dsh-email 0.13.2 → 0.14.1

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.14.1（2026-09-27）
+
+- 未补全的账号和服务器预设会显示未保存提示；避免草稿丢失和错误的“已保存”状态。测试连接只校验所选账号，错误直接指向设置页中的对应字段。
+
 > 完整历史（含详细改动说明）。README 只保留最近几个版本的一句话摘要。
 
 ## 中文版

package/README.en.md

@@ -1,5 +1,11 @@
 # dsh-email
 
+## 0.14.1 update (2026-09-27)
+
+Incomplete account and server-preset drafts display an unsaved status and are protected against accidental navigation. Connection tests validate the selected account independently and identify the relevant settings field.
+
+Validation host: Harness 0.1.7-rc.2 built from official sources, retaining the local tool-scheduler fix. Build and automated checks pass; interactive coverage and external-service limits are recorded in this release round.
+
 ![npm](https://img.shields.io/npm/v/dsh-email) ![downloads](https://img.shields.io/npm/dm/dsh-email) ![license](https://img.shields.io/github/license/STARDUSTLC666/dsh-email) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-email?style=social)
 
 [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
@@ -37,6 +43,8 @@ Example:
 
 ### Changelog
 
+- **0.14.0 (2026-09-23)**: supports Harness 0.1.7 settings. Existing mailbox settings migrate automatically and appear as editable cards; edits auto-save and survive refresh and restart. Advanced options and saved passwords are preserved; removing all cards no longer resurrects a hidden legacy account.
+
 - **0.13.2 (2026-09-21)**: download attachments by their real MIME section IDs, fixing duplicate filenames selecting the first file. Legacy parsed metadata matches sections one-to-one. Body-only reads and attachment-index caching remain intact; 268 tests pass, including downloaded-file byte checks.
 - **0.13.1 (2026-09-19)**: ships a community public-client registration (thanks [gurio-wine](https://github.com/gurio-wine)), so Outlook / Exchange Online works out of the box; supply your own `clientId` to override it — the card shows which application is in effect. 264 tests.
 - **0.13.0 (2026-09-18)**: fixes for bodies truncated to nothing, `email_watch` skipping new mail, and the attachment cache ignoring UIDVALIDITY; all ten tools declare a timeout; reads and body search download text parts only; the scan fallback labels its own semantics. 262 tests.
@@ -45,6 +53,8 @@ Example:
 - **0.10.8 and earlier**: see [CHANGELOG.md](CHANGELOG.md).
 ## Compatibility
 
+The current baseline is official-source Harness **0.1.7-alpha.2** (2026-09-23, with a local `Symbol.for` tool-scheduler fix). All 18 plugins load together. Legacy migration, editing and automatic saving in the real Web UI, refresh, revision conflicts and restart persistence have been checked with isolated fixture accounts. No live mailbox connection or sending was exercised in this round.
+
 2026-09-21: the current release package was installed through the official CLI in an isolated profile and co-loaded with the other two most-downloaded plugins on source-built Harness `0.1.6-alpha.2`. All 18 plugin tools registered; calendar/email configuration checks, PPT theme listing and 17-row table generation passed. The host is based on the official alpha.2 release plus the tool-scheduler `Symbol.for` fix (`93badd88`). This run did not connect to live mail or calendar services.
 
 Co-load verification was performed on 2026-09-16 with official source builds of Harness `0.1.5-rc.2` and `0.1.6-alpha.1`: all 18 components load alongside ModLens, with passing tool schemas, skill registration and offline read-only calls.
@@ -53,7 +63,7 @@ Co-load verification was performed on 2026-09-16 with official source builds of
 
 On 2026-09-10, npm `dsh-email@0.10.6` passed real QQ mailbox folder/list/read/search calls, the settings page's connection test and Save & Apply, and separate SMTP authentication. An empty authorization-code field correctly used `DSH_EMAIL_PASSWORD`. This recheck did not connect to a real mailbox or send, modify or delete mail.
 
