dsh-email 0.10.7 → 0.12.0

package/lib/mail-client.js

@@ -2,6 +2,7 @@ import { ImapFlow } from 'imapflow';
 import nodemailer from 'nodemailer';
 import { mkdir, stat, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { getFreshAccessToken, OAuth2Error } from './oauth2.js';
 import { flattenAddresses, parseRawMessage, sanitizeFilename } from './parse.js';
 export class MailError extends Error {
     constructor(message) {
@@ -12,6 +13,66 @@ export class MailError extends Error {
 export function messageOf(error, fallback) {
     return error instanceof Error && error.message !== '' ? error.message : fallback;
 }
+/**
+ * Replace anything credential-shaped in a server's own error text before it
+ * reaches a user.
+ *
+ * IMAP and SMTP servers routinely quote back the authentication string they
+ * rejected. For XOAUTH2 that string is `user=…\x01auth=Bearer <token>\x01\x01`,
+ * usually base64'd — so the raw message carries a live access token, and these
+ * messages are rendered in the settings panel, returned by the mail tools, and
+ * pasted into bug reports.
+ *
+ * Two shapes are masked: a JWT (three base64url segments, which is what every
+ * OAuth2 access token looks like) and a long base64 run (the quoted XOAUTH2
+ * blob). The replacement keeps the length so a report still says how big the
+ * thing was, without saying what it was.
+ */
+export function redactCredentials(text) {
+    return text
+        .replace(/[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{8,}/g, match => `<已隐去 ${match.length} 字符的令牌>`)
+        .replace(/[A-Za-z0-9+/]{40,}={0,2}/g, match => `<已隐去 ${match.length} 字符的凭据>`);
+}
+/**
+ * The IMAP `auth` block for one account. Pure so the shape the library
+ * receives is testable without a socket: an OAuth2 account authenticates with
+ * `accessToken` (imapflow then runs AUTHENTICATE XOAUTH2) and a password
+ * account with `pass`, exactly as before.
+ */
+export function imapAuthOf(cfg, accessToken) {
+    return cfg.authKind === 'oauth2'
+        ? { user: cfg.authUser, accessToken: accessToken ?? '' }
+        : { user: cfg.authUser, pass: cfg.authPassword };
+}
+/**
+ * Nodemailer consumes an OAuth2 token through accessToken, not pass.
+ * Refresh remains owned by this plugin; no refresh credentials leave here.
+ */
+export function smtpAuthOf(cfg, accessToken) {
+    return cfg.authKind === 'oauth2'
+        ? { type: 'OAuth2', user: cfg.authUser, accessToken: accessToken ?? '' }
+        : { user: cfg.authUser, pass: cfg.authPassword };
+}
+/** The message an OAuth2 account gets when the mailbox has to be logged into again. */
+export const OAUTH2_RELOGIN_MESSAGE = '邮箱登录失败：请到设置页重新登录（Microsoft 账号使用设备码登录，不使用授权码）';
+/**
+ * True for the errors both libraries report when the server rejects the
+ * credentials. An expired access token is indistinguishable from a wrong
+ * password at this level, so the connection retries once with a forced refresh
+ * before it believes the token is really dead.
