dsh-email 0.13.0 → 0.13.2

package/CHANGELOG.md

@@ -4,6 +4,8 @@
 
 ## 中文版
 
+- **0.13.2（2026-09-21）**：同名附件优先按真实 MIME 分段编号下载；旧解析元数据按一对一匹配，避免多个序号都取到第一个同名文件。保留正文分段下载和附件索引缓存，新增文件字节级回归，268 项测试通过。
+- **0.13.1（2026-09-19）**：**新增**：内置一份公共客户端注册（`15dcd5aa-…`，贡献者 [gurio-wine](https://github.com/gurio-wine) 在 [PR #13](https://github.com/STARDUSTLC666/dsh-email/pull/13) 注册，并授权本项目内置使用，特此致谢）——Outlook / Exchange Online 的 OAuth2 登录**开箱即用**，不再需要每个用户自己注册应用。设置页卡片会显示当前生效的应用 ID：留空即用内置的社区应用，填入自己的 `clientId` 即覆盖（账号级仍可覆盖顶层简写）。**文档**：README 说明内置应用来自谁、代价是什么、如何换成自己的；并说明 token 与签发它的应用 ID 绑定，将来替换内置注册需要这些账号重新登录一次。测试 262 → 264 项。
 - **0.13.0（2026-09-18）**：**修复**：①长正文截断会把整段正文丢成空（无断点时硬切，保留正文）；②`email_watch` / 网页弹窗的游标会永久漏报一次超过 `limit` 条的新邮件（改为最旧优先分批、游标只推进到实际返回那批）；③附件索引缓存未绑定 UIDVALIDITY，服务器重编号后可能按旧索引写出错误附件（缓存键并入 uidValidity）。**性能**：10 个工具声明 `timeoutMs`（search/watch 120s，其余 60s）；watch/弹窗轮询只 FETCH 本轮要报的条数（此前每轮最多 FETCH 100 封未读信封）；读信与正文搜索只下载 text/* 分段，不再把整封（含附件）拉下来。**口径**：搜索回退路径明确标注为扫描口径（「本页 N 条（仅扫描最近 X 封）」，不再冒充全文件夹匹配数）。**行为变化**：`email_read` 的 `attachments` 只列可下载的 `disposition=attachment`（内嵌图片不再列出）；回退扫描改为逐封下载文本分段（省流量、往返略增）。测试 237 → 262 项。
 - **0.12.0（2026-09-18）**：**新增发送别名**（`senderName` / `authUser` / `authPassword`）：`user` 只作为发件地址与信箱身份，登录名与登录密码可以另填——Gmail / Workspace 的别名发信、以及「登录账号 ≠ From 地址」的 SMTP 中继不再被 `535 Username and Password not accepted` 拒绝，From 也能带显示名。设置页账号卡片新增「发件显示名 / 登录账号 / 登录账号的密码」三栏（与授权码同一套三态：留空保留已存值、清空即删除）。**新增** `email_search` 的 `offset`，命中多于一页时可翻页。**修复与优化**：文件夹 UIDVALIDITY 变化时重建 `email_watch` / 弹窗的增量基线（不再把重编号后的整箱当成新邮件）；搜索的命中复核与结果列表合并为一次 FETCH；`email_attachment` 复用 `email_read` 已解析的 MIME 索引，不再把整封邮件（含附件）重下一遍；`email_folders` 结果缓存 60 秒；网页端新邮件弹窗在标签页不可见时暂停轮询、失败指数退避、皮肤快照降频。**工程**：CI 增加「`lib/` 与 `src/` 不允许漂移」和客户端 bundle 语法检查。测试 237 → 252 项。发送别名的方向来自 [@TianLanDaoRen](https://github.com/TianLanDaoRen) 的 [PR #8](https://github.com/STARDUSTLC666/dsh-email/pull/8)（本实现按 0.11.0 之后的代码重写）。
 - **0.11.0（2026-09-18）**：合入 gurio-wine 的设置页四连（[PR #11](https://github.com/STARDUSTLC666/dsh-email/pull/11)–[#14](https://github.com/STARDUSTLC666/dsh-email/pull/14)），并在评审后修掉其中若干问题。**新增**：①多账号卡片编辑器（增删改 / 改名 / 设默认 / 按账号单独测试连接，编辑即保存，不再需要点「保存并应用」）与服务器预设管理（`serverPresets`，自定义服务商端点，不含凭证）；②Outlook / Exchange Online 的 OAuth2 设备码登录（IMAP 与 SMTP 双端，access token 自动刷新，密码认证账号完全不受影响）；③设置面板文案中英双语，跟随宿主 Settings → General 的语言实时切换；④账号可显式钉住 `authKind`（自动 / oauth2 / password），给仍能用应用密码连 Exchange Online 的混合或本地租户留退路。**评审修复**：SMTP 的 OAuth2 认证形状原本一封也发不出去（nodemailer 的 `XOAuth2` 只读 `accessToken`、从不读 `pass`，实测报 `EAUTH`）；保存面板不再无条件抹掉账号手写的 imap/smtp 端点（运行时解析以账号自己的值优先，原行为会把自建服务器账号静默改指预设，无 provider 的账号则直接失去连接信息）；改名保留授权码与高级键，且不允许顶掉同名账号；设置路由增加 Host / Origin / Content-Type 同源校验（此前任意网页都能跨源改设置，DNS rebinding 还能读走含明文授权码的快照）；响应不再回显解析后的账号映射（那是一份含明文密码、前端从不读取的副本）；服务器原始报错经凭据脱敏后才展示（IMAP/SMTP 会回显被拒的认证串，其中含 access token）；删除账号即清理其 token，未提交的保存不清；版本冲突自动重基，而不是拿旧 revision 反复重试。**不内置任何第三方 OAuth2 应用注册**：OAuth2 账号需自带 `clientId`，见下文「Outlook OAuth2」。测试 81 → 237 项。**修复 `email_search`**：QQ 这类服务器会对任意关键词返回同一批无关 UID，现在服务器命中会先用 envelope 复核（subject/from/to/cc），核实不到就回退本地正文扫描，不会再出现「不存在的关键词也匹配 40 条」（[#15](https://github.com/STARDUSTLC666/dsh-email/issues/15)）。
@@ -22,6 +24,7 @@
 