-Follows the official [plugin packaging and installation requirements](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md): an ESM entry point, prebuilt `lib/`, `dsh.bundle.patch` and a `cordis.patch.yml` layer. The plugin explicitly injects its required services and supplies JSON Schema parameters, canonical output and rendering, with no runtime imports of `@deepseek-ai/*` internals. Use Node 22.19 or later within 22.x, or Node 24 or later. Harness is evolving rapidly; the version above is the tested baseline.
+Follows the official [plugin packaging and installation requirements](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md): an ESM entry point, prebuilt `lib/`, `dsh.bundle.patch` and a `cordis.patch.yml` layer. The plugin explicitly injects its required services and supplies JSON Schema parameters, canonical output and rendering, without importing host-internal services; configuration uses the public `@deepseek-ai/schemastery` package. Use Node 22.19 or later within 22.x, or Node 24 or later. Harness is evolving rapidly; the version above is the tested baseline.
 
 ## Installation
 
@@ -74,7 +84,7 @@ The whole settings page follows DSH's light and dark themes: every panel style r
 
 Multiple accounts can be edited visually in the settings page: account cards add, edit and delete accounts, rename them, pick the default, and run "Test connection" per account name; a half-filled account never blocks saving — it just gets an "incomplete" badge. Card edits are debounced and auto-saved; there is no longer a "write to YAML text, then click save" step. Version conflicts (settings changed elsewhere) are automatically rebased and re-saved once, rather than repeatedly failing with a stale revision. When a card is saved, an already-stored authorization code is kept by default (leave the password field empty to keep it, type into it to overwrite); comments in the YAML are preserved in place where possible — with an explicit notice when they cannot be. Rename re-keys in place, preserving auth codes and advanced keys, and refuses to overwrite an existing account name. Account-level hand-written imap/smtp endpoints are only cleaned when the **provider actually changes** — runtime resolution prefers the account's own host, so a routine save never silently re-points the connection target.
 
-Values saved in the settings page live in the `dsh-email` namespace of `settings.yaml` and override the YAML default-account config. Authorization-code fields are marked secret, but saving a filled field still writes its value to the local settings file. For a single account, set `DSH_EMAIL_PASSWORD` and leave the authorization-code field empty to avoid saving it; the environment value is not copied into settings.
+On Harness 0.1.7, the page saves directly to the current profile’s `tool-email` entry and applies changes live. Installations using the default entry automatically import the retired `dsh-email` section from `settings.yaml` or `settings.yaml.imported` once. Existing profile values win, and the original file is preserved. Older hosts retain their original settings storage. Authorization-code fields are marked secret, but saving a filled field still writes its value to the local settings file. For a single account, set `DSH_EMAIL_PASSWORD` and leave the authorization-code field empty to avoid saving it; the environment value is not copied into settings.
 
 ## Uninstall
 

package/README.md

@@ -2,6 +2,12 @@
 
 # dsh-email
 
+## 0.14.1 更新（2026-09-27）
+
+未补全的账号和服务器预设会显示未保存提示；避免草稿丢失和错误的“已保存”状态。测试连接只校验所选账号，错误直接指向设置页中的对应字段。
+
+验证宿主：官方源码构建的 Harness 0.1.7-rc.2（保留本地工具调度器修复）。构建与自动测试通过；实际操作和外部服务限制见本轮验收记录。
+
 > **让 agent 协助处理邮件**：收发、搜索、回复转发、附件、邮件整理与新邮件提醒，支持八种常见邮箱服务预设。
 
 ![npm version](https://img.shields.io/npm/v/dsh-email?label=npm&color=blue) ![npm downloads](https://img.shields.io/npm/dm/dsh-email) ![license](https://img.shields.io/npm/l/dsh-email) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-email?style=social)
@@ -45,6 +51,8 @@ IMAP/SMTP email tools for DeepSeek Harness, with replies, forwarding, mailbox or
 
