dsh-email 0.10.5 → 0.10.7

package/README.en.md

@@ -37,6 +37,8 @@ Example:
 
 ### Changelog
 
+- **0.10.7 (2026-09-11)**: revalidate official Harness 0.1.5-rc.1 and refresh suite co-load and live-service evidence; runtime code is unchanged.
+- **0.10.6 (2026-09-10)**: fix an empty authorization-code field shadowing `DSH_EMAIL_PASSWORD` in single-account connection tests and saved settings. Explicit passwords still take precedence; named accounts cannot borrow this environment variable. Refresh the settings tool count, multi-account guidance and real QQ mailbox validation notes.
 - **0.10.5 (2026-09-08)**: document installation, tool registration and the Web settings endpoint in official Harness 0.1.3-alpha.2; update Node requirements and clarify that `email_health` checks configuration only. Runtime code is unchanged from 0.10.4.
 - **0.10.4 (2026-09-07)**: raise the minimum `mailparser` version to `3.9.22` and update the lockfile to use the patched `html-to-text 10.0.1 → deepmerge-ts 8.0.2` dependency chain for [CVE-2026-40345](https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx). This does not rely on root-only `pnpm.overrides`, which cannot fix consumers installing this plugin as a dependency. Add runtime dependency-chain and HTML-message parsing regression tests. An affected dependency is not proof that mail input can trigger this vulnerability.
 - **0.9.0**: new `email_watch` incremental new-mail tool (cursor-based, ideal for scheduled notifications); new "whale-girl courier" new-mail popup in the web UI (local skin artwork read at runtime + built-in fallback).
@@ -47,7 +49,9 @@ Example:
 
 ## Compatibility
 
-On 2026-09-08, the npm release was installed with `dsh plugin --profile web add` into the locally installed official `@deepseek-ai/dsh@0.1.3-alpha.2`, running Node `24.16.0`. Validation covered profile composition, all 10 tool registrations, configuration health, settings-service registration and the Web settings endpoint (200). No real mailbox was configured; this does not claim actual send/receive verification.
+Verified with official `@deepseek-ai/dsh@0.1.5-rc.1` and Node `24.16.0` on 2026-09-11: all 18 components load alongside Modlens, with passing tool-schema, skill-registration and offline read-only invocation checks. Uses the `cordis.patch.yml` + `dsh.bundle.patch` bundle model. Node requirements match this Harness release: 22.19 or later within 22.x, or 24 or later. Live external-service workflows require separate configuration and validation.
+
+On 2026-09-10, npm `dsh-email@0.10.6` passed registration of all 10 tools, real QQ mailbox folder/list/read/search calls, and the settings page's connection test and Save & Apply in this Harness release. An empty authorization-code field correctly uses `DSH_EMAIL_PASSWORD`. Separate SMTP authentication also passed. No mail was sent, modified or deleted. This patch does not change runtime code.
 
 Follows the official [plugin packaging and installation requirements](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md): an ESM entry point, prebuilt `lib/`, `dsh.bundle.patch` and a `cordis.patch.yml` layer. The plugin explicitly injects its required services and supplies JSON Schema parameters, canonical output and rendering, with no runtime imports of `@deepseek-ai/*` internals. Use Node 22.19 or later within 22.x, or Node 24 or later. Harness is evolving rapidly; the version above is the tested baseline.
 
@@ -66,7 +70,7 @@ After installing, restart `dsh web`. The plugin ships with an empty config and *
 1. **Web settings (recommended)**: after restart, open **Settings → Mail (dsh-email)**, fill in the email address and authorization code, and click "Save & Apply"; a "Test connection" button is also provided. Zero YAML, zero restart.
 2. **YAML**: hand-write the cordis.patch.yml template below; the settings page's "Multiple accounts (advanced, YAML)" textbox can also hold the account map (overriding `accounts` in YAML).
 
