@xmanrui/dsh-im 4.22.0 → 4.24.0

package/plugin-src/client/i18n.js

@@ -1,3 +1,5 @@
+import imageInput from '../../src/channels/shared/i18n-en/image-input.mjs';
+import diagnostics from '../../src/channels/shared/i18n-en/diagnostics.mjs';
 import weixinDiagnostics from '../../src/channels/weixin/connection-error.en.mjs';
 import * as React from 'react';
 
@@ -5,6 +7,8 @@ export const IM_LOCALE_NAMESPACE = 'dsh-im';
 
 const EN = Object.freeze({
   ...weixinDiagnostics,
+  ...diagnostics,
+  ...imageInput,
   '$locale': 'en',
   '修改别名': 'Edit alias',
   '关闭修改别名': 'Close alias editor',
@@ -258,11 +262,13 @@ const EN = Object.freeze({
   '查看分步直推说明': 'View step push help',
   '开启后逐步推送工具调用与过程说明': 'Push tool calls and process notes step by step',
   '任务过程展示': 'Task progress display',
-  '设置任务执行过程的呈现方式：不显示、实时卡片或逐步消息': 'Choose how the execution is presented: hidden, one live card, or step-by-step messages',
+  '设置任务执行过程的呈现方式：不显示、原生直播、实时卡片或逐步消息': 'Choose how execution is presented: hidden, native live process, one live card, or step-by-step messages',
   '不显示过程（只发送最终答案）': 'Hide the process (send the final answer only)',
+  '实时直播（飞书原生思考过程）': 'Live process (native Feishu thinking process)',
   '实时过程卡（全程一张卡片动态更新）': 'Live process card (one card updated throughout)',
   '逐步直播（每一步单独发一条消息）': 'Step-by-step feed (one message per step)',
   '适合日常问答：执行过程中不显示工具调用等中间步骤，只回复最终结果': 'For everyday Q&A: tool calls and other interim steps stay hidden, only the final result is replied',
+  '使用飞书原生思考过程展示推理、工具调用与结果，最终答案单独发送': 'Use Feishu’s native thinking process for reasoning, tool calls, and results, then send the final answer separately',
   '推荐长任务使用：过程与最终答案都在同一张卡片里实时更新，不刷屏': 'Recommended for long tasks: the process and the final answer update live in one card without flooding the chat',
   '每一步都单独发一条消息（含工具调用和过程说明）；注意长任务会连续发送较多消息': 'Every step is sent as its own message (including tool calls and notes); long tasks may send many messages in a row',
   '分步直推设置保存失败，请重试。': 'Could not save the step push setting. Try again.',
@@ -663,6 +669,11 @@ const EN = Object.freeze({
   '接入 Telegram 机器人': 'Connect a Telegram bot',
   '先通过 @BotFather 获取 Bot Token，再在这里完成接入。': 'Get a Bot Token from @BotFather, then connect it here.',
   '填写 @BotFather 生成的 Bot Token': 'Enter the Bot Token from @BotFather',
+  '会话行为': 'Conversation behavior',
+  '思考过程留痕': 'Thinking traces',
+  '实时显示思考步骤与工具调用，最终答案单独成条': 'Show thinking steps and tool calls as they happen; the final answer arrives as its own message',
+  '请提交有效的思考过程留痕设置。': 'Submit a valid thinking-traces setting.',
+  '正在使用{name}…': 'Using {name}…',
   '访问模式': 'Access mode',
   'Telegram 访问模式': 'Telegram access mode',
   '查看 Telegram 访问模式说明': 'View Telegram access mode details',
@@ -1005,6 +1016,63 @@ const EN = Object.freeze({
   '企业微信应用操作失败，请稍后重试': 'The WeCom app operation failed; try again later',
   '企业微信应用服务返回了无法识别的响应': 'The WeCom app service returned an unrecognized response',
   '企业微信应用服务没有返回有效的机器人列表': 'The WeCom app service did not return a valid bot list',
+  '邮箱': 'Email',
+  ' IMAP/SMTP 邮箱': ' IMAP/SMTP mailbox',
+  'QQ 邮箱': 'QQ Mail',
+  '163 邮箱': '163 Mail',
+  '自定义服务器': 'Custom servers',
+  '在 QQ 邮箱「设置 → 账户」中开启 IMAP/SMTP 服务，并生成 16 位授权码（不是登录密码）。': 'In QQ Mail open Settings → Account, enable IMAP/SMTP, and generate a 16-character authorization code (not your login password).',