 ### 版本记录
 
+- **0.14.0（2026-09-23）**：适配 Harness 0.1.7 设置接口；自动导入旧版邮箱设置，旧账号直接显示为可编辑卡片。编辑即时保存，刷新后保留；保留高级参数与已有密码，清空账号后不再重新出现。
+
 - **0.13.2（2026-09-21）**：同名附件优先按真实 MIME 分段编号下载；旧解析元数据按一对一匹配，避免多个序号都取到第一个同名文件。保留正文分段下载和附件索引缓存，新增文件字节级回归，268 项测试通过。
 - **0.13.1（2026-09-19）**：内置一份社区公共客户端注册（感谢 [gurio-wine](https://github.com/gurio-wine)），Outlook / Exchange Online 的 OAuth2 登录开箱即用；想用自己的应用仍可填 `clientId` 覆盖，设置页会显示当前生效的是哪个应用。测试 264 项。
 - **0.13.0（2026-09-18）**：修复长正文截断成空、`email_watch` 永久漏报新邮件、附件缓存跨 UIDVALIDITY 失效；10 个工具声明超时；读信/搜索只下正文分段；搜索回退标明扫描口径。测试 262 项。
@@ -53,6 +61,8 @@ IMAP/SMTP email tools for DeepSeek Harness, with replies, forwarding, mailbox or
 - **0.10.8 及更早**：见 [CHANGELOG.md](CHANGELOG.md)。
 ## 兼容性
 
+当前验证基线为官方源码构建的 Harness **0.1.7-alpha.2**（2026-09-23，含本地工具调度器 `Symbol.for` 修复）。18 个插件共同加载；邮件设置已通过旧配置迁移、真实网页编辑与自动保存、刷新恢复、修订冲突和重启持久化检查。本轮使用隔离测试账号，未连接真实邮箱或发送邮件。
+
 2026-09-21：当前发布包经官方 CLI 安装到隔离 profile，在源码构建的 Harness `0.1.6-alpha.2` 上与另外两个下载量前三插件共同加载，18 个插件工具注册正常；日历/邮件配置自检、PPT 主题查询和 17 行表格生成通过。测试本体基于官方 alpha.2 发布提交，另含工具调度器 `Symbol.for` 修复（`93badd88`）。本轮未连接真实邮箱或日历服务。
 
 2026-09-16 曾在官方源码构建的 Harness `0.1.5-rc.2` 和 `0.1.6-alpha.1` 上完成同载验证：18 个组件与 ModLens 同载，工具 schema、技能注册及离线只读调用检查通过。
@@ -61,7 +71,7 @@ IMAP/SMTP email tools for DeepSeek Harness, with replies, forwarding, mailbox or
 
 2026-09-10，npm `dsh-email@0.10.6` 曾通过真实 QQ 邮箱目录、列表、读取和搜索，以及设置页“测试连接”“保存并应用”检查；授权码留空时能继续使用 `DSH_EMAIL_PASSWORD`。独立 SMTP 登录认证也已通过。此次复验未连接真实邮箱，未发送、修改或删除邮件。
 
-遵循官方[插件打包与安装要求](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md)：ESM 入口、预构建 `lib/`、`dsh.bundle.patch` 和 `cordis.patch.yml` 配置层；显式注入所需服务，提供 JSON Schema 参数、规范化输出和渲染函数，运行时不 import `@deepseek-ai/*` 内部模块。使用 Node 22.19 及以上的 22.x 或 Node 24 及以上版本；Harness 仍在快速迭代，上述版本是实测基线。
+遵循官方[插件打包与安装要求](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md)：ESM 入口、预构建 `lib/`、`dsh.bundle.patch` 和 `cordis.patch.yml` 配置层；显式注入所需服务，提供 JSON Schema 参数、规范化输出和渲染函数，运行时不导入宿主内部服务；配置声明使用官方 `@deepseek-ai/schemastery` 公共包。使用 Node 22.19 及以上的 22.x 或 Node 24 及以上版本；Harness 仍在快速迭代，上述版本是实测基线。
 
