dsh-email 0.10.5 → 0.10.6

package/README.en.md

@@ -37,6 +37,7 @@ Example:
 
 ### Changelog
 
+- **0.10.6 (2026-09-10)**: fix an empty authorization-code field shadowing `DSH_EMAIL_PASSWORD` in single-account connection tests and saved settings. Explicit passwords still take precedence; named accounts cannot borrow this environment variable. Refresh the settings tool count, multi-account guidance and real QQ mailbox validation notes.
 - **0.10.5 (2026-09-08)**: document installation, tool registration and the Web settings endpoint in official Harness 0.1.3-alpha.2; update Node requirements and clarify that `email_health` checks configuration only. Runtime code is unchanged from 0.10.4.
 - **0.10.4 (2026-09-07)**: raise the minimum `mailparser` version to `3.9.22` and update the lockfile to use the patched `html-to-text 10.0.1 → deepmerge-ts 8.0.2` dependency chain for [CVE-2026-40345](https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx). This does not rely on root-only `pnpm.overrides`, which cannot fix consumers installing this plugin as a dependency. Add runtime dependency-chain and HTML-message parsing regression tests. An affected dependency is not proof that mail input can trigger this vulnerability.
 - **0.9.0**: new `email_watch` incremental new-mail tool (cursor-based, ideal for scheduled notifications); new "whale-girl courier" new-mail popup in the web UI (local skin artwork read at runtime + built-in fallback).
@@ -47,7 +48,7 @@ Example:
 
 ## Compatibility
 
-On 2026-09-08, the npm release was installed with `dsh plugin --profile web add` into the locally installed official `@deepseek-ai/dsh@0.1.3-alpha.2`, running Node `24.16.0`. Validation covered profile composition, all 10 tool registrations, configuration health, settings-service registration and the Web settings endpoint (200). No real mailbox was configured; this does not claim actual send/receive verification.
+Validated with `dsh plugin --profile web add` in the locally installed official `@deepseek-ai/dsh@0.1.3-alpha.2`, running Node `24.16.0`: profile composition, all 10 tool registrations, configuration health, settings-service registration and the Web settings endpoint. On 2026-09-09, the npm `0.10.5` package passed real QQ mailbox folder, list, read and search calls inside Harness. Reading preserved message flags, and a separate SMTP authentication check passed. No mail was sent, modified or deleted; delivery, replies and mailbox writes have not been verified live.
 
 Follows the official [plugin packaging and installation requirements](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md): an ESM entry point, prebuilt `lib/`, `dsh.bundle.patch` and a `cordis.patch.yml` layer. The plugin explicitly injects its required services and supplies JSON Schema parameters, canonical output and rendering, with no runtime imports of `@deepseek-ai/*` internals. Use Node 22.19 or later within 22.x, or Node 24 or later. Harness is evolving rapidly; the version above is the tested baseline.
 
@@ -66,7 +67,7 @@ After installing, restart `dsh web`. The plugin ships with an empty config and *
 1. **Web settings (recommended)**: after restart, open **Settings → Mail (dsh-email)**, fill in the email address and authorization code, and click "Save & Apply"; a "Test connection" button is also provided. Zero YAML, zero restart.
 2. **YAML**: hand-write the cordis.patch.yml template below; the settings page's "Multiple accounts (advanced, YAML)" textbox can also hold the account map (overriding `accounts` in YAML).
 
-Values saved in the settings page live in the `dsh-email` namespace of `settings.yaml` and override the YAML default-account config; password fields are marked secret (they never appear in exports or diagnostics).
+Values saved in the settings page live in the `dsh-email` namespace of `settings.yaml` and override the YAML default-account config. Authorization-code fields are marked secret, but saving a filled field still writes its value to the local settings file. For a single account, set `DSH_EMAIL_PASSWORD` and leave the authorization-code field empty to avoid saving it; the environment value is not copied into settings.
 