+  '在 163 邮箱「设置 → POP3/SMTP/IMAP」中开启服务，并新增授权密码。': 'In 163 Mail open Settings → POP3/SMTP/IMAP, enable the service, and add an authorization password.',
+  '需要先开启两步验证，再生成「应用专用密码」。': 'Enable two-step verification first, then generate an app-specific password.',
+  '请填写邮箱服务商提供的 IMAP 与 SMTP 服务器地址及端口。': 'Enter the IMAP and SMTP host and port provided by your mail provider.',
+  '接入邮箱': 'Connect a mailbox',
+  'DeepSeek Harness 会读取该邮箱的新邮件作为指令，并在同一邮件线程内回复处理结果。': 'DeepSeek Harness reads new mail in this mailbox as instructions and replies with the result inside the same mail thread.',
+  '邮箱服务商': 'Mail provider',
+  '邮箱地址': 'Email address',
+  '应用密码 / 授权码': 'App password / authorization code',
+  'IMAP/SMTP 授权码': 'IMAP/SMTP authorization code',
+  '不是邮箱登录密码；请在邮箱设置中单独生成。': 'This is not your login password; generate it separately in your mailbox settings.',
+  'IMAP 服务器': 'IMAP server',
+  '端口': 'Port',
+  'SMTP 服务器': 'SMTP server',
+  '允许的发件人': 'Allowed senders',
+  'me@example.com\\n同事@example.com': 'me@example.com\\ncolleague@example.com',
+  '必填。只有这些地址发来的邮件会触发 Harness；多个地址用换行或逗号分隔。': 'Required. Only mail from these addresses triggers the Harness; separate multiple addresses with newlines or commas.',
+  '正在连接邮箱…': 'Connecting the mailbox…',
+  '连接邮箱': 'Connect mailbox',
+  '保存后会重新连接邮箱以使设置立即生效。': 'Saving reconnects the mailbox so the change takes effect immediately.',
+  '使用现有邮箱收发指令：邮件进来触发 Harness，处理结果以回信形式送达。': 'Use an existing mailbox to send instructions: incoming mail triggers the Harness and the result is delivered as a reply.',
+  '配置邮箱收发': 'Configure email send and receive',
+  '配置邮箱': 'Configure mailbox',
+  '邮箱配置': 'Mailbox configuration',
+  '会话绑定': 'Session binding',
+  '会话绑定已保存。': 'Session binding saved.',
+  '不绑定则每封新邮件开启一个新会话；绑定固定会话后，来信都在该会话内继续。': 'With no binding every new mail starts a new session; with a fixed session, incoming mail continues in that session.',
+  '固定会话（账号级）': 'Fixed session (account level)',
+  '不绑定（每封新邮件新建会话）': 'No binding (new session per mail)',
+  '按发件人覆盖（优先于账号级）': 'Per-sender override (takes priority)',
+  '跟随账号级': 'Follow the account setting',
+  '尚无可覆盖的发件人（先在上方配置允许的发件人）。': 'No senders to override yet (configure allowed senders above first).',
+  '保存绑定': 'Save binding',
+  '清除绑定': 'Clear binding',
+  '所有发件人同上': 'Point every sender at the same session',
+  '已选：': 'Selected: ',
+  '接入方式': 'Access method',
+  '生成授权链接': 'Generate authorization link',
+  '重新生成': 'Regenerate',
+  '授权链接': 'Authorization link',
+  '配对码': 'Pairing code',
+  '等待授权中…': 'Waiting for authorization…',
+  '等待授权中，': 'Waiting for authorization — valid for ',
+  ' 分钟': ' minutes',
+  '内有效，可保持本页打开。': '; you can keep this page open.',
+  '授权成功，正在接入邮箱…': 'Authorized; connecting the mailbox…',
+  '授权成功；请填写邮箱地址与允许的发件人后完成接入。': 'Authorized. Enter the mailbox address and at least one allowed sender to finish connecting.',
+  '授权后自动填入': 'Filled in after authorization',
+  '由授权结果自动填入，无需手工填写。': 'Filled in from the authorization; no need to type it.',
+  '刷新会话列表': 'Refresh the session list',
+  '腾讯 Agent 邮箱需要微信扫码授权。点下面的按钮生成授权链接，在打开的页面里用微信扫码登录并确认。': 'The Tencent Agent mailbox authorizes with a WeChat QR code. Generate an authorization link, then scan it with WeChat on the page that opens and confirm.',
+  '请求失败': 'The request failed',
 });
 