+ */
+export function looksLikeAuthFailure(error) {
+    const raw = messageOf(error, '').toLowerCase();
+    if (raw === '')
+        return false;
+    return raw.includes('authentication')
+        || raw.includes('authenticate')
+        || raw.includes('auth failed')
+        || raw.includes('login')
+        || raw.includes('command failed')
+        || raw.includes('invalid credentials')
+        || raw.includes('xoauth2');
+}
 /** True when any bodyStructure node declares an attachment disposition. */
 function structureHasAttachment(node) {
     if (node === null || node === undefined || typeof node !== 'object')
@@ -57,6 +118,10 @@ export function selectAttachmentPart(readAttachments, parts, index) {
     const byTypeAndSize = parts.find(part => part.contentType === meta.contentType && Math.abs(part.size - meta.size) <= tolerance);
     return byTypeAndSize;
 }
+/** The From header: `user` is the visible address, `senderName` only labels it. */
+function senderOf(cfg) {
+    return cfg.senderName === '' ? cfg.user : { name: cfg.senderName, address: cfg.user };
+}
 /** Case-insensitive match of a query against subject/from/body text. */
 export function messageMatchesQuery(subject, fromText, body, query) {
     const q = query.toLowerCase();
@@ -81,10 +146,11 @@ function formatAddress(entry) {
 }
 function dedupeAddresses(entries, exclude) {
     const seen = new Set();
+    const excluded = new Set((Array.isArray(exclude) ? exclude : [exclude]).map(a => a.trim().toLowerCase()).filter(a => a !== ''));
     const out = [];
     for (const entry of entries) {
         const addr = (entry.address ?? '').toLowerCase();
-        if (addr === '' || addr === exclude || seen.has(addr))
+        if (addr === '' || excluded.has(addr) || seen.has(addr))
             continue;
         seen.add(addr);
         out.push(entry);
@@ -103,7 +169,7 @@ const FORWARD_MAX_CHARS = 4000;
  */
 export function buildReplyMessage(original, mode, selfAddress, text, forwardTo = '') {
     const fromText = original.from.map(a => a.name ?? a.address).filter(Boolean).join(', ') || '(未知发件人)';
-    const self = selfAddress.toLowerCase();
+    const self = (Array.isArray(selfAddress) ? selfAddress : [selfAddress]).filter(a => a.trim() !== '');
     if (mode === 'forward') {
         const to = forwardTo.trim();
         if (to === '')
@@ -170,6 +236,11 @@ function listedFrom(envelope, size, hasAttachments) {
         hasAttachments,
     };
 }
+/** email_attachment reuses the MIME index email_read already parsed; keep a few. */
+const READ_CACHE_MAX = 16;
+const READ_CACHE_TTL_MS = 10 * 60 * 1000;
+/** Folder names change rarely; a short TTL keeps email_folders off the wire. */
+const FOLDER_CACHE_TTL_MS = 60 * 1000;
 /**
  * One mailbox pool for the whole plugin: pooled IMAP connections per
  * account plus pooled SMTP transporters, with idle sweep and error eviction.
@@ -204,17 +275,60 @@ export class EmailPool {
         this.queues.set(name, next.then(() => undefined, () => undefined));
         return next;
     }
+    readCache = new Map();
+    folderCache = new Map();
+    /** Remember a parsed attachment index so email_attachment can skip the refetch. */
+    rememberRead(account, folder, uid, parsed) {
+        const key = account + '\u0000' + folder + '\u0000' + uid;
+        this.readCache.delete(key);
+        this.readCache.set(key, { ...parsed, at: Date.now() });
+        while (this.readCache.size > READ_CACHE_MAX) {
+            const oldest = this.readCache.keys().next();
+            if (oldest.done === true)
+                break;
+            this.readCache.delete(oldest.value);
+        }
+    }
+    /**
+     * The attachment index for one message: the cached one when email_read already
+     * produced it, otherwise a fresh parse of the full source plus its bodyStructure.
+     */
+    async attachmentIndexOf(client, account, folder, uid, signal) {
+        const cached = this.recallRead(account, folder, uid);
+        if (cached !== undefined)
+            return cached;
+        const message = await client.fetchOne(uid, { uid: true, bodyStructure: true, source: true }, { uid: true });
+        if (message === false || message.source === undefined) {
+            throw new MailError('找不到 uid=' + uid + ' 的邮件（可能已被删除，或不在文件夹 "' + folder + '"）');
+        }
+        const body = await parseRawMessage(message.source, this.settings.maxBodyChars);
+        signal?.throwIfAborted();
+        const parsed = { attachments: body.attachments, parts: collectAttachmentParts(message.bodyStructure) };
+        this.rememberRead(account, folder, uid, parsed);
+        return parsed;
+    }
+    recallRead(account, folder, uid) {
+        const key = account + '\u0000' + folder + '\u0000' + uid;
+        const hit = this.readCache.get(key);
+        if (hit === undefined)
+            return undefined;
+        if (Date.now() - hit.at > READ_CACHE_TTL_MS) {
+            this.readCache.delete(key);
+            return undefined;
+        }
+        return hit;
+    }
     async withImap(accountName, folder, run, readOnly = true, signal) {
         const name = this.resolveName(accountName);
         const cfg = this.account(name);
         return this.enqueue(name, () => this.imapRun(name, cfg, folder, readOnly, run, signal), signal);
     }
-    createImap(cfg) {
+    createImap(auth, cfg) {
         const client = new ImapFlow({
             host: cfg.imap.host,
             port: cfg.imap.port,
             secure: cfg.imap.secure,
-            auth: { user: cfg.user, pass: cfg.password },
+            auth,
             logger: false,
             connectionTimeout: cfg.imap.connectionTimeoutMs ?? 30000,
             greetingTimeout: 30000,
@@ -234,6 +348,54 @@ export class EmailPool {
         });
         return client;
     }
+    /**
+     * Dial and authenticate one fresh IMAP connection.