-Values saved in the settings page live in the `dsh-email` namespace of `settings.yaml` and override the YAML default-account config; password fields are marked secret (they never appear in exports or diagnostics).
+Values saved in the settings page live in the `dsh-email` namespace of `settings.yaml` and override the YAML default-account config. Authorization-code fields are marked secret, but saving a filled field still writes its value to the local settings file. For a single account, set `DSH_EMAIL_PASSWORD` and leave the authorization-code field empty to avoid saving it; the environment value is not copied into settings.
 
 ## Uninstall
 

package/README.md

@@ -45,6 +45,8 @@ IMAP/SMTP email tools for DeepSeek Harness, with replies, forwarding, mailbox or
 
 ### 版本记录
 
+- **0.10.7（2026-09-11）**：复验官方 Harness 0.1.5-rc.1，更新整套同载与真实服务验证记录；运行时代码未变。
+- **0.10.6（2026-09-10）**：修复单账号设置页授权码留空时，空字符串遮蔽 `DSH_EMAIL_PASSWORD`，导致“测试连接”和保存后工具调用报未配置的问题；显式密码仍优先，多账号不会借用该环境变量。更新设置页工具数量、多账号说明，并补充真实 QQ 邮箱验证结果。
 - **0.10.5（2026-09-08）**：补充官方 Harness 0.1.3-alpha.2 的安装、工具注册及 Web 设置接口验证，更新 Node 版本要求，明确 `email_health` 只检查配置；运行时代码与 0.10.4 相同。
 - **0.10.4（2026-09-07）**：将 `mailparser` 最低版本提升到 `3.9.22` 并更新锁文件，使用 `html-to-text 10.0.1 → deepmerge-ts 8.0.2` 的修复链处理 [CVE-2026-40345](https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx)。不依赖插件作为下游依赖安装时不生效的根级 `pnpm.overrides`；新增真实依赖链与 HTML 邮件解析回归测试。依赖告警不等于已证实邮件输入可触发该漏洞。
 - **0.10.1**：补发制品——已发布的 0.10.0 打包时只含 `email_mark`，本版同时包含 `email_mark` 与 `email_reply`，代码与 0.10.0 的 main 一致。
@@ -58,7 +60,9 @@ IMAP/SMTP email tools for DeepSeek Harness, with replies, forwarding, mailbox or
 
 ## 兼容性
 
-2026-09-08 已在本机安装的官方 `@deepseek-ai/dsh@0.1.3-alpha.2`、Node `24.16.0` 中，通过 `dsh plugin --profile web add` 安装 npm 发布包，验证组合配置、10 个工具注册、配置自检、设置服务注册与 Web 设置接口（200）。本次没有配置真实邮箱，不代表已验证实际收发。
+已在官方 `@deepseek-ai/dsh@0.1.5-rc.1`、Node `24.16.0` 上验证（2026-09-11）：18 个组件与 Modlens 同载，工具 schema、技能注册及离线只读调用检查通过。采用 `cordis.patch.yml` + `dsh.bundle.patch` 组合包模型。Node 要求与该版本 Harness 一致：22.19 及以上的 22.x，或 24 及以上。外部服务的实际业务操作需按各组件配置单独验证。
+
+2026-09-10，npm `dsh-email@0.10.6` 在该 Harness 中通过 10 个工具注册，真实 QQ 邮箱目录、列表、读取和搜索，以及设置页“测试连接”“保存并应用”检查；授权码留空时能继续使用 `DSH_EMAIL_PASSWORD`。独立 SMTP 登录认证也已通过。未发送、修改或删除邮件；本次补丁不修改运行时代码。
 
 遵循官方[插件打包与安装要求](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md)：ESM 入口、预构建 `lib/`、`dsh.bundle.patch` 和 `cordis.patch.yml` 配置层；显式注入所需服务，提供 JSON Schema 参数、规范化输出和渲染函数，运行时不 import `@deepseek-ai/*` 内部模块。使用 Node 22.19 及以上的 22.x 或 Node 24 及以上版本；Harness 仍在快速迭代，上述版本是实测基线。
 