 ## English
 
+- **0.13.2 (2026-09-21)**: download attachments by their real MIME section IDs, fixing duplicate filenames selecting the first file. Legacy parsed metadata matches sections one-to-one. Body-only reads and attachment-index caching remain intact; 268 tests pass, including downloaded-file byte checks.
 - **0.13.0 (2026-09-18)**: **Fixes**: (1) long bodies could be truncated to nothing (now hard-cut with the body preserved); (2) the `email_watch` / popup cursor permanently skipped new mail beyond one `limit` batch (now oldest-first batching, cursor only advances over what was actually returned); (3) the attachment index cache ignored UIDVALIDITY, so a renumbered mailbox could download the wrong attachment (cache key now includes uidValidity). **Performance**: all ten tools declare `timeoutMs` (120s for search/watch, 60s otherwise); watch/popup polls FETCH only the rows they report (previously up to 100 unread envelopes per poll); reads and body search download text/* parts only instead of the whole message with its attachments. **Semantics**: the body-scan fallback now labels itself as such ("this page only, scanning the newest N messages") instead of claiming a folder-wide match count. **Behaviour change**: `email_read` now lists only downloadable `disposition=attachment` entries (inline images are no longer listed); the fallback scan fetches per message (fewer bytes, slightly more round trips). Tests 237 → 262.
 - **0.12.0 (2026-09-18)**: **send-as alias** (`senderName` / `authUser` / `authPassword`): `user` is now only the From address and the mailbox identity, while the login user and password can differ — Gmail / Workspace aliases and SMTP relays where the login is not the From address no longer fail with `535 Username and Password not accepted`, and the From header can carry a display name. The account card gained three fields (same three-state contract as the authorization code: empty keeps the stored value, clearing deletes the key). **New**: `offset` for `email_search`, so results beyond the first page are reachable. **Fixes and optimisations**: a changed folder UIDVALIDITY re-seeds the `email_watch` / popup baseline instead of reporting the renumbered mailbox as new; search verification and the result rows share one FETCH; `email_attachment` reuses the MIME index `email_read` already parsed instead of downloading the whole message again; `email_folders` is cached for 60s; the web new-mail popup pauses while the tab is hidden, backs off on failures and refreshes its skin snapshot less often. **Engineering**: CI now rejects `lib/` drift against `src/` and syntax-checks the hand-written client bundle. Tests 237 → 252. The send-as direction came from [@TianLanDaoRen](https://github.com/TianLanDaoRen)'s [PR #8](https://github.com/STARDUSTLC666/dsh-email/pull/8) (this implementation is a rewrite on top of 0.11.0).
 - **0.11.0 (2026-09-18)**: merge gurio-wine's four settings-page PRs ([#11](https://github.com/STARDUSTLC666/dsh-email/pull/11)–[#14](https://github.com/STARDUSTLC666/dsh-email/pull/14)) with post-review fixes. **Added**: ① visual multi-account card editor (add/edit/delete, rename, set-default, per-account connection test — edits auto-save; no "Save & Apply" button) and server-preset management (`serverPresets`, custom provider endpoints, no credentials); ② OAuth2 device-code login for Outlook / Exchange Online (IMAP and SMTP share one token; automatic refresh; password-auth accounts unaffected); ③ bilingual settings-panel copy that follows the host's Settings → General language in real time; ④ accounts can pin `authKind` (auto / oauth2 / password), giving hybrid or on-premises tenants that still accept app passwords an escape hatch. **Review fixes**: SMTP OAuth2 could never send (nodemailer's `XOAuth2` reads only `accessToken`, never `pass` — confirmed `EAUTH`); saving no longer unconditionally wipes account-level hand-written imap/smtp endpoints (runtime prefers the account's own host; the old behavior silently re-pointed custom-server accounts to presets, and accounts without a provider lost connection info entirely); rename preserves stored auth codes and advanced keys and refuses to overwrite an existing account name; settings routes now enforce Host / Origin / Content-Type same-origin checks (previously any web page could cross-origin-write settings; DNS rebinding could read snapshots containing plaintext auth codes); responses no longer echo the resolved account map (a plaintext-password copy the front end never reads); raw server errors are credential-scrubbed before display (IMAP/SMTP echo rejected auth strings containing access tokens); deleting an account cleans its tokens (uncommitted saves do not); version conflicts auto-rebase instead of retrying with a stale revision. **No third-party OAuth2 app registration is bundled**: OAuth2 accounts must supply their own `clientId` — see "Outlook OAuth2" below. Tests: 81 → 237. **`email_search` fix**: servers like QQ answer any keyword with the same unrelated uid list; hits are now re-verified against the envelopes (subject/from/to/cc) and fall back to the local body scan when none survive, so an impossible keyword no longer "matches" 40 messages ([#15](https://github.com/STARDUSTLC666/dsh-email/issues/15)).

package/README.en.md

@@ -37,12 +37,16 @@ Example:
 
 ### Changelog
 
+- **0.13.2 (2026-09-21)**: download attachments by their real MIME section IDs, fixing duplicate filenames selecting the first file. Legacy parsed metadata matches sections one-to-one. Body-only reads and attachment-index caching remain intact; 268 tests pass, including downloaded-file byte checks.
+- **0.13.1 (2026-09-19)**: ships a community public-client registration (thanks [gurio-wine](https://github.com/gurio-wine)), so Outlook / Exchange Online works out of the box; supply your own `clientId` to override it — the card shows which application is in effect. 264 tests.
 - **0.13.0 (2026-09-18)**: fixes for bodies truncated to nothing, `email_watch` skipping new mail, and the attachment cache ignoring UIDVALIDITY; all ten tools declare a timeout; reads and body search download text parts only; the scan fallback labels its own semantics. 262 tests.
 - **0.12.0 (2026-09-18)**: send-as alias (`senderName` / `authUser` / `authPassword`) and `offset` paging for `email_search`; QQ match-everything searches no longer trusted; popup polling pauses while the tab is hidden.
 - **0.11.0 (2026-09-18)**: gurio-wine’s four settings-page PRs (card editor / OAuth2 device-code login / bilingual panel / pinned `authKind`) plus the review fixes for SMTP OAuth2 and same-origin settings routes.
 - **0.10.8 and earlier**: see [CHANGELOG.md](CHANGELOG.md).
 ## Compatibility
 
+2026-09-21: the current release package was installed through the official CLI in an isolated profile and co-loaded with the other two most-downloaded plugins on source-built Harness `0.1.6-alpha.2`. All 18 plugin tools registered; calendar/email configuration checks, PPT theme listing and 17-row table generation passed. The host is based on the official alpha.2 release plus the tool-scheduler `Symbol.for` fix (`93badd88`). This run did not connect to live mail or calendar services.
+
 Co-load verification was performed on 2026-09-16 with official source builds of Harness `0.1.5-rc.2` and `0.1.6-alpha.1`: all 18 components load alongside ModLens, with passing tool schemas, skill registration and offline read-only calls.
 