 ## 安装
 
@@ -82,7 +92,7 @@ dsh plugin --profile web add dsh-email
 
 多账号可以在设置页可视化编辑：账号卡片支持增删改账号、改名、设默认、按账号名单独「测试连接」；没填完的账号不阻断保存，只标一个「未完成」。卡片改动即时防抖落盘，不再有"先写 YAML 文本、再点一次保存"这一步；版本冲突（别处也改了设置）会自动重基后重存一次，而不是拿旧版本号反复失败。保存卡片时，已存的授权码默认保持（密码栏留空 = 不变，填内容 = 覆盖）；YAML 里的注释尽量原地保留，实在保不住时会明确提示。改名走的是原地改键，授权码与高级键一并保留，且不允许改成已有账号名（那会顶掉另一个账号）。账号自己手写的 imap/smtp 端点只在**服务商真的换了**时才清洗——运行时以账号自己的 host 优先，普通保存不会悄悄改动连接目标。
 
-设置页保存的值存在 `settings.yaml` 的 `dsh-email` 命名空间里，覆盖 YAML 的默认账号配置。授权码字段标记为 secret，但填写后保存仍会写入本机配置文件。单账号如需避免保存授权码，可设置 `DSH_EMAIL_PASSWORD` 并将授权码栏留空；环境变量不会被复制进设置文件。
+Harness 0.1.7 中，设置页直接保存到当前 profile 的 `tool-email` 配置行，修改立即生效。使用默认插件行的旧安装会自动导入 `settings.yaml` 或 `settings.yaml.imported` 中的 `dsh-email` 设置；已有 profile 配置优先，原文件保留且只迁移一次，无需重新输入账号。旧版宿主仍使用原 settings 存储。授权码字段标记为 secret，但填写后保存仍会写入本机配置文件。单账号如需避免保存授权码，可设置 `DSH_EMAIL_PASSWORD` 并将授权码栏留空；环境变量不会被复制进设置文件。
 
 ## 卸载
 

package/lib/client.js

@@ -10,7 +10,8 @@ const React = require("react");
 const { useState, useEffect, useCallback, useRef } = React;
 const h = React.createElement;
 
-const ROUTE = "/_dsh/dsh-email/settings";
+// Harness supplies document.baseURI for reverse-proxy mounts and in-page navigation.
+const ROUTE = "_dsh/dsh-email/settings";
 /** 「编辑即保存」的防抖窗口：连续打字只落一次盘。 */
 const SAVE_DEBOUNCE_MS = 800;
 
@@ -207,6 +208,7 @@ const CSS = [
   ".dshe-auto-status{font-size:12px;font-weight:600;align-self:center;color:var(--dsw-alias-label-tertiary,#77736d)}",
   ".dshe-auto-status.is-saved{color:var(--dsw-alias-state-success-primary,#267d52)}",
   ".dshe-auto-status.is-error{color:var(--dsw-alias-state-error-primary,#aa3939)}",
+  ".dshe-auto-status.is-draft{color:var(--dsw-alias-state-warning-primary,#986000)}",
   ".dshe-acc-badge.is-oauth{border-color:transparent;background:color-mix(in srgb,var(--dsw-alias-state-success-primary,#267d52) 12%,transparent);color:var(--dsw-alias-state-success-primary,#267d52)}",
   ".dshe-oauth{display:grid;gap:8px;padding:10px 11px;border:1px dashed var(--dsw-alias-border-l2,#dedbd5);border-radius:10px;background:var(--dsw-alias-bg-layer-1,#fff)}",
   ".dshe-oauth.is-logged-in{border-style:solid;border-color:color-mix(in srgb,var(--dsw-alias-state-success-primary,#267d52) 34%,transparent);background:color-mix(in srgb,var(--dsw-alias-state-success-primary,#267d52) 8%,transparent)}",
@@ -245,8 +247,8 @@ var UI = {
     // 导航 / 段标题
     "nav.title": "邮件 (dsh-email)",
     "section.title": "邮件",
-    "section.intro": "在这里配置邮箱账号，即可使用 10 个 email_* 工具。每个账号只记服务商与凭证，端点在连接时从服务器预设展开；改动自动保存、立即生效。",
-    "section.readonly": "当前 settings 存储是只读的，只能查看不能保存。",
+    "section.intro": "添加邮箱后，就可以让助手帮你查收、搜索和回复邮件。选择服务商并填写邮箱地址与授权码，修改会自动保存。",
+    "section.readonly": "当前配置为只读，可以查看，但无法保存修改。",
     "section.activeAccounts": "当前生效账号：{accounts}",
 
