExecutor } : {}),
     ...(fileIngressExecutor ? { fileIngressExecutor } : {}),
+    imageInputPolicy: () => getImageInputSettingsStore(config).get(),
   });
   const modelCatalog = () => listModelCatalog(harness);
   const coreController = new Controller({

package/plugin-src/host/channels/dingtalk/rpc.mjs

@@ -1,3 +1,5 @@
+import { diagnosticFields } from '../../../../src/channels/shared/diagnostic-details.mjs';
+import { createConnectionDiagnostics, diagnosticRpcResult } from '../../../../src/channels/shared/connection-error.mjs';
 import { SET_ALIAS_ENDPOINT, validAliasPayload } from '../shared/bot-alias-rpc.mjs';
 import { registerManagementRpc } from '../../../management-rpc.mjs';
 import QRCode from 'qrcode';
@@ -169,7 +171,7 @@ function publicConnectionFailure(error) {
       ? source.referenceId
       : null;
   return code && message && hint && referenceId
-    ? { code, message, hint, referenceId }
+    ? { code, message, hint, referenceId, ...diagnosticFields(source) }
     : null;
 }
 
@@ -227,6 +229,7 @@ function assertController(controller) {
 }
 
 export function createDingtalkRpcHandler(controller, { encodeQr = qrDataUrl } = {}) {
+  const diagnostics = controller.diagnostics ?? createConnectionDiagnostics({ channel: 'dingtalk' });
   assertController(controller);
   const qrCache = new Map();
   const cachedEncode = (url) => {
@@ -283,7 +286,7 @@ export function createDingtalkRpcHandler(controller, { encodeQr = qrDataUrl } =
               await controller.sendConnectionTest(payload.botId);
               testMessage = publicConnectionTestResult();
             } catch (error) {
-              testMessage = publicConnectionTestResult(error);
+              testMessage = publicConnectionTestResult(error, { diagnostics, botId: payload.botId });
             }
           }
         }
@@ -338,11 +341,11 @@ export function createDingtalkRpcHandler(controller, { encodeQr = qrDataUrl } =
     } catch (error) {
       const workspaceError = publicWorkspaceError(error);
       const connectionError = publicConnectionFailure(error);
-      return signal?.aborted ? cancelled() : workspaceError
+      return diagnosticRpcResult(diagnostics, error, signal?.aborted ? cancelled() : workspaceError
         ? { ok: false, error: workspaceError }
         : connectionError
           ? { ok: false, error: connectionError }
-        : internalFailure();
+        : internalFailure(), { operation: endpoint, botId: payload?.botId });
     }
   };
 }

package/plugin-src/host/channels/email/availability.mjs

@@ -0,0 +1,60 @@
+/**
+ * The single switch that opens or closes the email channel.
+ *
+ * Email is enabled by default. A deployment can opt out with
+ * `EMAIL_CHANNEL_ENABLED=0` or `emailChannelEnabled: false` in the channel config.
+ * Setting either option to true enables the entry point, runtime and config
+ * restore again without a code change.
+ *
+ * Closing is deliberately non-destructive: it never deletes a mailbox config or
+ * a credential. It only refuses to expose the entry point and to start the
+ * runtime, so every existing mailbox is still there when the switch reopens.
+ */
+
+/** Environment variable that controls the email channel. */
+export const EMAIL_CHANNEL_ENABLED_ENV = 'EMAIL_CHANNEL_ENABLED';
+
+const TRUTHY = new Set(['1', 'true', 'yes', 'on']);
+const FALSY = new Set(['0', 'false', 'no', 'off', '']);
+
+function readBoolean(value) {
+  if (typeof value === 'boolean') return value;
+  if (typeof value === 'string') {
+    const normalized = value.trim().toLowerCase();
+    if (TRUTHY.has(normalized)) return true;
+    if (FALSY.has(normalized)) return false;
+  }
+  return null;
+}
+
+/**
+ * Decide whether the email channel is open.
+ *
+ * An explicit config value wins over the environment so a deployment can pin
+ * the channel without changing its environment; an unreadable value falls back
+ * to the environment, and an absent one keeps the channel enabled.
+ */
+export function isEmailChannelEnabled(config = {}, env = process.env) {
+  return readBoolean(config.emailChannelEnabled)
+    ?? readBoolean(env?.[EMAIL_CHANNEL_ENABLED_ENV])
+    ?? true;
+}
+
+/**
+ * The single host-side gate.
+ *
+ * Returns `null` when email is open, or a public "not available" result when it
+ * is closed. Both the management RPC and the production startup consult this so
+ * a closed channel can neither be configured nor connected.
+ */
+export function emailChannelGate(config = {}, env = process.env) {
+  if (isEmailChannelEnabled(config, env)) return null;
+  return Object.freeze({
+    ok: false,
+    error: Object.freeze({
+      code: 'email-channel-disabled',
+      message: 'Email is not available yet.',
+      details: Object.freeze({}),
+    }),
+  });
+}