 **0.11.0 co-load verification (2026-09-18, locally built Harness `0.1.5-rc.2`, `web` profile)**: the plugin mounted without errors; the settings route answered GET with 200 and no `raw` field in the response; a `text/plain` POST was refused with **415**, proving the same-origin guard holds in the real host; under a `application/json` POST the card projection was correct, and an account pinning `authKind: password` reported both `authKindDeclared` and `authKind` as `password`; the panel actually rendered account cards, the eight provider presets with localized labels, the three-way authentication selector, the application (client) ID field with its hint, the missing-ID warning banner (so `--dsw-alias-state-warn-primary` is genuinely defined in the real host) and the Sign in with Microsoft button; the browser console was clean; save worked end to end, and afterwards `accountsYaml` was restored to empty with the original account intact. Offline tests: 231 green. **Still not done**: an end-to-end OAuth2 run against a real Outlook tenant (the device-code flow needs a human to authorize in a browser) and real sending; the `clientId` paths are covered only against a fake authority. Uses the `cordis.patch.yml` + `dsh.bundle.patch` bundle model. Node requirements are 22.19 or later within 22.x, or 24 or later. Live external-service workflows require separate configuration and validation.
@@ -57,7 +61,7 @@ Follows the official [plugin packaging and installation requirements](https://gi
 dsh plugin --profile web add dsh-email
 ```
 
-(Or install from GitHub: `dsh plugin --profile web add github:your-account/dsh-email#<commit>`, then follow the prompt to authorize the `prepare` build in the profile's `pnpm-workspace.yaml`.)
+(Or install a specific GitHub commit: `dsh plugin --profile web add github:STARDUSTLC666/dsh-email#<commit>`. The repository includes prebuilt `lib/` artifacts; no `prepare` build is required.)
 
 After installing, restart `dsh web`. The plugin ships with an empty config and **won't crash startup**; calling any email tool before configuration returns a clear configuration hint.
 
@@ -163,7 +167,7 @@ The settings page's "Server presets" fold-out edits these presets visually, and
 | `maxBodyChars` | `20000` | Body truncation limit for `email_read` (1000–200000) |
 | `accounts` | — | Named account map; account-level fields override top-level shorthand |
 | `accountsYaml` | — | YAML text of the account map, written by the settings-page card editor; overrides `accounts` when non-empty |
-| `clientId` | — | Application (client) ID for OAuth2 accounts; account-level overrides top-level shorthand. The plugin bundles no third-party registration — required for Outlook / Exchange Online OAuth2 (see "Outlook OAuth2" below) |
+| `clientId` | built-in community app (below) | Application (client) ID for OAuth2 accounts: empty uses the plugin's built-in public client, a value overrides it (account-level also overrides the top-level shorthand) |
 | `authKind` | derived from provider | Authentication method override: `oauth2` / `password`. When omitted, derived from provider and IMAP host; hybrid or on-premises tenants that still accept app passwords for Exchange Online can pin `password`. The card's "Authentication method" selector writes this key |
 | `serverPresets` | — | YAML text of custom provider presets (key = preset name, value has optional `label` + `imap`/`smtp`); endpoints only, no credentials. The settings-page dropdown lists preset names and pre-fills endpoints into account cards; editing a preset does not reconnect established connections |
 | `defaultAccount` | auto (single account) | Account used when the `account` argument is omitted (required for multi-account) |
@@ -193,9 +197,9 @@ Every provider requires an authorization code / app-specific password instead of
 
 Microsoft has disabled username+password basic auth for Exchange Online: personal outlook.com accounts and most tenants now require OAuth2. This plugin supports the device-code flow — IMAP and SMTP share a single token with automatic refresh.
 
-**Why no bundled application ID**: a client ID is "someone's app registration." If the plugin shipped one, the Microsoft consent screen would show another party's app name (enterprise security teams typically deny it outright), sign-in logs and telemetry would land in that party's tenant (including your UPN), and if they ever deleted the app every user's login would break simultaneously — with only a cryptic "clientId may be wrong" error. Therefore this plugin **carries no third-party registration**; please register your own (free, ~10 minutes).
+**Where the bundled application ID comes from**: the device-code flow needs an app registration, and making every user register one is a wall nobody should have to climb — so the plugin ships one: `15dcd5aa-00dd-487f-82d7-1d2b2c299e14`, registered by contributor [gurio-wine](https://github.com/gurio-wine) in [PR #13](https://github.com/STARDUSTLC666/dsh-email/pull/13) and used here with their permission — thank you. The cost is stated plainly: the Microsoft consent screen names **their** application (enterprise security teams may refuse it), and the sign-in logs and telemetry land in **their** tenant, including your UPN. If they ever delete the app, every account that did not bring its own id stops signing in at once, with no better error than "clientId may be wrong". **Registering your own (free, ~10 minutes) keeps you independent — paste it into the card to override the built-in value; leaving the field empty keeps using the bundled one.**
 
-**Registering a public client**:
+**Using your own application instead (optional, free, ~10 minutes)**:
 
 1. Open the [Entra admin center](https://entra.microsoft.com/) → **App registrations** → **New registration**.
 2. Under **Supported account types**, select "Accounts in any organizational directory and personal Microsoft accounts" — this determines whether personal outlook.com accounts can sign in. Choosing incorrectly yields `AADSTS700016` or `AADSTS50020`.
@@ -204,19 +208,19 @@ Microsoft has disabled username+password basic auth for Exchange Online: persona
 5. In the left sidebar, go to **Authentication** → scroll to the bottom → set **Allow public client flows** to **Yes** and save. Without this, login fails with an `AADSTS700028`-style "device-code flow not enabled" error.
 6. In the left sidebar, go to **API permissions** → Add a permission → Microsoft Graph → **Delegated permissions** → check `IMAP.AccessAsUser.All`, `SMTP.Send`, and `offline_access` (the last one is essential for obtaining a refresh token — without it, every expiry forces a fresh login). Personal tenants generally need no admin consent; enterprise tenants may require an admin to click "Grant admin consent" once.
 
-**Filling it into the plugin**: Settings → Mail (dsh-email) → the account card's "Application (client) ID" field; or in YAML (account-level `clientId`, which can also be set at the top level as a default for all accounts).
+**Filling it into the plugin (overrides the built-in value)**: Settings → Mail (dsh-email) → the account card's "Application (client) ID" field (the card shows which application is in effect; empty keeps the bundled community app); or in YAML (account-level `clientId`, which can also be set at the top level as a default for all accounts).
 
 **Login flow**: click "Sign in to Microsoft account" on the card → the panel shows a `microsoft.com/devicelogin` link and a code → open the link in a browser, enter the code, and complete authorization → the panel polls until it shows "Signed in: your@email". Both receiving and sending then use this token.
 
 **Caveats**:
 
 - Enterprise tenants may additionally require an admin to enable **IMAP** and **SMTP AUTH** for the mailbox in the Exchange admin center. The typical symptom of SMTP AUTH being off: receiving works fine, sending is rejected.
-- The token is bound to the application ID that issued it: changing `clientId` is treated as "switched apps" and requires re-login (this is intentional — it prevents using the old app's credentials against the new one).
+- The token is bound to the application ID that issued it: changing `clientId` is treated as "switched apps" and requires re-login (this is intentional — it prevents using the old app's credentials against the new one). The bundled app is shared by every account that names none: a future release that replaces it with the project's own registration will ask those accounts to sign in once more.
 - If your tenant is hybrid or on-premises and SMTP AUTH is still enabled, app passwords work: select "Password / authorization code" in the card's "Authentication method" selector — no OAuth2 needed.
 
 ## Known limitations
 
-- **OAuth2 covers Outlook / Exchange Online only, and requires your own app ID**: device-code login supports both IMAP and SMTP, but the plugin **bundles no third-party app registration** — OAuth2 accounts must supply their own `clientId` (free to register; see "Outlook OAuth2" above). Other environments that mandate OAuth (e.g. Google Workspace) remain unusable; use the provider's app-specific password / authorization code instead.
+- **OAuth2 covers Outlook / Exchange Online only, and works out of the box (your own app ID optional)**: device-code login supports both IMAP and SMTP and defaults to the bundled community application (see "Outlook OAuth2" above), so no registration is needed to sign in; if your organisation refuses third-party apps, paste your own `clientId` into the card to override it. Other environments that mandate OAuth (e.g. Google Workspace) remain unusable; use the provider's app-specific password / authorization code instead.
 - **Search match counts**: server hits are re-checked against the envelopes (see `email_search` above); when they hold up, "N matches" is the count the server reported while every listed row really carries the keyword. The local body-scan fallback only looked at the newest `bodySearchLimit` messages, so it renders "N rows on this page (only the newest N scanned)" instead of "N matches".
 - **Body search**: the server side only searches subject / from / to / cc. Most servers (e.g. QQ) have unreliable IMAP `TEXT` / `HEADER` search, so with no results it falls back to a body scan of the most recent `bodySearchLimit` messages (slower; disable with `bodySearchFallback`).
 - **Attachments**: inline images aren't downloadable separately yet; a failed attachment match errors instead of downloading the wrong file (safe default).

package/README.md

@@ -45,12 +45,16 @@ IMAP/SMTP email tools for DeepSeek Harness, with replies, forwarding, mailbox or
 
 ### 版本记录
 
+- **0.13.2（2026-09-21）**：同名附件优先按真实 MIME 分段编号下载；旧解析元数据按一对一匹配，避免多个序号都取到第一个同名文件。保留正文分段下载和附件索引缓存，新增文件字节级回归，268 项测试通过。
+- **0.13.1（2026-09-19）**：内置一份社区公共客户端注册（感谢 [gurio-wine](https://github.com/gurio-wine)），Outlook / Exchange Online 的 OAuth2 登录开箱即用；想用自己的应用仍可填 `clientId` 覆盖，设置页会显示当前生效的是哪个应用。测试 264 项。
 - **0.13.0（2026-09-18）**：修复长正文截断成空、`email_watch` 永久漏报新邮件、附件缓存跨 UIDVALIDITY 失效；10 个工具声明超时；读信/搜索只下正文分段；搜索回退标明扫描口径。测试 262 项。
 - **0.12.0（2026-09-18）**：新增发送别名（`senderName` / `authUser` / `authPassword`）与 `email_search` 的 `offset` 翻页；修复 QQ 搜索假命中；弹窗轮询按页面可见性节流。
 - **0.11.0（2026-09-18）**：合入 gurio-wine 的设置页四连（卡片编辑器 / OAuth2 设备码登录 / 双语面板 / `authKind` 钉住），并修掉评审发现的 SMTP OAuth2、设置路由同源校验等问题。
 - **0.10.8 及更早**：见 [CHANGELOG.md](CHANGELOG.md)。
 ## 兼容性
 
+2026-09-21：当前发布包经官方 CLI 安装到隔离 profile，在源码构建的 Harness `0.1.6-alpha.2` 上与另外两个下载量前三插件共同加载，18 个插件工具注册正常；日历/邮件配置自检、PPT 主题查询和 17 行表格生成通过。测试本体基于官方 alpha.2 发布提交，另含工具调度器 `Symbol.for` 修复（`93badd88`）。本轮未连接真实邮箱或日历服务。
+
 2026-09-16 曾在官方源码构建的 Harness `0.1.5-rc.2` 和 `0.1.6-alpha.1` 上完成同载验证：18 个组件与 ModLens 同载，工具 schema、技能注册及离线只读调用检查通过。
 
 **0.11.0 的同载验证（2026-09-18，本地构建的 Harness `0.1.5-rc.2`，`web` profile）**：插件挂载无报错；设置路由 GET 返回 200 且响应中已无 `raw` 字段；用 `text/plain` 发 POST 被 **415** 拒绝（同源守卫在真实宿主下生效）；`application/json` 的 POST 下卡片投影正确，账号钉住 `authKind: password` 后 `authKindDeclared` 与 `authKind` 均为 `password`；设置面板实际渲染出账号卡片、8 个服务商预设的中文下拉、「认证方式」三态选择器、「应用（客户端）ID」输入格与提示、未填 ID 时的警示条（说明 `--dsw-alias-state-warn-primary` 在真实宿主下确有定义）与「登录 Microsoft 账号」按钮；浏览器控制台无报错；save 全链路可用，验证结束后已把 `accountsYaml` 还原为空、原有账号恢复。离线测试 231 项全绿。**仍未做**：真实 Outlook 租户的 OAuth2 端到端（设备码流程要真人在浏览器完成授权）与真实发信未测，`clientId` 相关路径目前只有假 authority 的用例覆盖。采用 `cordis.patch.yml` + `dsh.bundle.patch` 组合包模型。Node 要求为 22.19 及以上的 22.x，或 24 及以上。外部服务的实际业务操作需按各组件配置单独验证。
@@ -65,7 +69,7 @@ IMAP/SMTP email tools for DeepSeek Harness, with replies, forwarding, mailbox or
 dsh plugin --profile web add dsh-email
 ```
 