     // 内置服务商名（PROVIDERS 里存的就是这些 key）
@@ -259,18 +261,19 @@ var UI = {
     "provider.outlook": "Outlook",
     "provider.icloud": "iCloud",
     "provider.custom": "自定义",
-    "provider.noneInYaml": "（YAML 未指定服务商）",
+    "provider.noneInYaml": "请选择邮箱服务商",
     "provider.undefinedPresetSuffix": "（未定义预设）",
 
     // 全局设置
     "global.sendApproval": "发信前弹确认（强烈建议保留；Full Access 模式下会被自动拒绝）",
-    "global.downloadDirLabel": "附件下载目录（默认 $DSH_HOME/email-downloads）",
+    "global.downloadDirLabel": "附件下载目录（默认保存在当前工作区）",
     "global.downloadDirPlaceholder": "留空使用默认",
     "global.hint": "以上两项对所有账号统一生效。",
 
     // 自动保存状态条
     "status.saved": "已保存",
     "status.saving": "保存中…",
+    "status.draft": "还有未保存的内容，请补全下方标记的字段。",
     "status.saveFailed": "保存失败：{message}（点击重试）",
 
     // 账号卡片
@@ -299,9 +302,9 @@ var UI = {
     "card.errReservedName": "账号名不能是 defaultAccount（该键保留给默认账号），这份改动先不保存。",
     "card.errNoDefault": "有多个账号还没指定默认账号，这份改动先不保存。",
     "card.yamlParseFailed": "accountsYaml 解析失败：{error}",
-    "card.confirmDelete": "删除账号「{name}」会在保存后从 YAML 里移除，已存密码一并丢失。",
-    "card.nameLabel": "账号名（工具调用的 account 参数）",
-    "card.nameHint": "不能叫 defaultAccount（该键保留给默认账号）。改名会删旧键、建新键。",
+    "card.confirmDelete": "删除账号「{name}」会同时移除已保存的登录信息，不会删除邮箱里的邮件。",
+    "card.nameLabel": "账号名称",
+    "card.nameHint": "用来区分多个邮箱，例如「工作邮箱」。修改名称会保留原有设置；名称不能为 defaultAccount。",
     "card.reservedNameWarn": "defaultAccount 是保留键（表示默认账号），请换一个名字。",
     "card.providerLabel": "服务商",
     "card.addressLabel": "邮箱地址",
@@ -313,7 +316,7 @@ var UI = {
     "card.passwordLabel": "授权码 / 应用专用密码",
     "card.passwordPlaceholder": "留空保持不变",
     "card.passwordSaved": "已存有授权码：留空保持不变，清空后填内容即覆盖。",
-    "card.passwordHint": "留空即不写入 password 键。",
+    "card.passwordHint": "请填写邮箱服务商提供的授权码或应用专用密码，然后点击「测试连接」。",
   "card.senderNameLabel": "发件显示名（可选）",
   "card.senderNamePlaceholder": "只影响收件人看到的名称",
   "card.senderNameHint": "只改收件人看到的显示名，发件地址仍是上面的邮箱地址。",
@@ -424,7 +427,7 @@ var UI = {
     // 导航 / 段标题
     "nav.title": "Email (dsh-email)",
     "section.title": "Email",
-    "section.intro": "Configure mailbox accounts here to use the ten email_* tools. An account stores only its provider and credentials; endpoints are expanded from the server preset at connect time. Changes save automatically and take effect at once.",
+    "section.intro": "Add a mailbox so your assistant can read, search and reply to mail. Choose a provider and enter your email address and app password. Changes save automatically.",
     "section.readonly": "The settings store is read-only right now: you can view the settings but not save them.",
     "section.activeAccounts": "Active accounts: {accounts}",
 