+     *
+     * A password account connects once. An OAuth2 account connects with a fresh
+     * access token and, when the server rejects it, refreshes once and tries
+     * again: a token that expired between the freshness check and the dial is
+     * indistinguishable from a wrong password at the socket, and guessing wrong
+     * would send the user through a browser login for nothing.
+     */
+    async connectImap(name, cfg, forceToken = false) {
+        const oauth2 = cfg.authKind === 'oauth2';
+        const attempt = async (token) => {
+            const client = this.createImap(imapAuthOf(cfg, token), cfg);
+            await client.connect();
+            return client;
+        };
+        let token;
+        if (oauth2) {
+            try {
+                token = await getFreshAccessToken(name, cfg, { force: forceToken });
+            }
+            catch (error) {
+                throw this.oauth2ErrorOf(error);
+            }
+        }
+        try {
+            return await attempt(token);
+        }
+        catch (error) {
+            if (!oauth2 || !looksLikeAuthFailure(error))
+                throw error;
+            try {
+                token = await getFreshAccessToken(name, cfg, { force: true });
+            }
+            catch (refreshError) {
+                throw this.oauth2ErrorOf(refreshError);
+            }
+            return await attempt(token);
+        }
+    }
+    /** The token store's own errors are already actionable; never dress them as IMAP failures. */
+    oauth2ErrorOf(error) {
+        if (error instanceof OAuth2Error)
+            return new MailError(error.message);
+        if (error instanceof MailError)
+            return error;
+        return new MailError(OAUTH2_RELOGIN_MESSAGE + '（' + redactCredentials(messageOf(error, '未知错误')) + '）');
+    }
     async imapRun(name, cfg, folder, readOnly, run, signal) {
         let entry = this.imaps.get(name);
         let activeClient = entry?.client;
@@ -252,11 +414,9 @@ export class EmailPool {
             if (entry === undefined || !entry.client.usable) {
                 if (entry !== undefined)
                     await this.evictImap(name);
-                const client = this.createImap(cfg);
+                const client = await this.connectImap(name, cfg);
                 activeClient = client;
                 signal?.throwIfAborted();
-                await client.connect();
-                signal?.throwIfAborted();
                 entry = { client, selected: null, selectedReadOnly: true, lastUsed: Date.now(), inUse: 0 };
                 this.imaps.set(name, entry);
             }
@@ -279,7 +439,7 @@ export class EmailPool {
         catch (error) {
             await this.evictImap(name);
             signal?.throwIfAborted();
-            throw this.normalizeImapError(error, folder);
+            throw this.normalizeImapError(error, folder, cfg.authKind);
         }
         finally {
             signal?.removeEventListener('abort', onAbort);
@@ -287,11 +447,14 @@ export class EmailPool {
                 entry.inUse = Math.max(0, entry.inUse - 1);
         }
     }
-    normalizeImapError(error, folder) {
+    normalizeImapError(error, folder, authKind = 'password') {
         const raw = messageOf(error, 'IMAP 操作失败');
         const lower = raw.toLowerCase();
         if (lower.includes('authentication') || lower.includes('login')) {
-            return new MailError('邮箱登录失败：' + raw + '（请检查 user 与授权码）');
+            // An OAuth2 account has no 授权码 to check: the only fix is a new login.