-（或从 GitHub 安装：`dsh plugin --profile web add github:你的账号/dsh-email#<commit>`，随后按提示在 profile 的 `pnpm-workspace.yaml` 里授权 `prepare` 构建。）
+（或从 GitHub 安装指定提交：`dsh plugin --profile web add github:STARDUSTLC666/dsh-email#<commit>`。仓库已包含 `lib/` 构建产物，无需 `prepare` 构建。）
 
 装好后重启 `dsh web`。插件自带空配置，**不会弄崩启动**；配置前调用任何 email 工具都会返回明确的配置提示。
 
@@ -171,7 +175,7 @@ dsh plugin --profile web remove dsh-email
 | `maxBodyChars` | `20000` | email_read 正文截断上限（1000–200000） |
 | `accounts` | 无 | 具名账号表；账号级字段覆盖顶层简写 |
 | `accountsYaml` | 无 | 账号映射的 YAML 文本，由设置页的卡片编辑器写入；非空时覆盖 accounts |
-| `clientId` | 无 | OAuth2 账号的应用（客户端）ID；账号级可覆盖顶层简写。插件不内置任何第三方注册，Outlook / Exchange Online 走 OAuth2 时必填（见「Outlook OAuth2」） |
+| `clientId` | 内置社区应用（见下） | OAuth2 账号的应用（客户端）ID：留空即用插件内置的公共客户端，填了则覆盖内置值（账号级也可覆盖顶层简写） |
 | `authKind` | 按 provider 派生 | 认证方式覆盖，取值 `oauth2` / `password`。缺省时按 provider 与 IMAP 主机派生；仍能用应用密码连 Exchange Online 的混合或本地租户可钉 `password`。设置页卡片的「认证方式」选择器即写此键 |
 | `serverPresets` | 无 | 自定义服务商预设的 YAML 文本（键=预设名，值含 `label?`/`imap`/`smtp`）；只存端点、不含凭证，设置页下拉会列出预设名并把端点预填进账号卡片，改预设不会重连已建立的连接 |
 | `defaultAccount` | 单账号时自动 | 工具省略 account 参数时使用的账号（多账号必填） |
@@ -201,9 +205,9 @@ dsh plugin --profile web remove dsh-email
 
 微软已经对 Exchange Online 关闭了用户名+密码的 basic auth：个人 outlook.com 与绝大多数租户现在只能用 OAuth2。本插件支持设备码（device code）流程，IMAP 与 SMTP 双端共用同一份 token，过期自动刷新。
 
-**为什么不内置一个应用 ID**：客户端 ID 是"某个人的应用注册"。如果插件自带一个，微软同意屏上显示的会是别人的应用名（企业安全团队通常直接拒授权），登录日志与 telemetry 会归到对方租户（含你的 UPN），而对方哪天删掉这个应用，所有用户的登录会同时失败——报出来的还只是一句"clientId 可能填错了"。所以本插件**不携带任何第三方注册**，请用自己的（免费，约 10 分钟）。
+**内置的应用 ID 是哪来的**：设备码登录必须先有一个"应用注册"，而让每个用户自己注册一次实在太麻烦——所以插件内置了一份：`15dcd5aa-00dd-487f-82d7-1d2b2c299e14`，由贡献者 [gurio-wine](https://github.com/gurio-wine) 在 [PR #13](https://github.com/STARDUSTLC666/dsh-email/pull/13) 注册，并授权本项目内置使用，在此致谢。代价也要说清楚：微软同意屏上显示的是**他的应用名**（企业安全团队可能因此拒绝授权），登录日志与 telemetry 会归到**他的租户**（含你的 UPN）；哪天他删掉这个应用，所有没填自己 ID 的账号会同时登不上，报错还只是一句"clientId 可能填错了"。**想完全自主就注册一个自己的（免费，约 10 分钟）填进卡片覆盖内置值；留空则一直用内置的。**
 
-**注册一个公共客户端**：
+**换成自己的应用（可选，免费，约 10 分钟）**：
 
 1. 打开 [Entra 管理中心](https://entra.microsoft.com/) → **应用注册（App registrations）** → **新注册**。
 2. **受支持的账户类型**选「任何组织目录中的账户 **以及** 个人 Microsoft 账户」——这一项决定了个人 outlook.com 能不能登录，选错会报 `AADSTS700016` 或 `AADSTS50020`。
@@ -212,19 +216,19 @@ dsh plugin --profile web remove dsh-email
 5. 左侧 **身份验证** → 页面最下方 **允许公共客户端流** 设为 **是** 并保存。不开这一项，登录会报 `AADSTS700028` 之类的"未开启设备码流"错误。
 6. 左侧 **API 权限** → 添加权限 → Microsoft Graph → **委托的权限**，勾上 `IMAP.AccessAsUser.All`、`SMTP.Send`、`offline_access`（最后这个是拿到 refresh token 的关键，少了它每次过期都要重新登录）。个人租户一般无需管理员同意；企业租户可能需要管理员点一次「授予同意」。
 
-**填进插件**：设置页 → 邮件 (dsh-email) → 该账号卡片的「应用（客户端）ID」栏；或者写在 YAML 里（账号级 `clientId`，也可写在顶层作为所有账号的默认）。
+**填进插件（覆盖内置值）**：设置页 → 邮件 (dsh-email) → 该账号卡片的「应用（客户端）ID」栏（卡片会显示当前生效的是哪个应用；留空即继续用内置的社区应用）；或者写在 YAML 里（账号级 `clientId`，也可写在顶层作为所有账号的默认）。
 