package/plugin-src/host/channels/email/index.mjs

@@ -0,0 +1,36 @@
+import { createProductionController } from './production.mjs';
+import { createEmailRpcHandler, installEmailRpc, EMAIL_RPC_CHANNEL } from './rpc.mjs';
+import { installProductionChannel } from '../shared/startup.mjs';
+import { emailChannelGate } from './availability.mjs';
+
+export const name = 'dsh-im-email-host';
+export const inject = ['connection', 'credentials', 'typertGateway'];
+
+/**
+ * Cordis/DSH Host plugin entry. The management RPC is mounted before the
+ * fallible production initialization so the channel's settings page stays
+ * reachable (and can report why the mailbox failed) even when startup throws.
+ * Tests and embedded distributions may inject a controller through config.
+ *
+ * While `EMAIL_CHANNEL_ENABLED` is off this mounts the management RPC only and
+ * returns: no mailbox runtime is started and no configured mailbox is restored,
+ * so a machine that already holds mailboxes sends no network request for them.
+ * Nothing is deleted — reopening the switch restores every mailbox untouched.
+ */
+export async function apply(ctx, config = {}) {
+  if (config?.controller) {
+    return installEmailRpc(ctx, config.controller, config.rpcAuthority);
+  }
+  const closed = emailChannelGate(config);
+  if (closed) return installEmailRpc(ctx, { disabled: () => closed }, config.rpcAuthority);
+  return installProductionChannel(ctx, config, {
+    channel: 'email',
+    rpcChannel: EMAIL_RPC_CHANNEL,
+    createProduction: () => createProductionController(ctx, config, config.internals ?? {}),
+    createHandler: controller => createEmailRpcHandler(controller),
+  });
+}
+
+export { createProductionController } from './production.mjs';
+export { EMAIL_ENDPOINTS, EMAIL_RPC_CHANNEL, EMAIL_RPC_ENDPOINTS,
+  createEmailRpcHandler, installEmailRpc } from './rpc.mjs';

package/plugin-src/host/channels/email/production.mjs

@@ -0,0 +1,58 @@
+import { EmailConfigStore } from '../../../../src/channels/email/config-store.mjs';
+import { EmailHarnessClient } from '../../../../src/channels/email/harness-client.mjs';
+import { EmailStateStore } from '../../../../src/channels/email/state-store.mjs';
+import { EmailController } from '../../../../src/channels/email/email-controller.mjs';
+import { EmailRuntime } from '../../../../src/channels/email/email-runtime.mjs';
+import {
+  createAccessPolicy,
+  createAccessPolicyScope,
+} from '../../../../src/channels/shared/access-policy.mjs';
+import { createTokenProductionController } from '../shared/production.mjs';
+
+/**
+ * Email has no group concept, and a mail address is trivially forgeable, so
+ * both scopes start as an allowlist seeded from the mailbox's configured
+ * senders instead of the open baseline other token channels use. With no
+ * senders configured the allowlist is empty, which denies everyone until the
+ * user adds one — the channel fails closed.
+ */
+function emailAccessPolicyFor(bot) {
+  const senders = Array.isArray(bot?.allowedSenders) ? bot.allowedSenders : [];
+  const scope = createAccessPolicyScope({
+    mode: 'allowlist',
+    open: { defaultCanExecuteCommands: false, commandPermissionOverrides: [] },
+    // Every policy user entry carries its command permission alongside the id.
+    allowlist: { users: senders.map((id) => ({ id, canExecuteCommands: true })) },
+  });
+  return createAccessPolicy({ direct: scope, group: scope });
+}
+
+/**
+ * Email is a token-shaped channel: one mailbox identity plus one secret. It
+ * reuses the shared token production assembly, which wires the workspace
+ * scope, access policy, delivery adapter, and connection supervisor.
+ */
+export function createProductionController(ctx, config = {}, internals = {}) {
+  return createTokenProductionController(ctx, config, internals, {
+    channel: 'email',
+    ConfigStore: EmailConfigStore,
+    StateStore: EmailStateStore,
+    HarnessClient: EmailHarnessClient,
+    Controller: EmailController,
+    Runtime: EmailRuntime,
+    runtimeOptions: (channelConfig) => ({
+      ...(channelConfig.pollIntervalMs === undefined
+        ? {} : { pollIntervalMs: channelConfig.pollIntervalMs }),
+    }),
+    initialAccessPolicyForBot: emailAccessPolicyFor,
+    // Declares that this channel keeps its allowlist in its own config and
+    // pushes the derived policy into the workspace store on change.
+    accessPolicyForBot: emailAccessPolicyFor,
+    // The mailbox settings page can pin the chat to an existing session.
+    supportsSessionBinding: true,
+    // The Agent mailbox rotates its refresh token on every refresh, so the new
+    // pair must be written back through the controller.
+    persistBotCredential: ({ botId, tokens, controller }) =>
+      controller?.persistTokens?.(botId, tokens) ?? Promise.resolve(false),
+  });
+}