 export const en = EN;

package/plugin-src/client/index.js

@@ -14,6 +14,7 @@ import {
   WeixinLogoGlyph,
   WhatsappLogoGlyph,
   IMessageLogoGlyph,
+  EmailLogoGlyph,
 } from './channel-logos.js';
 import { DINGTALK_RPC_CHANNEL } from './channels/dingtalk/api.js';
 import { DingtalkSettingsTab } from './channels/dingtalk/index.js';
@@ -48,8 +49,11 @@ import { WHATSAPP_RPC_CHANNEL } from './channels/whatsapp/api.js';
 import { WhatsappSettingsTab } from './channels/whatsapp/index.js';
 import { installWhatsappStyles } from './channels/whatsapp/styles.js';
 import { IMESSAGE_RPC_CHANNEL } from './channels/imessage/api.js';
+import { EMAIL_RPC_CHANNEL } from './channels/email/api.js';
 import { IMessageSettingsTab } from './channels/imessage/index.js';
+import { EmailSettingsTab, useEmailChannelEnabled } from './channels/email/index.js';
 import { installIMessageStyles } from './channels/imessage/styles.js';
+import { installEmailStyles } from './channels/email/styles.js';
 import { en, h, IM_LOCALE_NAMESPACE, setImTranslator, zh } from './i18n.js';
 import {
   HOST_LANGUAGE_RPC_CHANNEL,
@@ -102,6 +106,7 @@ const CHANNELS = Object.freeze([
   { id: 'whatsapp', label: 'WhatsApp' },
   { id: 'wecomApp', label: '企业微信应用', note: '（实验功能）' },
   { id: 'imessage', label: 'iMessage', note: '（实验功能）' },
+  { id: 'email', label: '邮箱', note: '（实验功能）' },
   { id: 'office', label: 'AI Office', note: '（实验功能）' },
 ]);
 
@@ -157,6 +162,11 @@ function IMessageLogo() {
     h(IMessageLogoGlyph));
 }
 
+function EmailLogo() {
+  return h('span', { className: 'dim-logo dim-logoEmail', 'aria-hidden': 'true' },
+    h(EmailLogoGlyph));
+}
+
 function OfficeLogo() {
   return h('span', { className: 'dim-logo dim-logoOffice', 'aria-hidden': 'true' },
     h(OfficeLogoGlyph));
@@ -174,6 +184,7 @@ function ChannelLogo({ channel }) {
   if (channel === 'discord') return h(DiscordLogo);
   if (channel === 'whatsapp') return h(WhatsappLogo);
   if (channel === 'imessage') return h(IMessageLogo);
+  if (channel === 'email') return h(EmailLogo);
   return h(OfficeLogo);
 }
 