+            return new MailError(authKind === 'oauth2'
+                ? OAUTH2_RELOGIN_MESSAGE + '（' + raw + '）'
+                : '邮箱登录失败：' + raw + '（请检查 user 与授权码）');
         }
         if (lower.includes('nonselect') || lower.includes('does not exist') || lower.includes('nonexistent')) {
             return new MailError('找不到邮箱文件夹 "' + (folder ?? '') + '"：' + raw);
@@ -333,7 +496,12 @@ export class EmailPool {
             transporter.close();
         this.smtps.clear();
     }
-    transporter(name, cfg) {
+    /**
+     * A pooled transporter for one account. The token is captured when the
+     * transporter is built; an OAuth2 token that turns out to be stale is
+     * re-minted in sendMail, which rebuilds the transporter.
+     */
+    transporter(name, cfg, accessToken) {
         let t = this.smtps.get(name);
         if (t === undefined) {
             t = nodemailer.createTransport({
@@ -341,7 +509,7 @@ export class EmailPool {
                 host: cfg.smtp.host,
                 port: cfg.smtp.port,
                 secure: cfg.smtp.secure,
-                auth: { user: cfg.user, pass: cfg.password },
+                auth: smtpAuthOf(cfg, accessToken),
                 connectionTimeout: 30000,
                 greetingTimeout: 10000,
                 socketTimeout: 60000,
@@ -352,27 +520,62 @@ export class EmailPool {
         }
         return t;
     }
-    /** Send through the pooled transporter while making cancellation close it. */
+    dropTransporter(name, transporter) {
+        if (this.smtps.get(name) === transporter)
+            this.smtps.delete(name);
+        transporter.close();
+    }
+    /**
+     * Send through the pooled transporter while making cancellation close it.
+     *
+     * An OAuth2 transporter carries a token that was minted when it was built,
+     * so a rejection is retried once against a freshly built one (and a fresh
+     * form of whatever stored token state exists). Password accounts keep the
+     * single attempt they always had.
+     */
     async sendMail(name, cfg, message, signal) {
         signal?.throwIfAborted();
-        const transporter = this.transporter(name, cfg);
-        const onAbort = () => {
-            if (this.smtps.get(name) === transporter)
-                this.smtps.delete(name);
-            transporter.close();
+        const attempt = async (forceToken) => {
+            const token = cfg.authKind === 'oauth2' ? await getFreshAccessToken(name, cfg, { force: forceToken }) : undefined;
+            const transporter = this.transporter(name, cfg, token);
+            const onAbort = () => {
+                this.dropTransporter(name, transporter);
+            };
+            signal?.addEventListener('abort', onAbort, { once: true });
+            try {
+                const info = await transporter.sendMail(message);
+                signal?.throwIfAborted();
+                return info;
+            }
+            finally {
+                signal?.removeEventListener('abort', onAbort);
+            }
         };
-        signal?.addEventListener('abort', onAbort, { once: true });
         try {
-            const info = await transporter.sendMail(message);
-            signal?.throwIfAborted();
-            return info;
+            return await attempt(false);
         }
         catch (error) {
             signal?.throwIfAborted();
-            throw error;
-        }
-        finally {
-            signal?.removeEventListener('abort', onAbort);
+            if (cfg.authKind !== 'oauth2')
+                throw error;
+            // A pooled connection that already authenticated can fail for reasons no
+            // token can fix (a rejected recipient, a full mailbox). Only a credential
+            // rejection is worth a second, freshly-tokened attempt — and a token
+            // store that refused outright is reported as itself.
+            if (!looksLikeAuthFailure(error))
+                throw this.oauth2ErrorOf(error);
+            // The cached transporter holds the old token: it has to go, or the retry
+            // would reuse the very credential that was just refused.
+            const stale = this.smtps.get(name);
+            if (stale !== undefined)
+                this.dropTransporter(name, stale);
+            try {
+                return await attempt(true);
+            }
+            catch (retryError) {
+                signal?.throwIfAborted();
+                throw this.oauth2ErrorOf(retryError);
+            }
         }
     }
     async list(accountName, folder, limit, offset, unreadOnly, since, until, signal) {
@@ -382,6 +585,8 @@ export class EmailPool {
         return this.withImap(name, folderName, async (client) => {
             const mailbox = client.mailbox;
             const total = mailbox === false ? 0 : mailbox.exists;
+            // imapflow types uidValidity as number | bigint; the wire format is 32-bit.