 **登录**：卡片上点「登录 Microsoft 账号」→ 面板给出一个 `microsoft.com/devicelogin` 链接和一段代码 → 在浏览器打开链接、输入代码、完成授权 → 面板轮询到成功后即显示「已登录：你的地址」。之后收信与发信都用这份 token。
 
 **注意事项**：
 
 - 企业租户可能还需要管理员在 Exchange 管理中心开启该邮箱的 **IMAP** 与 **SMTP AUTH**。没开 SMTP AUTH 时的典型症状是：收信一切正常，发信被拒。
-- token 与签发它的应用 ID 绑定：换了 `clientId` 会被判为"换了应用"，需要重新登录（这是有意的，避免拿旧应用的凭据去撞新应用）。
+- token 与签发它的应用 ID 绑定：换了 `clientId` 会被判为"换了应用"，需要重新登录（这是有意的，避免拿旧应用的凭据去撞新应用）。内置应用是所有没填 `clientId` 的账号共用的一份：将来某个版本把它换成项目自己的注册时，这些账号也会需要重新登录一次。
 - 如果你的租户是混合或本地部署、SMTP AUTH 仍然开着，用应用密码也能连：在卡片的「认证方式」里选「密码 / 授权码」即可，不必走 OAuth2。
 
 ## 已知限制
 
-- **OAuth2 仅覆盖 Outlook / Exchange Online，且需自带应用 ID**：设备码登录已支持 IMAP 与 SMTP 双端，但插件**不内置任何第三方应用注册**，OAuth2 账号必须填自己的 `clientId`（免费注册，见上文「Outlook OAuth2」）。Google Workspace 等其它强制 OAuth 的环境仍不可用，只能用服务商的应用专用密码 / 授权码。
+- **OAuth2 仅覆盖 Outlook / Exchange Online（开箱即用，也可自带应用 ID）**：设备码登录已支持 IMAP 与 SMTP 双端，默认使用插件内置的社区应用（见上文「Outlook OAuth2」），无需自己注册即可登录；企业策略不接受第三方应用时，在卡片里填自己的 `clientId` 覆盖。Google Workspace 等其它强制 OAuth 的环境仍不可用，只能用服务商的应用专用密码 / 授权码。
 - **搜索的匹配数**：服务器命中会先用信封复核（见上文 `email_search`）；复核通过时「共 N 条匹配」沿用服务器给出的条数，而列出的每一行都保证真的带关键词。正文回退扫描只看了最近 `bodySearchLimit` 封，不知道全文件夹匹配数，因此渲染为「本页 N 条（仅扫描最近 N 封）」而不是「共 N 条」。
 - **正文搜索**：服务器端只搜 subject / from / to / cc；多数服务器（如 QQ）的 IMAP `TEXT` / `HEADER` 搜索不可靠，无结果时回退到最近 `bodySearchLimit` 封的正文扫描（较慢，可用 `bodySearchFallback` 关闭）。
 - **附件**：内嵌图片暂不支持单独下载；附件定位失败会直接报错而不是下载错误文件（安全默认）。

package/lib/client.js

@@ -332,8 +332,9 @@ var UI = {
     // OAuth2 登录区
     "oauth.clientIdLabel": "应用（客户端）ID",
     "oauth.clientIdPlaceholder": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
-    "oauth.clientIdHint": "本插件不内置任何第三方应用注册，请用自己注册的 Azure（Entra）公共客户端 ID：免费，需勾选 IMAP/SMTP 委托权限并开启设备码流，步骤见 README 的「Outlook OAuth2」一节。改动它需要重新登录。",
-    "oauth.clientIdMissing": "还没填应用（客户端）ID，设备码登录无法开始：按下面的提示注册一个，填进来即可。",
+    "oauth.clientIdHint": "留空即用插件内置的社区应用（免费、开箱即用）：微软同意屏上显示的是贡献者的应用名，登录日志也归到对方租户。想换成自己的 Azure（Entra）公共客户端 ID（需勾选 IMAP/SMTP 委托权限并开启设备码流）就填进来，改动它需要重新登录。",
+    "oauth.clientIdMissing": "当前构建没有内置应用（客户端）ID，设备码登录无法开始：按 README 的「Outlook OAuth2」一节注册一个，填进来即可。",
+    "oauth.clientIdBuiltIn": "将使用插件内置的社区应用：{id}（贡献者 gurio-wine 注册并授权本项目内置使用）。企业策略不接受第三方应用时，请换成自己的。",
     "oauth.passwordless": "这个服务商使用 OAuth2 授权，不需要密码{label}。",
     "oauth.passwordlessLabel": "（{label}）",
     "oauth.signIn.outlook": "登录 Microsoft 账号",
@@ -510,8 +511,9 @@ var UI = {
     // OAuth2 登录区
     "oauth.clientIdLabel": "Application (client) ID",
     "oauth.clientIdPlaceholder": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
-    "oauth.clientIdHint": "This plugin ships no third-party application registration, so use your own Azure (Entra) public client ID: free, with the IMAP/SMTP delegated permissions and the device-code flow enabled. The README's「Outlook OAuth2」section walks through it. Changing it requires signing in again.",
-    "oauth.clientIdMissing": "No application (client) ID yet, so the device-code login cannot start: register one as described below and paste it here.",
+    "oauth.clientIdHint": "Leave this empty to log in with the plugin's built-in community application (free, nothing to set up): the Microsoft consent screen names the contributor's app and the sign-in logs land in their tenant. Paste your own Azure (Entra) public client ID here (with the IMAP/SMTP delegated permissions and the device-code flow enabled) to use that instead; changing it requires signing in again.",
+    "oauth.clientIdMissing": "This build carries no built-in application (client) ID, so the device-code login cannot start: register one as described in the README's「Outlook OAuth2」section and paste it here.",
+    "oauth.clientIdBuiltIn": "Signing in through the plugin's built-in community application: {id} (registered by contributor gurio-wine, used with permission). Use your own application if third-party apps are not allowed.",
     "oauth.passwordless": "This provider authorizes over OAuth2, so no password is needed{label}.",
     "oauth.passwordlessLabel": " ({label})",
     "oauth.signIn.outlook": "Sign in with Microsoft",
@@ -764,6 +766,11 @@ function draftFromCard(card) {
     senderName: card.senderName === undefined || card.senderName === null ? "" : String(card.senderName),
     authUser: card.authUser === undefined || card.authUser === null ? "" : String(card.authUser),
     clientId: card.clientId === undefined || card.clientId === null ? "" : String(card.clientId),
+    // 卡片只在账号自己的 clientId 为空时报内置值：它是「留空会用哪个应用」的答案，
+    // 不是账号的字段，所以既不进 YAML，也不参与三态写入。
+    defaultClientId: card.oauthDefaultClientId === undefined || card.oauthDefaultClientId === null
+      ? ""
+      : String(card.oauthDefaultClientId),
     // authKind 是生效裁决（决定显示登录区还是密码框），authKindSetting 是用户钉住
     // 了什么（'' = 自动）。两者必须分开：都从裁决读的话，「自动」与「显式密码」在
     // 编辑器里长得一样，那条给混合/本地租户留的退路就没法从面板操作。
@@ -1180,9 +1187,11 @@ function OauthLoginPanel(props) {
   const disabled = props.disabled === true;
   const label = props.providerLabel || draft.provider || "OAuth2";
 