@@ -198,6 +209,7 @@ export function IMSettingsTab({
   discordRpcCall,
   feishuRpcCall,
   imessageRpcCall,
+  emailRpcCall,
   qqRpcCall,
   slackRpcCall,
   telegramRpcCall,
@@ -222,10 +234,18 @@ export function IMSettingsTab({
   const [loopbackRecovery, setLoopbackRecovery] = React.useState(null);
   const [runningVersion, setRunningVersion] = React.useState(IM_PLUGIN_VERSION);
   const [deliverySettings, setDeliverySettings] = React.useState(null);
+  // The Host owns email availability and reports it over RPC. The
+  // mailbox entry point is omitted entirely while it is closed, and the visible
+  // channel list is what every later lookup (active tab, rail) reads from.
+  const emailEnabled = useEmailChannelEnabled(emailRpcCall);
+  const visibleChannels = React.useMemo(
+    () => CHANNELS.filter((channel) => channel.id !== 'email' || emailEnabled),
+    [emailEnabled],
+  );
   const githubTooltipId = React.useId();
   const generalSettingsTooltipId = React.useId();
   const globalSettingsSelected = selected === GLOBAL_SETTINGS_TAB_ID;
-  const active = CHANNELS.find((channel) => channel.id === selected) ?? CHANNELS[0];
+  const active = visibleChannels.find((channel) => channel.id === selected) ?? visibleChannels[0];
   const activeTabId = globalSettingsSelected
     ? 'dim-general-settings-trigger'
     : `dim-tab-${active.id}`;
@@ -254,6 +274,7 @@ export function IMSettingsTab({
     deliveryRpcCall,
     globalSettingsRpcCall,
     imessageRpcCall,
+    emailRpcCall,
   }, {
     location: browserLocation,
     onRecovery: reportLoopbackRecovery,
@@ -265,6 +286,7 @@ export function IMSettingsTab({
     feishuRpcCall,
     globalSettingsRpcCall,
     imessageRpcCall,
+    emailRpcCall,
     officeRpcCall,
     qqRpcCall,
     reportLoopbackRecovery,
@@ -302,8 +324,16 @@ export function IMSettingsTab({
           'aria-label': 'dsh-im GitHub',
           'aria-describedby': githubTooltipId,
         },
-        h('span', null, 'GitHub'),
-        h('span', { className: 'dim-githubArrow', 'aria-hidden': 'true' }, '↗')),
+        h('svg', {
+          width: 18,
+          height: 18,
+          viewBox: '0 0 16 16',
+          fill: 'currentColor',
+          focusable: 'false',
+          'aria-hidden': 'true',
+        }, h('path', {
+          d: 'M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82a7.65 7.65 0 0 1 2-.27c.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0 0 16 8c0-4.42-3.58-8-8-8Z',
+        }))),
         h('span', {
           id: githubTooltipId,
           className: 'dim-githubTooltip',
@@ -331,7 +361,7 @@ export function IMSettingsTab({
     ),
     h('div', { className: 'dim-layout' },
       h('nav', { className: 'dim-rail', role: 'tablist', 'aria-label': 'IM 设置导航' },
-        CHANNELS.map((channel) => h('button', {
+        visibleChannels.map((channel) => h('button', {
           key: channel.id,
           type: 'button',
           role: 'tab',
@@ -395,6 +425,8 @@ export function IMSettingsTab({
                           ? h(WhatsappSettingsTab, { rpcCall: rpcCalls.whatsappRpcCall })
                           : active.id === 'imessage'
                             ? h(IMessageSettingsTab, { rpcCall: rpcCalls.imessageRpcCall })
+                          : active.id === 'email'
+                            ? h(EmailSettingsTab, { rpcCall: rpcCalls.emailRpcCall })
                           : h(OfficeSettingsTab, { rpcCall: rpcCalls.officeRpcCall }))),
     ),
   ));
@@ -433,6 +465,7 @@ export function apply(ctx) {
       installDiscordStyles(),
       installWhatsappStyles(),
       installIMessageStyles(),
+      installEmailStyles(),
       installOfficeStyles(),
       installImStyles(),
     ];
@@ -461,6 +494,8 @@ export function apply(ctx) {
     callManagementRpc(ctx.connection, WHATSAPP_RPC_CHANNEL, endpoint, payload, signal);
   const imessageRpcCall = (endpoint, payload, signal) =>
     callManagementRpc(ctx.connection, IMESSAGE_RPC_CHANNEL, endpoint, payload, signal);
+  const emailRpcCall = (endpoint, payload, signal) =>
+    callManagementRpc(ctx.connection, EMAIL_RPC_CHANNEL, endpoint, payload, signal);
   const slackRpcCall = (endpoint, payload, signal) =>
     callManagementRpc(ctx.connection, SLACK_RPC_CHANNEL, endpoint, payload, signal);
   const officeRpcCall = (endpoint, payload, signal) =>
@@ -490,6 +525,7 @@ export function apply(ctx) {
     whatsappRpcCall,
     imessageRpcCall,
     officeRpcCall,
+    emailRpcCall,
     updateRpcCall,
     deliveryRpcCall,
     globalSettingsRpcCall,