+            const uidValidity = mailbox === false ? 0 : Number(mailbox.uidValidity ?? 0);
             let scopeCount = total;
             let uids = [];
             const hasDateFilter = since !== undefined || until !== undefined;
@@ -407,17 +612,21 @@ export class EmailPool {
             uids.reverse();
             const window = uids.slice(offset, offset + limit);
             const messages = await this.fetchListed(client, window, signal);
-            return { account: name, count: scopeCount, folder: folderName, messages };
+            return { account: name, count: scopeCount, folder: folderName, uidValidity, messages };
         }, true, signal);
     }
-    async search(accountName, query, folder, limit, since, until, signal) {
+    async search(accountName, query, folder, limit, offset, since, until, signal) {
         const name = this.resolveName(accountName);
         const cfg = this.account(name);
         const folderName = folder || cfg.inboxFolder;
         return this.withImap(name, folderName, async (client) => {
             // No nested OR and no TEXT search: several servers (QQ among them)
-            // silently answer those with empty or match-everything results.
-            // subject/from/to/cc searches unioned client-side behave well everywhere.
+            // silently answer those with empty results, and some answer with a
+            // non-empty list that has nothing to do with the query at all (QQ again:
+            // an impossible keyword still「matches」every uid in the folder). The
+            // server's hit list is therefore a hint, not an answer: confirm it
+            // against the envelopes before reporting anything, otherwise scan
+            // locally.
             const dateRange = {};
             if (since !== undefined)
                 dateRange.since = since;
@@ -430,20 +639,50 @@ export class EmailPool {
                 client.search({ cc: query, ...dateRange }, { uid: true }),
             ]);
             signal?.throwIfAborted();
-            const uids = [...new Set(found.flatMap(result => result === false ? [] : result))].sort((a, b) => a - b);
-            uids.reverse();
-            if (uids.length === 0 && this.settings.bodySearchFallback) {
-                // Server-side search found nothing: fall back to a client-side scan of
-                // the most recent messages (subject/from/body), capped for time.
-                const messages = await this.searchBodies(client, query, folderName, limit, since, until, signal);
-                return { account: name, query, count: messages.length, folder: folderName, messages };
-            }
-            const messages = await this.fetchListed(client, uids.slice(0, limit), signal);
-            return { account: name, query, count: uids.length, folder: folderName, messages };
+            const uids = [...new Set(found.flatMap(result => result === false ? [] : result))].sort((a, b) => b - a);
+            if (uids.length > 0) {
+                // The sample has to cover the requested page (offset + limit) — the same
+                // window the fallback scan looks at — so one FETCH serves both the
+                // verification and the rows that are handed out.
+                const confirmed = await this.searchHits(client, uids, query, offset + limit, signal);
+                if (confirmed.length > 0) {
+                    // The server's list holds up, so its size is reported as the match
+                    // count; only rows that were confirmed are ever handed out.
+                    return { account: name, query, count: uids.length, folder: folderName, offset, messages: confirmed.slice(offset, offset + limit) };
+                }
+            }
+            // Nothing believable came back (empty answer, or hits that did not
+            // survive verification): scan the newest messages locally instead.
+            if (this.settings.bodySearchFallback) {
+                const messages = await this.searchBodies(client, query, folderName, limit, offset, since, until, signal);
+                return { account: name, query, count: messages.length, folder: folderName, offset, messages };
+            }
+            return { account: name, query, count: 0, folder: folderName, offset, messages: [] };
         }, true, signal);
     }
+    /**
+     * Confirm server-side hits against the mailbox itself: fetch the envelopes
+     * of the newest candidates — the same window the body-scan fallback looks at
+     * — and keep only those that really carry the query in subject/from/to/cc,
+     * the four fields the server was asked about. No body is downloaded here,
+     * and uids the server made up simply return nothing.