-  // 插件不内置任何第三方应用注册，所以「用哪个应用登录」是账号自己的配置项，
-  // 面板是用户唯一的常规入口。它不是机密（公共客户端 ID 每次都随请求发出），
-  // 因此可以直接回填、直接编辑。
+  // 「用哪个应用登录」是账号自己的配置项，面板是用户唯一的常规入口。它不是机密
+  // （公共客户端 ID 每次都随请求发出），因此可以直接回填、直接编辑。留空不是
+  // 「没配置」：插件自带一份社区注册，所以这里必须说清生效的到底是哪个应用 ——
+  // 同意屏上写的名字不是账号主人自己的，这件事不该等点了登录才发现。
+  const builtInClientId = String(draft.defaultClientId || "").trim();
   const clientIdField = () => h("div", { className: "dshe-field dshe-oauth-client" }, [
     h("label", null, t("oauth.clientIdLabel")),
     h("input", {
@@ -1190,10 +1199,13 @@ function OauthLoginPanel(props) {
       value: String(draft.clientId || ""),
       disabled: disabled,
       spellcheck: "false",
-      placeholder: t("oauth.clientIdPlaceholder"),
+      placeholder: builtInClientId !== "" ? builtInClientId : t("oauth.clientIdPlaceholder"),
       onChange: (e) => { if (props.onClientId) props.onClientId(e.target.value); },
     }),
     h("div", { className: "dshe-hint" }, t("oauth.clientIdHint")),
+    String(draft.clientId || "").trim() === "" && builtInClientId !== ""
+      ? h("div", { className: "dshe-hint dshe-oauth-builtin" }, t("oauth.clientIdBuiltIn", { id: builtInClientId }))
+      : null,
   ]);
 
   if (state === "pending") {
@@ -1263,7 +1275,7 @@ function OauthLoginPanel(props) {
     h("div", { className: "dshe-oauth-head" },
       t("oauth.passwordless", { label: label ? t("oauth.passwordlessLabel", { label }) : "" })),
     clientIdField(),
-    String(draft.clientId || "").trim() === ""
+    String(draft.clientId || "").trim() === "" && builtInClientId === ""
       ? h("div", { className: "dshe-alert warn" }, t("oauth.clientIdMissing"))
       : null,
     h("div", { className: "dshe-oauth-actions" }, [

package/lib/config.d.ts

@@ -18,23 +18,27 @@ export declare const OUTLOOK_PROVIDER = "outlook";
 /** The Exchange Online IMAP host. Any account dialling it is an OAuth2 account. */
 export declare const OUTLOOK_IMAP_HOST = "outlook.office365.com";
 /**
- * The built-in default client id for the device-code flow: deliberately empty.
+ * The built-in client id for the device-code flow: a community registration.
  *
- * An earlier revision shipped a registration belonging to a contributor. That
- * cannot be right for a package thousands of strangers install: the Microsoft
- * consent screen would name someone else's application (which enterprise
- * security teams refuse), the sign-in logs and telemetry would land in their
- * tenant along with the user's UPN, and their deleting the app would break
- * every login at once — with an error that only says the client id「可能填错了」,
- * so no user could diagnose it.
+ * Requiring every Outlook user to register an application of their own puts a
+ * setup wall in front of the one provider where OAuth2 cannot be avoided, so
+ * the plugin ships one. The id below is the public-client registration
+ * contributed by gurio-wine (PR #13) and used with their permission; the README
+ * credits them and states the two things that follow from using somebody
+ * else's application: the consent screen names *their* app, and the sign-in
+ * logs land in *their* tenant along with the user's UPN.
  *
- * Nothing third-party is baked in, so an account supplies its own `clientId`
- * (a free Entra public-client registration; the README walks through it) and
- * `startDeviceFlow` refuses with an actionable message until one is set. A
- * maintainer who registers an application for this project restores the
- * out-of-box experience by filling in this one constant.
+ * An account that wants neither — an enterprise that refuses third-party apps,
+ * or a day when this registration is gone — sets its own `clientId` (a free
+ * Entra public-client registration) and that value wins over this constant.
+ * The settings card shows which application is in effect either way, so nobody
+ * consents to an app they were not told about.
+ *
+ * Replacing this constant is the whole change a maintainer makes to ship the
+ * project's own application instead. Tokens are bound to the id that issued
+ * them, so such a release asks every built-in account to log in one more time.
  */
-export declare const OUTLOOK_OAUTH2_CLIENT_ID = "";
+export declare const OUTLOOK_OAUTH2_CLIENT_ID = "15dcd5aa-00dd-487f-82d7-1d2b2c299e14";
 /**
  * How an account proves who it is. `password` covers every existing provider
  * (an app password / 授权码) and is the default, so nothing about them changes.

package/lib/config.js

@@ -13,23 +13,27 @@ export const OUTLOOK_PROVIDER = 'outlook';
 /** The Exchange Online IMAP host. Any account dialling it is an OAuth2 account. */
 export const OUTLOOK_IMAP_HOST = 'outlook.office365.com';
 /**
- * The built-in default client id for the device-code flow: deliberately empty.
+ * The built-in client id for the device-code flow: a community registration.
  *
- * An earlier revision shipped a registration belonging to a contributor. That
- * cannot be right for a package thousands of strangers install: the Microsoft
- * consent screen would name someone else's application (which enterprise
- * security teams refuse), the sign-in logs and telemetry would land in their
- * tenant along with the user's UPN, and their deleting the app would break
- * every login at once — with an error that only says the client id「可能填错了」,
- * so no user could diagnose it.
+ * Requiring every Outlook user to register an application of their own puts a
+ * setup wall in front of the one provider where OAuth2 cannot be avoided, so
+ * the plugin ships one. The id below is the public-client registration
+ * contributed by gurio-wine (PR #13) and used with their permission; the README
+ * credits them and states the two things that follow from using somebody
+ * else's application: the consent screen names *their* app, and the sign-in
+ * logs land in *their* tenant along with the user's UPN.
  *
- * Nothing third-party is baked in, so an account supplies its own `clientId`
- * (a free Entra public-client registration; the README walks through it) and
- * `startDeviceFlow` refuses with an actionable message until one is set. A
- * maintainer who registers an application for this project restores the
- * out-of-box experience by filling in this one constant.
+ * An account that wants neither — an enterprise that refuses third-party apps,
+ * or a day when this registration is gone — sets its own `clientId` (a free
+ * Entra public-client registration) and that value wins over this constant.
+ * The settings card shows which application is in effect either way, so nobody
+ * consents to an app they were not told about.
+ *
+ * Replacing this constant is the whole change a maintainer makes to ship the
+ * project's own application instead. Tokens are bound to the id that issued
+ * them, so such a release asks every built-in account to log in one more time.
  */
-export const OUTLOOK_OAUTH2_CLIENT_ID = '';
+export const OUTLOOK_OAUTH2_CLIENT_ID = '15dcd5aa-00dd-487f-82d7-1d2b2c299e14';
 export const PROVIDER_PRESETS = {
     qq: { imap: { host: 'imap.qq.com', port: 993, secure: true }, smtp: { host: 'smtp.qq.com', port: 465, secure: true } },
     '163': { imap: { host: 'imap.163.com', port: 993, secure: true }, smtp: { host: 'smtp.163.com', port: 465, secure: true } },

package/lib/index.d.ts

@@ -6,7 +6,7 @@ export type Config = EmailConfig;
 export declare function apply(ctx: any, config?: Config): void;
 export { clampInt, defaultDownloadDir, EMAIL_PASSWORD_ENV, isOAuth2Account, OUTLOOK_OAUTH2_CLIENT_ID, OUTLOOK_PROVIDER, parseAccountsYaml, parseServerPresets, presetNamesIn, providerNames, PROVIDER_NAMES, resolveEmailConfig, resolveEmailSettings, serializeAccountsYaml } from './config.js';
 export type { AuthKind, ResolvedEmailConfig } from './config.js';
-export { ACCESS_TOKEN_MARGIN_MS, classifyOAuthFailure, clearTokenFor, DEVICE_CODE_URL, getFreshAccessToken, mapAadstsMessage, NO_CLIENT_ID_MESSAGE, NOT_LOGGED_IN_MESSAGE, oauth2StateOf, oauth2TokenFile, OAUTH2_SCOPES, OAuth2Error, pollDeviceFlow, readTokenStore, startDeviceFlow, TOKEN_URL, writeTokenStore, } from './oauth2.js';
+export { ACCESS_TOKEN_MARGIN_MS, classifyOAuthFailure, clearTokenFor, clientIdOf, DEVICE_CODE_URL, getFreshAccessToken, mapAadstsMessage, NO_CLIENT_ID_MESSAGE, NOT_LOGGED_IN_MESSAGE, oauth2StateOf, oauth2TokenFile, OAUTH2_SCOPES, OAuth2Error, pollDeviceFlow, readTokenStore, startDeviceFlow, TOKEN_URL, writeTokenStore, } from './oauth2.js';
 export type { DeviceFlowStart, OAuth2PollResult, OAuth2State, OAuth2TokenEntry, OAuth2TokenStore } from './oauth2.js';
 export { buildReplyMessage, EmailPool, extractMessageIds, imapAuthOf, looksLikeAuthFailure, MailError, messageMatchesQuery, messageOf, OAUTH2_RELOGIN_MESSAGE, redactCredentials, selectAttachmentPart, smtpAuthOf, validateAttachmentPaths } from './mail-client.js';
 export { flattenAddresses, parseRawMessage, sanitizeFilename, stripHtml, truncateText } from './parse.js';