package/plugin-src/client/last-message-error.js

@@ -1,3 +1,4 @@
+import { diagnosticFields } from '../../src/channels/shared/diagnostic-details.mjs';
 function text(value, maxLength) {
   if (typeof value !== 'string') return null;
   const trimmed = value.trim();
@@ -12,6 +13,6 @@ export function normalizeLastMessageError(value) {
   const referenceId = text(value.referenceId, 40);
   const at = Number.isFinite(value.at) ? value.at : null;
   return code && reason && message && referenceId && at !== null
-    ? { code, reason, message, referenceId, at }
+    ? { code, reason, message, referenceId, at, ...(value.details ? diagnosticFields(value) : {}) }
     : null;
 }

package/plugin-src/client/styles.js

@@ -1,6 +1,12 @@
 export const IM_STYLE_ID = 'xmanrui-dsh-im-settings';
 
 const CSS = String.raw`
+.dim-connectionDiagnostic { min-width: 0; width: 100%; color: var(--dsw-alias-label-secondary, #646a73); overflow-wrap: anywhere; font-size: 13px; line-height: 1.6; }
+.dim-connectionDiagnostic[data-warning="true"] { color: var(--dsw-alias-state-warn-primary, #d97706); }
+.dim-connectionDiagnostic p { margin: 4px 0; }
+.dim-connectionDiagnostic button { border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 6px; padding: 6px 10px; color: inherit; background: var(--dsw-alias-bg-layer-1, #fff); font: inherit; cursor: pointer; }
+.dim-connectionDiagnostic button:focus-visible, .dim-connectionDiagnostic summary:focus-visible { outline: 2px solid var(--dsw-alias-state-business-primary, #3370ff); outline-offset: 2px; }
+
 .dim-aliasName { display: flex; align-items: center; gap: 4px; min-width: 0; }
 .dim-aliasName h3 { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .dim-aliasName h3:focus-visible { outline: 2px solid var(--dsw-alias-state-business-primary, #3370ff); outline-offset: 2px; border-radius: 3px; }
@@ -87,10 +93,10 @@ const CSS = String.raw`
 .dim-updateFooter .dim-updateButton:first-child { margin-right: auto; }
 .dim-updatePrimary, .dim-updatePrimary:hover:not(:disabled) { border-color: var(--dsw-alias-state-business-primary, #3370ff); color: #fff; background: var(--dsw-alias-state-business-primary, #3370ff); }
 .dim-githubAction { position: relative; display: inline-flex; flex: none; }
-.dim-githubLink { min-height: 30px; display: inline-flex; align-items: center; gap: 5px; flex: none; padding: 0 10px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 8px; color: var(--dsw-alias-label-secondary, #646a73); background: var(--dsw-alias-bg-layer-1, #fff); font-size: 12px; line-height: normal; font-weight: 560; text-decoration: none; transition: border-color .15s ease, color .15s ease, background .15s ease; }
+.dim-githubLink { width: 30px; height: 30px; display: grid; place-items: center; flex: none; padding: 0; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 8px; color: var(--dsw-alias-label-secondary, #646a73); background: var(--dsw-alias-bg-layer-1, #fff); text-decoration: none; transition: border-color .15s ease, color .15s ease, background .15s ease; }
+.dim-githubLink svg { display: block; }
 .dim-githubLink:hover { border-color: #aeb3bb; color: var(--dsw-alias-label-primary, #1f2329); background: var(--dsw-alias-interactive-bg-hover, #f7f8fa); }
 .dim-githubLink:focus-visible { outline: 2px solid color-mix(in srgb, var(--dim-blue) 70%, white); outline-offset: 2px; }
-.dim-githubArrow { font-size: 13px; line-height: 1; }
 .dim-githubTooltip { position: absolute; top: calc(100% + 8px); right: 0; z-index: 20; width: max-content; max-width: min(220px, 80vw); padding: 6px 9px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 7px; color: var(--dsw-alias-label-primary, #1f2329); background: var(--dsw-alias-bg-layer-3, #fff); box-shadow: 0 8px 24px rgb(31 35 41 / 14%); font-size: 11px; line-height: 16px; font-weight: 500; white-space: nowrap; opacity: 0; visibility: hidden; transform: translateY(-3px); pointer-events: none; transition: opacity .15s ease, transform .15s ease, visibility .15s ease; }
 .dim-githubAction:hover .dim-githubTooltip, .dim-githubAction:focus-within .dim-githubTooltip { opacity: 1; visibility: visible; transform: translateY(0); }
 .dim-generalSettingsAction { position: relative; display: inline-flex; flex: none; }