+     */
+    async searchHits(client, uids, query, need, signal) {
+        const sample = uids.slice(0, Math.min(uids.length, Math.max(this.settings.bodySearchLimit, need)));
+        signal?.throwIfAborted();
+        const fetched = await client.fetchAll(sample, { uid: true, envelope: true, flags: true, size: true, bodyStructure: true }, { uid: true });
+        signal?.throwIfAborted();
+        return fetched
+            .filter(message => {
+            const envelope = message.envelope;
+            const addressText = [envelope?.from, envelope?.to, envelope?.cc].map(flattenAddressText).join(' ');
+            return messageMatchesQuery(envelope?.subject ?? '', addressText, '', query);
+        })
+            .map(message => listedFrom(message, message.size, structureHasAttachment(message.bodyStructure)))
+            .sort((a, b) => b.uid - a.uid);
+    }
     /** Client-side scan of the tail of the mailbox, newest first. */
-    async searchBodies(client, query, folder, limit, since, until, signal) {
+    async searchBodies(client, query, folder, limit, offset, since, until, signal) {
         signal?.throwIfAborted();
         const mailbox = client.mailbox;
         const total = mailbox === false ? 0 : mailbox.exists;
@@ -454,7 +693,7 @@ export class EmailPool {
         const out = [];
         for (const message of [...fetched].reverse()) {
             signal?.throwIfAborted();
-            if (out.length >= limit)
+            if (out.length >= offset + limit)
                 break;
             const receivedAt = message.internalDate ?? message.envelope?.date;
             if (since !== undefined && (receivedAt === undefined || receivedAt < since))
@@ -480,7 +719,7 @@ export class EmailPool {
                 out.push(listedFrom(message, message.size, structureHasAttachment(message.bodyStructure)));
             }
         }
-        return out;
+        return out.slice(offset, offset + limit);
     }
     async fetchListed(client, uids, signal) {
         signal?.throwIfAborted();
@@ -497,12 +736,13 @@ export class EmailPool {
         const cfg = this.account(name);
         const folderName = folder || cfg.inboxFolder;
         return this.withImap(name, folderName, async (client) => {
-            const message = await client.fetchOne(uid, { uid: true, source: true }, { uid: true });
+            const message = await client.fetchOne(uid, { uid: true, source: true, bodyStructure: true }, { uid: true });
             if (message === false || message.source === undefined) {
                 throw new MailError('找不到 uid=' + uid + ' 的邮件（可能已被删除，或不在文件夹 "' + folderName + '"；可用 email_list 重新获取 uid）');
             }
             const body = await parseRawMessage(message.source, this.settings.maxBodyChars);
             signal?.throwIfAborted();
+            this.rememberRead(name, folderName, uid, { attachments: body.attachments, parts: collectAttachmentParts(message.bodyStructure) });
             return { account: name, uid, folder: folderName, ...body };
         }, true, signal);
     }
@@ -565,17 +805,23 @@ export class EmailPool {
     async folders(accountName, subscribedOnly, signal) {
         const name = this.resolveName(accountName);
         return this.withImap(name, null, async (client) => {
-            const list = await client.list();
-            signal?.throwIfAborted();
-            const folders = list
-                .filter(row => !subscribedOnly || row.subscribed !== false)
-                .map(row => ({
-                name: row.name ?? row.path,
-                path: row.path,
-                specialUse: row.specialUse ?? '',
-                subscribed: row.subscribed !== false,
-            }));
-            return { account: name, folders };
+            const cached = this.folderCache.get(name);
+            let rows;
+            if (cached !== undefined && Date.now() - cached.at < FOLDER_CACHE_TTL_MS) {
+                rows = cached.folders;
+            }
+            else {
+                const list = await client.list();
+                signal?.throwIfAborted();
+                rows = list.map(row => ({
+                    name: row.name ?? row.path,
+                    path: row.path,
+                    specialUse: row.specialUse ?? '',
+                    subscribed: row.subscribed !== false,
+                }));
+                this.folderCache.set(name, { at: Date.now(), folders: rows });
+            }
+            return { account: name, folders: rows.filter(row => !subscribedOnly || row.subscribed !== false) };
         }, true, signal);
     }
     async downloadAttachment(accountName, folder, uid, index, workspaceHint, signal) {
@@ -583,23 +829,19 @@ export class EmailPool {
         const cfg = this.account(name);
         const folderName = folder || cfg.inboxFolder;
         return this.withImap(name, folderName, async (client) => {
-            const message = await client.fetchOne(uid, { uid: true, bodyStructure: true, source: true }, { uid: true });
-            if (message === false || message.source === undefined) {
-                throw new MailError('找不到 uid=' + uid + ' 的邮件（可能已被删除，或不在文件夹 "' + folderName + '"）');
-            }
-            // The mailparser list is authoritative for the index email_read showed;
-            // the bodyStructure walk supplies the IMAP part to download.