@@ -77,7 +81,7 @@ dsh plugin --profile web add dsh-email
 1. **网页设置（推荐）**：重启后打开 **设置 → 邮件 (dsh-email)**，表单里填邮箱地址和授权码，点「保存并应用」，还带「测试连接」按钮。零 YAML、零重启。
 2. **YAML**：按下面的 cordis.patch.yml 模板手写；设置页的「多账号（高级，YAML）」文本框也能填账号映射（覆盖 YAML 里的 accounts）。
 
-设置页保存的值存在 `settings.yaml` 的 `dsh-email` 命名空间里，覆盖 YAML 的默认账号配置；密码字段标记为 secret（不会出现在任何导出/诊断里）。
+设置页保存的值存在 `settings.yaml` 的 `dsh-email` 命名空间里，覆盖 YAML 的默认账号配置。授权码字段标记为 secret，但填写后保存仍会写入本机配置文件。单账号如需避免保存授权码，可设置 `DSH_EMAIL_PASSWORD` 并将授权码栏留空；环境变量不会被复制进设置文件。
 
 ## 卸载
 

package/lib/client.js

@@ -197,7 +197,7 @@ function EmailSettingsSection() {
     h("header", { className: "dshe-header" }, [
       h("span", { className: "dshe-kicker" }, "dsh-email · IMAP/SMTP"),
       h("h2", null, "邮件"),
-      h("p", null, "在这里填写邮箱账号，六个 email_* 工具立即生效，无需手写 YAML。密码字段标记为 secret，不会出现在任何导出里。"),
+      h("p", null, "在这里配置邮箱账号，即可使用 10 个 email_* 工具。支持表单和多账号 YAML，保存后立即生效。"),
     ]),
     h("section", { className: "dshe-panel" }, [
       h("div", { className: "dshe-grid" }, [
@@ -302,7 +302,7 @@ function EmailSettingsSection() {
       ? h("div", { className: testResult.ok ? "dshe-alert success" : "dshe-alert error" }, testResult.text)
       : null,
     accounts.length > 0
-      ? h("div", { className: "dshe-hint" }, "当前生效账号：" + accounts.join("、") + "（多账号 accounts 映射仍走 cordis.patch.yml）")
+      ? h("div", { className: "dshe-hint" }, "当前生效账号：" + accounts.join("、"))
       : null,
   ]);
 }
@@ -429,4 +429,4 @@ exports.apply = apply;
 exports.inject = inject;
 
 return module.exports;
-}});
+}});

package/lib/config.js

@@ -113,7 +113,9 @@ function resolveAccount(name, common, acc, allowEnvPassword) {
         throw new Error(`dsh-email：账号 "${name}" 的 provider "${acc.provider ?? common.provider}" 未知，可选：${PROVIDER_NAMES.join('/')}；或省略 provider 直接填 imap.host 与 smtp.host`);
     }
     const user = (acc.user ?? common.user ?? '').trim();
-    const password = acc.password ?? common.password ?? (allowEnvPassword ? process.env[EMAIL_PASSWORD_ENV] ?? '' : '');
+    // The settings form uses '' for an empty password. In single-account mode
+    // that explicitly selects the environment fallback; named accounts stay isolated.
+    const password = (acc.password ?? common.password) || (allowEnvPassword ? process.env[EMAIL_PASSWORD_ENV] ?? '' : '');
     const imap = {
         host: acc.imap?.host ?? common.imap?.host ?? preset?.imap.host,
         port: acc.imap?.port ?? common.imap?.port ?? preset?.imap.port,

package/lib/settings.d.ts

@@ -4,8 +4,8 @@ import { type EmailConfig } from './config.js';
 export declare const SETTINGS_NAMESPACE = "dsh-email";
 /**
  * The settings-page shape: the single default account plus shared policy.
- * Multi-account (`accounts` map) stays YAML-only; the page edits the
- * default/shorthand account.
+ * The form edits the default/shorthand account; its advanced YAML area
+ * edits named accounts through accountsYaml.
  */
 export declare const EmailSettingsSchema: z<Schemastery.ObjectS<{
     provider: z<string, string>;