package/plugin-src/host/build.mjs

@@ -14,7 +14,11 @@ const externalRuntimePackages = [
   '@tencent-connect/qqbot-nodejs',
   '@wecom/aibot-node-sdk',
   'dingtalk-stream',
+  'imapflow',
+  'mailparser',
+  'nodemailer',
   'qrcode',
+  'sharp',
   'undici',
 ];
 const external = externalRuntimePackages.flatMap((name) => [name, `${name}/*`]);

package/plugin-src/host/channels/dingtalk/production.mjs

@@ -1,3 +1,4 @@
+import { getImageInputSettingsStore } from '../../../../src/channels/shared/image-input-settings-store.mjs';
 import { unlink } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
@@ -113,6 +114,7 @@ export async function createProductionController(ctx, config = {}, internals = {
     ...(controlExecutor ? { controlExecutor } : {}),
     ...(sessionMaintenanceExecutor ? { sessionMaintenanceExecutor } : {}),
     ...(fileIngressExecutor ? { fileIngressExecutor } : {}),
+    imageInputPolicy: () => getImageInputSettingsStore(config).get(),
   });
   const modelCatalog = () => listModelCatalog(harness);
   const coreController = new Controller({

package/plugin-src/host/channels/dingtalk/rpc.mjs

@@ -1,3 +1,5 @@
+import { diagnosticFields } from '../../../../src/channels/shared/diagnostic-details.mjs';
+import { createConnectionDiagnostics, diagnosticRpcResult } from '../../../../src/channels/shared/connection-error.mjs';
 import { SET_ALIAS_ENDPOINT, validAliasPayload } from '../shared/bot-alias-rpc.mjs';
 import { registerManagementRpc } from '../../../management-rpc.mjs';
 import QRCode from 'qrcode';
@@ -169,7 +171,7 @@ function publicConnectionFailure(error) {
       ? source.referenceId
       : null;
   return code && message && hint && referenceId
-    ? { code, message, hint, referenceId }
+    ? { code, message, hint, referenceId, ...diagnosticFields(source) }
     : null;
 }
 