-            const body = await parseRawMessage(message.source, this.settings.maxBodyChars);
-            signal?.throwIfAborted();
-            const parts = collectAttachmentParts(message.bodyStructure);
-            if (body.attachments.length === 0)
+            // The mailparser list is authoritative for the index email_read showed and
+            // the bodyStructure walk supplies the IMAP part to download. email_read
+            // already produced both in the usual read-then-download flow, so reuse that
+            // instead of pulling the whole message — attachments included — again.
+            const { attachments, parts } = await this.attachmentIndexOf(client, name, folderName, uid, signal);
+            if (attachments.length === 0)
                 throw new MailError('该邮件没有附件');
-            if (body.attachments[index] === undefined) {
-                throw new MailError('附件序号 ' + index + ' 越界：共 ' + body.attachments.length + ' 个附件（序号从 0 开始，与 email_read 返回的 attachments 顺序一致）');
+            if (attachments[index] === undefined) {
+                throw new MailError('附件序号 ' + index + ' 越界：共 ' + attachments.length + ' 个附件（序号从 0 开始，与 email_read 返回的 attachments 顺序一致）');
             }
-            const att = selectAttachmentPart(body.attachments, parts, index);
+            const att = selectAttachmentPart(attachments, parts, index);
             if (att === undefined) {
-                throw new MailError('附件 #' + index + '（' + body.attachments[index].filename + '）无法在邮件结构中定位（可能是内嵌图片，暂不支持下载）');
+                throw new MailError('附件 #' + index + '（' + attachments[index].filename + '）无法在邮件结构中定位（可能是内嵌图片，暂不支持下载）');
             }
             if (att.size > this.settings.maxAttachmentBytes) {
                 throw new MailError('附件 "' + att.filename + '" 大小 ' + att.size + ' 字节，超过上限 maxAttachmentBytes=' + this.settings.maxAttachmentBytes);
@@ -607,7 +849,7 @@ export class EmailPool {
             const dl = await client.download(uid, att.part, { uid: true, maxBytes: this.settings.maxAttachmentBytes });
             signal?.throwIfAborted();
             const buf = await collectStream(dl.content, this.settings.maxAttachmentBytes, signal);
-            const safeName = sanitizeFilename(dl.meta.filename ?? att.filename ?? body.attachments[index].filename);
+            const safeName = sanitizeFilename(dl.meta.filename ?? att.filename ?? attachments[index].filename);
             // Default the destination to the session workspace so the model can
             // read the file back; an explicit downloadDir always wins.
             const dir = this.settings.downloadDirExplicit
@@ -628,7 +870,7 @@ export class EmailPool {
         const cfg = this.account(name);
         const attachments = await validateAttachmentPaths(attachmentPaths ?? [], this.settings.maxAttachmentBytes, signal);
         const info = await this.sendMail(name, cfg, {
-            from: cfg.user,
+            from: senderOf(cfg),
             to,
             cc,
             subject,
@@ -657,10 +899,13 @@ export class EmailPool {
             const ids = extractMessageIds(message.source);
             const body = await parseRawMessage(message.source, this.settings.maxBodyChars);
             signal?.throwIfAborted();
-            return buildReplyMessage({ from: body.from, to: body.to, cc: body.cc, subject: body.subject, date: body.date, text: body.text, messageId: ids.messageId, references: ids.references }, mode, cfg.user, text, forwardTo);
+            return buildReplyMessage({ from: body.from, to: body.to, cc: body.cc, subject: body.subject, date: body.date, text: body.text, messageId: ids.messageId, references: ids.references }, mode, 
+            // Both the visible address and the login are "me": a reply-all that
+            // keeps either of them would mail the sender his own message.
+            cfg.authUser === cfg.user ? cfg.user : [cfg.user, cfg.authUser], text, forwardTo);
         }, true, signal);
         const info = await this.sendMail(name, cfg, {
-            from: cfg.user,
+            from: senderOf(cfg),
             to: built.to,
             cc,
             subject: built.subject,