package/lib/settings.js

@@ -4,8 +4,8 @@ import { PROVIDER_NAMES } from './config.js';
 export const SETTINGS_NAMESPACE = 'dsh-email';
 /**
  * The settings-page shape: the single default account plus shared policy.
- * Multi-account (`accounts` map) stays YAML-only; the page edits the
- * default/shorthand account.
+ * The form edits the default/shorthand account; its advanced YAML area
+ * edits named accounts through accountsYaml.
  */
 export const EmailSettingsSchema = z.object({
     provider: z.string().default(''),

package/package.json

@@ -1,74 +1,74 @@
-{
-  "name": "dsh-email",
-  "version": "0.10.5",
-  "description": "DeepSeek Harness 邮件插件：IMAP/SMTP 收发、搜索、回复转发、邮件整理与增量收件，支持多邮箱预设、发信审批及 Web 设置与新邮件通知。",
-  "type": "module",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/index.d.ts",
-      "default": "./lib/index.js"
-    },
-    "./client": "./lib/client.js",
-    "./cordis.patch.yml": "./cordis.patch.yml",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib",
-    "assets/whale-fallback.png",
-    "cordis.patch.yml",
+{
+  "name": "dsh-email",
+  "version": "0.10.7",
+  "description": "DeepSeek Harness 邮件插件：IMAP/SMTP 收发、搜索、回复转发、邮件整理与增量收件，支持多邮箱预设、发信审批及 Web 设置与新邮件通知。",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "assets/whale-fallback.png",
+    "cordis.patch.yml",
     "README.md",
     "README.en.md"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "pnpm run build",
-    "test": "pnpm run build && node --test \"test/*.test.mjs\""
-  },
-  "keywords": [
-    "dsh-plugin",
-    "deepseek-harness",
-    "dsh",
-    "email",
-    "imap",
-    "smtp"
-  ],
-  "author": "stardustlc",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/STARDUSTLC666/dsh-email.git"
-  },
-  "bugs": {
-    "url": "https://github.com/STARDUSTLC666/dsh-email/issues"
-  },
-  "homepage": "https://github.com/STARDUSTLC666/dsh-email#readme",
-  "license": "MIT",
-  "packageManager": "pnpm@11.7.0",
-  "engines": {
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "pnpm run build",
+    "test": "pnpm run build && node --test \"test/*.test.mjs\""
+  },
+  "keywords": [
+    "dsh-plugin",
+    "deepseek-harness",
+    "dsh",
+    "email",
+    "imap",
+    "smtp"
+  ],
+  "author": "stardustlc",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/STARDUSTLC666/dsh-email.git"
+  },
+  "bugs": {
+    "url": "https://github.com/STARDUSTLC666/dsh-email/issues"
+  },
+  "homepage": "https://github.com/STARDUSTLC666/dsh-email#readme",
+  "license": "MIT",
+  "packageManager": "pnpm@11.7.0",
+  "engines": {
     "node": "^22.19.0 || >=24.0.0"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "inject": [
-        "@deepseek-ai/dsh-client-ui-settings"
-      ],
-      "platform": "web"
-    }
-  },
-  "dependencies": {
-    "imapflow": "^1.7.0",
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-settings"
+      ],
+      "platform": "web"
+    }
+  },
+  "dependencies": {
+    "imapflow": "^1.7.0",
     "mailparser": "^3.9.22",
-    "nodemailer": "^9.0.5",
-    "schemastery": "^3.18.0",
-    "yaml": "^2.9.0"
-  },
-  "devDependencies": {
-    "@types/node": "^26.2.0",
-    "@types/nodemailer": "^8.0.1",
-    "typescript": "^5.7.3"
-  }
-}
+    "nodemailer": "^9.0.5",
+    "schemastery": "^3.18.0",
+    "yaml": "^2.9.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.2.0",
+    "@types/nodemailer": "^8.0.1",
+    "typescript": "^5.7.3"
+  }
+}