 ## Uninstall
 

package/README.md

@@ -45,6 +45,7 @@ IMAP/SMTP email tools for DeepSeek Harness, with replies, forwarding, mailbox or
 
 ### 版本记录
 
+- **0.10.6（2026-09-10）**：修复单账号设置页授权码留空时，空字符串遮蔽 `DSH_EMAIL_PASSWORD`，导致“测试连接”和保存后工具调用报未配置的问题；显式密码仍优先，多账号不会借用该环境变量。更新设置页工具数量、多账号说明，并补充真实 QQ 邮箱验证结果。
 - **0.10.5（2026-09-08）**：补充官方 Harness 0.1.3-alpha.2 的安装、工具注册及 Web 设置接口验证，更新 Node 版本要求，明确 `email_health` 只检查配置；运行时代码与 0.10.4 相同。
 - **0.10.4（2026-09-07）**：将 `mailparser` 最低版本提升到 `3.9.22` 并更新锁文件，使用 `html-to-text 10.0.1 → deepmerge-ts 8.0.2` 的修复链处理 [CVE-2026-40345](https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx)。不依赖插件作为下游依赖安装时不生效的根级 `pnpm.overrides`；新增真实依赖链与 HTML 邮件解析回归测试。依赖告警不等于已证实邮件输入可触发该漏洞。
 - **0.10.1**：补发制品——已发布的 0.10.0 打包时只含 `email_mark`，本版同时包含 `email_mark` 与 `email_reply`，代码与 0.10.0 的 main 一致。
@@ -58,7 +59,7 @@ IMAP/SMTP email tools for DeepSeek Harness, with replies, forwarding, mailbox or
 
 ## 兼容性
 
-2026-09-08 已在本机安装的官方 `@deepseek-ai/dsh@0.1.3-alpha.2`、Node `24.16.0` 中，通过 `dsh plugin --profile web add` 安装 npm 发布包，验证组合配置、10 个工具注册、配置自检、设置服务注册与 Web 设置接口（200）。本次没有配置真实邮箱，不代表已验证实际收发。
+已在本机安装的官方 `@deepseek-ai/dsh@0.1.3-alpha.2`、Node `24.16.0` 中，通过 `dsh plugin --profile web add` 验证组合配置、10 个工具注册、配置自检、设置服务注册与 Web 设置接口。2026-09-09 使用 npm `0.10.5` 包完成真实 QQ 邮箱实测：Harness 内目录、列表、读取和搜索调用通过，读取未改变邮件标记；独立 SMTP 登录认证通过。测试未发送、修改或删除邮件，因此不代表实际投递、回复和写入操作已验证。
 
 遵循官方[插件打包与安装要求](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md)：ESM 入口、预构建 `lib/`、`dsh.bundle.patch` 和 `cordis.patch.yml` 配置层；显式注入所需服务，提供 JSON Schema 参数、规范化输出和渲染函数，运行时不 import `@deepseek-ai/*` 内部模块。使用 Node 22.19 及以上的 22.x 或 Node 24 及以上版本；Harness 仍在快速迭代，上述版本是实测基线。
 
@@ -77,7 +78,7 @@ dsh plugin --profile web add dsh-email
 1. **网页设置（推荐）**：重启后打开 **设置 → 邮件 (dsh-email)**，表单里填邮箱地址和授权码，点「保存并应用」，还带「测试连接」按钮。零 YAML、零重启。
 2. **YAML**：按下面的 cordis.patch.yml 模板手写；设置页的「多账号（高级，YAML）」文本框也能填账号映射（覆盖 YAML 里的 accounts）。
 
-设置页保存的值存在 `settings.yaml` 的 `dsh-email` 命名空间里，覆盖 YAML 的默认账号配置；密码字段标记为 secret（不会出现在任何导出/诊断里）。
+设置页保存的值存在 `settings.yaml` 的 `dsh-email` 命名空间里，覆盖 YAML 的默认账号配置。授权码字段标记为 secret，但填写后保存仍会写入本机配置文件。单账号如需避免保存授权码，可设置 `DSH_EMAIL_PASSWORD` 并将授权码栏留空；环境变量不会被复制进设置文件。
 