package/lib/index.js

@@ -15,7 +15,7 @@ export function apply(ctx, config = {}) {
     installSendApproval(ctx, runtime);
 }
 export { clampInt, defaultDownloadDir, EMAIL_PASSWORD_ENV, isOAuth2Account, OUTLOOK_OAUTH2_CLIENT_ID, OUTLOOK_PROVIDER, parseAccountsYaml, parseServerPresets, presetNamesIn, providerNames, PROVIDER_NAMES, resolveEmailConfig, resolveEmailSettings, serializeAccountsYaml } from './config.js';
-export { ACCESS_TOKEN_MARGIN_MS, classifyOAuthFailure, clearTokenFor, DEVICE_CODE_URL, getFreshAccessToken, mapAadstsMessage, NO_CLIENT_ID_MESSAGE, NOT_LOGGED_IN_MESSAGE, oauth2StateOf, oauth2TokenFile, OAUTH2_SCOPES, OAuth2Error, pollDeviceFlow, readTokenStore, startDeviceFlow, TOKEN_URL, writeTokenStore, } from './oauth2.js';
+export { ACCESS_TOKEN_MARGIN_MS, classifyOAuthFailure, clearTokenFor, clientIdOf, DEVICE_CODE_URL, getFreshAccessToken, mapAadstsMessage, NO_CLIENT_ID_MESSAGE, NOT_LOGGED_IN_MESSAGE, oauth2StateOf, oauth2TokenFile, OAUTH2_SCOPES, OAuth2Error, pollDeviceFlow, readTokenStore, startDeviceFlow, TOKEN_URL, writeTokenStore, } from './oauth2.js';
 export { buildReplyMessage, EmailPool, extractMessageIds, imapAuthOf, looksLikeAuthFailure, MailError, messageMatchesQuery, messageOf, OAUTH2_RELOGIN_MESSAGE, redactCredentials, selectAttachmentPart, smtpAuthOf, validateAttachmentPaths } from './mail-client.js';
 export { flattenAddresses, parseRawMessage, sanitizeFilename, stripHtml, truncateText } from './parse.js';
 export { EmailSettingsSchema, SETTINGS_NAMESPACE, toEmailConfig, toSettingsBase, validateSettingsValue } from './settings.js';

package/lib/mail-client.d.ts

@@ -69,9 +69,9 @@ interface AttachmentPart {
 }
 /**
  * Map the index in the mailparser attachment list (what email_read showed the
- * model) onto a bodyStructure part. Name first, then type + tolerant size;
- * an inline image that our walk excludes simply fails instead of downloading
- * the wrong part.
+ * model) onto a bodyStructure part. Real IMAP section ids are authoritative.
+ * Legacy mailparser indexes need one-to-one name/type/size matching so duplicate
+ * filenames cannot repeatedly select the first attachment.
  */
 export declare function selectAttachmentPart(readAttachments: EmailAttachmentMeta[], parts: AttachmentPart[], index: number): AttachmentPart | undefined;
 /** Case-insensitive match of a query against subject/from/body text. */

package/lib/mail-client.js

@@ -103,20 +103,38 @@ function collectAttachmentParts(node, out = []) {
 }
 /**
  * Map the index in the mailparser attachment list (what email_read showed the
- * model) onto a bodyStructure part. Name first, then type + tolerant size;
- * an inline image that our walk excludes simply fails instead of downloading
- * the wrong part.
+ * model) onto a bodyStructure part. Real IMAP section ids are authoritative.
+ * Legacy mailparser indexes need one-to-one name/type/size matching so duplicate
+ * filenames cannot repeatedly select the first attachment.
  */
 export function selectAttachmentPart(readAttachments, parts, index) {
     const meta = readAttachments[index];
     if (meta === undefined)
         return undefined;
-    const byName = parts.find(part => part.filename === meta.filename || sanitizeFilename(part.filename) === meta.filename);
-    if (byName !== undefined)
-        return byName;
-    const tolerance = Math.max(64, Math.ceil(meta.size * 0.5));
-    const byTypeAndSize = parts.find(part => part.contentType === meta.contentType && Math.abs(part.size - meta.size) <= tolerance);
-    return byTypeAndSize;
+    const hasSectionId = (item) => /^\d+(?:\.\d+)*$/.test(item.part);
+    if (hasSectionId(meta))
+        return parts.find(part => part.part === meta.part);
+    const used = new Set();
+    // Reserve exact identities even if mixed with older parsed metadata.
+    for (const item of readAttachments)
+        if (hasSectionId(item))
+            used.add(item.part);
+    for (let position = 0; position <= index; position++) {
+        const item = readAttachments[position];
+        if (hasSectionId(item))
+            continue;
+        const available = parts.filter(part => !used.has(part.part));
+        const sameName = (part) => part.filename === item.filename || sanitizeFilename(part.filename) === item.filename;
+        const tolerance = Math.max(64, Math.ceil(item.size * 0.5));
+        const sameTypeAndSize = (part) => part.contentType === item.contentType && Math.abs(part.size - item.size) <= tolerance;
+        const match = available.find(part => sameName(part) && sameTypeAndSize(part))
+            ?? available.find(sameName) ?? available.find(sameTypeAndSize);
+        if (position === index)
+            return match;
+        if (match !== undefined)
+            used.add(match.part);
+    }
+    return undefined;
 }
 /**
  * Leaf text/* parts that can carry the message body, attachment parts excluded.