@@ -227,6 +229,7 @@ function assertController(controller) {
 }
 
 export function createDingtalkRpcHandler(controller, { encodeQr = qrDataUrl } = {}) {
+  const diagnostics = controller.diagnostics ?? createConnectionDiagnostics({ channel: 'dingtalk' });
   assertController(controller);
   const qrCache = new Map();
   const cachedEncode = (url) => {
@@ -283,7 +286,7 @@ export function createDingtalkRpcHandler(controller, { encodeQr = qrDataUrl } =
               await controller.sendConnectionTest(payload.botId);
               testMessage = publicConnectionTestResult();
             } catch (error) {
-              testMessage = publicConnectionTestResult(error);
+              testMessage = publicConnectionTestResult(error, { diagnostics, botId: payload.botId });
             }
           }
         }
@@ -338,11 +341,11 @@ export function createDingtalkRpcHandler(controller, { encodeQr = qrDataUrl } =
     } catch (error) {
       const workspaceError = publicWorkspaceError(error);
       const connectionError = publicConnectionFailure(error);
-      return signal?.aborted ? cancelled() : workspaceError
+      return diagnosticRpcResult(diagnostics, error, signal?.aborted ? cancelled() : workspaceError
         ? { ok: false, error: workspaceError }
         : connectionError
           ? { ok: false, error: connectionError }
-        : internalFailure();
+        : internalFailure(), { operation: endpoint, botId: payload?.botId });
     }
   };
 }

package/plugin-src/host/channels/email/availability.mjs

@@ -0,0 +1,60 @@
+/**
+ * The single switch that opens or closes the email channel.
+ *
+ * Email is enabled by default. A deployment can opt out with
+ * `EMAIL_CHANNEL_ENABLED=0` or `emailChannelEnabled: false` in the channel config.
+ * Setting either option to true enables the entry point, runtime and config
+ * restore again without a code change.
+ *
+ * Closing is deliberately non-destructive: it never deletes a mailbox config or
+ * a credential. It only refuses to expose the entry point and to start the
+ * runtime, so every existing mailbox is still there when the switch reopens.
+ */
+
+/** Environment variable that controls the email channel. */
+export const EMAIL_CHANNEL_ENABLED_ENV = 'EMAIL_CHANNEL_ENABLED';
+
+const TRUTHY = new Set(['1', 'true', 'yes', 'on']);
+const FALSY = new Set(['0', 'false', 'no', 'off', '']);
+
+function readBoolean(value) {
+  if (typeof value === 'boolean') return value;
+  if (typeof value === 'string') {
+    const normalized = value.trim().toLowerCase();
+    if (TRUTHY.has(normalized)) return true;
+    if (FALSY.has(normalized)) return false;
+  }
+  return null;
+}
+
+/**
+ * Decide whether the email channel is open.
+ *
+ * An explicit config value wins over the environment so a deployment can pin
+ * the channel without changing its environment; an unreadable value falls back
+ * to the environment, and an absent one keeps the channel enabled.
+ */
+export function isEmailChannelEnabled(config = {}, env = process.env) {
+  return readBoolean(config.emailChannelEnabled)
+    ?? readBoolean(env?.[EMAIL_CHANNEL_ENABLED_ENV])
+    ?? true;
+}
+
+/**
+ * The single host-side gate.
+ *
+ * Returns `null` when email is open, or a public "not available" result when it
+ * is closed. Both the management RPC and the production startup consult this so
+ * a closed channel can neither be configured nor connected.
+ */
+export function emailChannelGate(config = {}, env = process.env) {
+  if (isEmailChannelEnabled(config, env)) return null;
+  return Object.freeze({
+    ok: false,
+    error: Object.freeze({
+      code: 'email-channel-disabled',
+      message: 'Email is not available yet.',
+      details: Object.freeze({}),
+    }),
+  });
+}