 ## 卸载
 

package/lib/client.js

@@ -197,7 +197,7 @@ function EmailSettingsSection() {
     h("header", { className: "dshe-header" }, [
       h("span", { className: "dshe-kicker" }, "dsh-email · IMAP/SMTP"),
       h("h2", null, "邮件"),
-      h("p", null, "在这里填写邮箱账号，六个 email_* 工具立即生效，无需手写 YAML。密码字段标记为 secret，不会出现在任何导出里。"),
+      h("p", null, "在这里配置邮箱账号，即可使用 10 个 email_* 工具。支持表单和多账号 YAML，保存后立即生效。"),
     ]),
     h("section", { className: "dshe-panel" }, [
       h("div", { className: "dshe-grid" }, [
@@ -302,7 +302,7 @@ function EmailSettingsSection() {
       ? h("div", { className: testResult.ok ? "dshe-alert success" : "dshe-alert error" }, testResult.text)
       : null,
     accounts.length > 0
-      ? h("div", { className: "dshe-hint" }, "当前生效账号：" + accounts.join("、") + "（多账号 accounts 映射仍走 cordis.patch.yml）")
+      ? h("div", { className: "dshe-hint" }, "当前生效账号：" + accounts.join("、"))
       : null,
   ]);
 }
@@ -429,4 +429,4 @@ exports.apply = apply;
 exports.inject = inject;
 
 return module.exports;
-}});
+}});

package/lib/config.js

@@ -113,7 +113,9 @@ function resolveAccount(name, common, acc, allowEnvPassword) {
         throw new Error(`dsh-email：账号 "${name}" 的 provider "${acc.provider ?? common.provider}" 未知，可选：${PROVIDER_NAMES.join('/')}；或省略 provider 直接填 imap.host 与 smtp.host`);
     }
     const user = (acc.user ?? common.user ?? '').trim();
-    const password = acc.password ?? common.password ?? (allowEnvPassword ? process.env[EMAIL_PASSWORD_ENV] ?? '' : '');
+    // The settings form uses '' for an empty password. In single-account mode
+    // that explicitly selects the environment fallback; named accounts stay isolated.
+    const password = (acc.password ?? common.password) || (allowEnvPassword ? process.env[EMAIL_PASSWORD_ENV] ?? '' : '');
     const imap = {
         host: acc.imap?.host ?? common.imap?.host ?? preset?.imap.host,
         port: acc.imap?.port ?? common.imap?.port ?? preset?.imap.port,

package/lib/settings.d.ts

@@ -4,8 +4,8 @@ import { type EmailConfig } from './config.js';
 export declare const SETTINGS_NAMESPACE = "dsh-email";
 /**
  * The settings-page shape: the single default account plus shared policy.
- * Multi-account (`accounts` map) stays YAML-only; the page edits the
- * default/shorthand account.
+ * The form edits the default/shorthand account; its advanced YAML area
+ * edits named accounts through accountsYaml.
  */
 export declare const EmailSettingsSchema: z<Schemastery.ObjectS<{
     provider: z<string, string>;

package/lib/settings.js

@@ -4,8 +4,8 @@ import { PROVIDER_NAMES } from './config.js';
 export const SETTINGS_NAMESPACE = 'dsh-email';
 /**
  * The settings-page shape: the single default account plus shared policy.
- * Multi-account (`accounts` map) stays YAML-only; the page edits the
- * default/shorthand account.
+ * The form edits the default/shorthand account; its advanced YAML area
+ * edits named accounts through accountsYaml.
  */
 export const EmailSettingsSchema = z.object({
     provider: z.string().default(''),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-email",
-  "version": "0.10.5",
+  "version": "0.10.6",
   "description": "DeepSeek Harness 邮件插件：IMAP/SMTP 收发、搜索、回复转发、邮件整理与增量收件，支持多邮箱预设、发信审批及 Web 设置与新邮件通知。",
   "type": "module",
   "main": "lib/index.js",