package/lib/oauth2.d.ts

@@ -17,11 +17,12 @@ export declare const OAUTH2_REQUEST_TIMEOUT_MS = 15000;
 /** The one message every「no token yet」path reports, so the fix is always the same. */
 export declare const NOT_LOGGED_IN_MESSAGE = "\u5C1A\u672A\u767B\u5F55\uFF1A\u8BF7\u5148\u5728\u8BBE\u7F6E\u9875\u5B8C\u6210\u8BBE\u5907\u7801\u767B\u5F55";
 /**
- * Reported when an OAuth2 account has no application to log in through. The
- * plugin ships no third-party registration, so this is a setup step, not a
- * failure — and it says where to go and what to type.
+ * Reported when an OAuth2 account has nothing to log in through. The packaged
+ * build carries a community registration (OUTLOOK_OAUTH2_CLIENT_ID), so this
+ * only surfaces in a build that blanks it, or on an account whose own id was
+ * cleared while the built-in one is gone — it still says what to type.
  */
-export declare const NO_CLIENT_ID_MESSAGE = "\u5C1A\u672A\u914D\u7F6E OAuth2 \u5E94\u7528\uFF1A\u8BF7\u5728\u8BBE\u7F6E\u9875\u8BE5\u8D26\u53F7\u7684\u300C\u5E94\u7528\uFF08\u5BA2\u6237\u7AEF\uFF09ID\u300D\u91CC\u586B\u5165\u4F60\u81EA\u5DF1\u6CE8\u518C\u7684 Azure \u516C\u5171\u5BA2\u6237\u7AEF ID\uFF08\u514D\u8D39\uFF0C\u6CE8\u518C\u6B65\u9AA4\u89C1 README \u7684\u300COutlook OAuth2\u300D\u4E00\u8282\uFF09\u3002\u672C\u63D2\u4EF6\u4E0D\u5185\u7F6E\u4EFB\u4F55\u7B2C\u4E09\u65B9\u5E94\u7528\u6CE8\u518C\uFF0C\u56E0\u6B64\u6CA1\u6709\u5B83\u5C31\u65E0\u6CD5\u5F00\u59CB\u8BBE\u5907\u7801\u767B\u5F55";
+export declare const NO_CLIENT_ID_MESSAGE = "\u5C1A\u672A\u914D\u7F6E OAuth2 \u5E94\u7528\uFF1A\u5F53\u524D\u6784\u5EFA\u6CA1\u6709\u5185\u7F6E\u516C\u5171\u5BA2\u6237\u7AEF ID\uFF0C\u8BF7\u5728\u8BBE\u7F6E\u9875\u8BE5\u8D26\u53F7\u7684\u300C\u5E94\u7528\uFF08\u5BA2\u6237\u7AEF\uFF09ID\u300D\u91CC\u586B\u5165\u4E00\u4E2A\uFF08\u514D\u8D39\u6CE8\u518C\uFF0C\u6B65\u9AA4\u89C1 README \u7684\u300COutlook OAuth2\u300D\u4E00\u8282\uFF09\uFF0C\u5426\u5219\u65E0\u6CD5\u5F00\u59CB\u8BBE\u5907\u7801\u767B\u5F55";
 /** Where the refresh/access tokens live. Kept out of the settings namespace on purpose. */
 export declare function oauth2TokenFile(): string;
 export interface OAuth2TokenEntry {

package/lib/oauth2.js

@@ -44,11 +44,12 @@ export const OAUTH2_REQUEST_TIMEOUT_MS = 15000;
 /** The one message every「no token yet」path reports, so the fix is always the same. */
 export const NOT_LOGGED_IN_MESSAGE = '尚未登录：请先在设置页完成设备码登录';
 /**
- * Reported when an OAuth2 account has no application to log in through. The
- * plugin ships no third-party registration, so this is a setup step, not a
- * failure — and it says where to go and what to type.
+ * Reported when an OAuth2 account has nothing to log in through. The packaged
+ * build carries a community registration (OUTLOOK_OAUTH2_CLIENT_ID), so this
+ * only surfaces in a build that blanks it, or on an account whose own id was
+ * cleared while the built-in one is gone — it still says what to type.
  */
-export const NO_CLIENT_ID_MESSAGE = '尚未配置 OAuth2 应用：请在设置页该账号的「应用（客户端）ID」里填入你自己注册的 Azure 公共客户端 ID（免费，注册步骤见 README 的「Outlook OAuth2」一节）。本插件不内置任何第三方应用注册，因此没有它就无法开始设备码登录';
+export const NO_CLIENT_ID_MESSAGE = '尚未配置 OAuth2 应用：当前构建没有内置公共客户端 ID，请在设置页该账号的「应用（客户端）ID」里填入一个（免费注册，步骤见 README 的「Outlook OAuth2」一节），否则无法开始设备码登录';
 /** Where the refresh/access tokens live. Kept out of the settings namespace on purpose. */
 export function oauth2TokenFile() {
     const home = process.env.DSH_HOME ?? join(homedir(), '.dsh');

package/lib/web.d.ts

@@ -36,10 +36,18 @@ export interface AccountCardData {
      * The application (client) id this account logs in through. Unlike a password
      * this is not a secret — a public-client id travels in every device-code
      * request — so the card carries the value itself and the editor can prefill
-     * it. Omitted when the account has none, which for an OAuth2 account is
-     * exactly the state that has to be fixed before login can start.
+     * it. Omitted when the account names none, which means the built-in
+     * registration below is the application that will be used.
      */
     clientId?: string;
+    /**
+     * The application the login falls back to when the account names none: the
+     * community registration the plugin ships. Carried on the card so the editor
+     * can show which app the consent screen is about to name, instead of leaving
+     * the user to guess — and so「no id of its own」stops looking like an error
+     * that has to be fixed before a login can even start.
+     */
+    oauthDefaultClientId?: string;
     /** Display name for the From header, when the account sets one. */
     senderName?: string;
     /** Login user when it differs from the visible address (`user`). */
@@ -79,8 +87,8 @@ export interface AccountCardInput {
     password?: string | number | boolean;
     /**
      * OAuth2 应用（客户端）ID，三态契约与 password 相同：undefined = 本卡片没提供
-     * （保留 YAML 里已存的 clientId 键），'' = 明确清除，非空 = 写入。插件不内置任何
-     * 第三方应用注册，所以这是 OAuth2 账号的必填项，而设置面板是用户唯一的常规入口。
+     * （保留 YAML 里已存的 clientId 键），'' = 明确清除（回到内置的社区应用），非空 =
+     * 写入。留空不等于不能用：内置注册就是默认值，这一栏是把默认值换成自己的应用。
      */
     clientId?: string;
     /**

package/lib/web.js

@@ -3,7 +3,7 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { isMap, parseDocument } from 'yaml';
 import { SETTINGS_NAMESPACE, toEmailConfig, validateSettingsValue } from './settings.js';
-import { isOAuth2Account, parseAccountsYaml, parseServerPresets, presetNamesIn, PROVIDER_PRESETS, resolveEmailSettings, serializeAccountsYaml, } from './config.js';
+import { isOAuth2Account, OUTLOOK_OAUTH2_CLIENT_ID, parseAccountsYaml, parseServerPresets, presetNamesIn, PROVIDER_PRESETS, resolveEmailSettings, serializeAccountsYaml, } from './config.js';
 import { clearTokenFor, getFreshAccessToken, oauth2StateOf, pollDeviceFlow, startDeviceFlow, } from './oauth2.js';
 import { EmailPool, messageOf, redactCredentials } from './mail-client.js';
 /** Same-origin route the browser settings section talks to. */
@@ -84,9 +84,10 @@ function buildAccountCards(raw, defaultAccount, presets, tokens = () => ({ state
             : isOAuth2Account(providerName, imap.host) ? 'oauth2' : 'password';
         const user = typeof account.user === 'string' ? account.user : '';
         // A public-client id is not a secret, so unlike the password it is handed
-        // back for the editor to prefill: an OAuth2 account without one cannot
-        // start a device-code login, and the card is where that gets fixed.
+        // back for the editor to prefill: an account that names no application logs
+        // in with the built-in one, and the card has to say which that is.
         const clientId = typeof account.clientId === 'string' ? account.clientId.trim() : '';
+        const oauthDefaultClientId = authKind === 'oauth2' && clientId === '' ? OUTLOOK_OAUTH2_CLIENT_ID : '';
         // The display name and the login user are not secrets, so — like clientId —
         // the card hands them back for the editor to prefill. A separate login
         // password is a secret and only ever reported as a boolean.
@@ -102,6 +103,7 @@ function buildAccountCards(raw, defaultAccount, presets, tokens = () => ({ state
             authKind,
             ...(pinned === 'oauth2' || pinned === 'password' ? { authKindDeclared: pinned } : {}),
             ...(clientId !== '' ? { clientId } : {}),
+            ...(oauthDefaultClientId !== '' ? { oauthDefaultClientId } : {}),
             ...(senderName !== '' ? { senderName } : {}),
             ...(authUser !== '' ? { authUser } : {}),
             ...(typeof account.authPassword === 'string' && account.authPassword !== '' ? { hasAuthPassword: true } : {}),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-email",
-  "version": "0.13.0",
-  "description": "DSH 邮件插件：IMAP/SMTP 收发搜索、回复转发、附件与整理，多账号卡片设置页 + Outlook OAuth2 + 发信审批。",
+  "version": "0.13.2",
+  "description": "DSH 邮件插件：IMAP/SMTP 收发搜索、回复转发、附件与整理，多账号卡片设置页、Outlook OAuth2 登录与发信审批。",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",