package/plugin-src/host/channels/email/index.mjs

@@ -0,0 +1,36 @@
+import { createProductionController } from './production.mjs';
+import { createEmailRpcHandler, installEmailRpc, EMAIL_RPC_CHANNEL } from './rpc.mjs';
+import { installProductionChannel } from '../shared/startup.mjs';
+import { emailChannelGate } from './availability.mjs';
+
+export const name = 'dsh-im-email-host';
+export const inject = ['connection', 'credentials', 'typertGateway'];
+
+/**
+ * Cordis/DSH Host plugin entry. The management RPC is mounted before the
+ * fallible production initialization so the channel's settings page stays
+ * reachable (and can report why the mailbox failed) even when startup throws.
+ * Tests and embedded distributions may inject a controller through config.
+ *
+ * While `EMAIL_CHANNEL_ENABLED` is off this mounts the management RPC only and
+ * returns: no mailbox runtime is started and no configured mailbox is restored,
+ * so a machine that already holds mailboxes sends no network request for them.
+ * Nothing is deleted — reopening the switch restores every mailbox untouched.
+ */
+export async function apply(ctx, config = {}) {
+  if (config?.controller) {
+    return installEmailRpc(ctx, config.controller, config.rpcAuthority);
+  }
+  const closed = emailChannelGate(config);
+  if (closed) return installEmailRpc(ctx, { disabled: () => closed }, config.rpcAuthority);
+  return installProductionChannel(ctx, config, {
+    channel: 'email',
+    rpcChannel: EMAIL_RPC_CHANNEL,
+    createProduction: () => createProductionController(ctx, config, config.internals ?? {}),
+    createHandler: controller => createEmailRpcHandler(controller),
+  });
+}
+
+export { createProductionController } from './production.mjs';
+export { EMAIL_ENDPOINTS, EMAIL_RPC_CHANNEL, EMAIL_RPC_ENDPOINTS,
+  createEmailRpcHandler, installEmailRpc } from './rpc.mjs';

package/plugin-src/host/channels/email/production.mjs

@@ -0,0 +1,58 @@
+import { EmailConfigStore } from '../../../../src/channels/email/config-store.mjs';
+import { EmailHarnessClient } from '../../../../src/channels/email/harness-client.mjs';
+import { EmailStateStore } from '../../../../src/channels/email/state-store.mjs';
+import { EmailController } from '../../../../src/channels/email/email-controller.mjs';
+import { EmailRuntime } from '../../../../src/channels/email/email-runtime.mjs';
+import {
+  createAccessPolicy,
+  createAccessPolicyScope,
+} from '../../../../src/channels/shared/access-policy.mjs';
+import { createTokenProductionController } from '../shared/production.mjs';
+
+/**
+ * Email has no group concept, and a mail address is trivially forgeable, so
+ * both scopes start as an allowlist seeded from the mailbox's configured
+ * senders instead of the open baseline other token channels use. With no
+ * senders configured the allowlist is empty, which denies everyone until the
+ * user adds one — the channel fails closed.
+ */
+function emailAccessPolicyFor(bot) {
+  const senders = Array.isArray(bot?.allowedSenders) ? bot.allowedSenders : [];
+  const scope = createAccessPolicyScope({
+    mode: 'allowlist',
+    open: { defaultCanExecuteCommands: false, commandPermissionOverrides: [] },
+    // Every policy user entry carries its command permission alongside the id.
+    allowlist: { users: senders.map((id) => ({ id, canExecuteCommands: true })) },
+  });
+  return createAccessPolicy({ direct: scope, group: scope });
+}
+
+/**
+ * Email is a token-shaped channel: one mailbox identity plus one secret. It
+ * reuses the shared token production assembly, which wires the workspace
+ * scope, access policy, delivery adapter, and connection supervisor.
+ */
+export function createProductionController(ctx, config = {}, internals = {}) {
+  return createTokenProductionController(ctx, config, internals, {
+    channel: 'email',
+    ConfigStore: EmailConfigStore,
+    StateStore: EmailStateStore,
+    HarnessClient: EmailHarnessClient,
+    Controller: EmailController,
+    Runtime: EmailRuntime,
+    runtimeOptions: (channelConfig) => ({
+      ...(channelConfig.pollIntervalMs === undefined
+        ? {} : { pollIntervalMs: channelConfig.pollIntervalMs }),
+    }),
+    initialAccessPolicyForBot: emailAccessPolicyFor,
+    // Declares that this channel keeps its allowlist in its own config and
+    // pushes the derived policy into the workspace store on change.
+    accessPolicyForBot: emailAccessPolicyFor,
+    // The mailbox settings page can pin the chat to an existing session.
+    supportsSessionBinding: true,
+    // The Agent mailbox rotates its refresh token on every refresh, so the new
+    // pair must be written back through the controller.
+    persistBotCredential: ({ botId, tokens, controller }) =>
+      controller?.persistTokens?.(botId, tokens) ?? Promise.resolve(false),
+  });
+}