@@ -438,18 +441,19 @@ var UI = {
     "provider.outlook": "Outlook",
     "provider.icloud": "iCloud",
     "provider.custom": "Custom",
-    "provider.noneInYaml": "(no provider in YAML)",
+    "provider.noneInYaml": "Choose your email provider",
     "provider.undefinedPresetSuffix": "(undefined preset)",
 
     // 全局设置
     "global.sendApproval": "Ask for confirmation before sending (strongly recommended; auto-denied under Full Access)",
-    "global.downloadDirLabel": "Attachment download directory (defaults to $DSH_HOME/email-downloads)",
+    "global.downloadDirLabel": "Attachment download directory (defaults to the current workspace)",
     "global.downloadDirPlaceholder": "Leave empty for the default",
     "global.hint": "These two settings apply to every account.",
 
     // 自动保存状态条
     "status.saved": "Saved",
     "status.saving": "Saving…",
+    "status.draft": "Some edits are not saved yet. Complete the highlighted fields below.",
     "status.saveFailed": "Save failed: {message} (click to retry)",
 
     // 账号卡片
@@ -478,9 +482,9 @@ var UI = {
     "card.errReservedName": "An account cannot be named defaultAccount (that key is reserved for the default account); this change will not be saved.",
     "card.errNoDefault": "Several accounts exist but no default account was chosen; this change will not be saved.",
     "card.yamlParseFailed": "accountsYaml failed to parse: {error}",
-    "card.confirmDelete": "Deleting account “{name}” removes it from the YAML once saved, and its stored password is lost with it.",
-    "card.nameLabel": "Account name (the account argument of tool calls)",
-    "card.nameHint": "Cannot be defaultAccount (that key is reserved for the default account). Renaming deletes the old key and creates a new one.",
+    "card.confirmDelete": "Deleting account “{name}” also removes its saved login details. Messages in the mailbox are not deleted.",
+    "card.nameLabel": "Account name",
+    "card.nameHint": "Use a name such as “Work” to distinguish your mailboxes. Renaming keeps the existing settings; defaultAccount is reserved.",
     "card.reservedNameWarn": "defaultAccount is a reserved key (it means the default account); pick another name.",
     "card.providerLabel": "Provider",
     "card.addressLabel": "Email address",
@@ -492,7 +496,7 @@ var UI = {
     "card.passwordLabel": "Authorization code / app password",
     "card.passwordPlaceholder": "Leave empty to keep it",
     "card.passwordSaved": "A password is already stored: leave empty to keep it, or clear the field and type to overwrite.",
-    "card.passwordHint": "Leave it empty and the password key is not written.",
+    "card.passwordHint": "Enter the authorization code or app password from your email provider, then click “Test connection”.",
   "card.senderNameLabel": "Sender display name (optional)",
   "card.senderNamePlaceholder": "Only the name recipients see",
   "card.senderNameHint": "Changes only the name recipients see; the address stays the one above.",
@@ -1349,33 +1353,38 @@ function AccountCardsEditor(props) {
    */
   const autoSave = (draftsNow, orderNow, defaultNow, immediate) => {
     if (typeof props.onAutoSave !== "function") return null;
+    const incomplete = (text) => {
+      setNotice({ kind: "error", text });
+      if (typeof props.onDraftStatus === "function") props.onDraftStatus(true);
+    };
     const names = orderNow.map((row) => row.key).filter((name) => Object.prototype.hasOwnProperty.call(draftsNow, name));
     let built;
     try {
       built = names.map((name) => draftToInput(draftsNow[name]));
     } catch (e) {
-      console.error("[dsh-email] 卡片快照组装失败", e, names, draftsNow);
+      incomplete(e && e.message ? e.message : String(e));
       return null;
     }
     if (built.some((card) => String(card.name || "").trim() === "")) {
-      setNotice({ kind: "error", text: t("card.errNoName") });
+      incomplete(t("card.errNoName"));
       return null;
     }
     if (names.some((name) => !draftsNow[name].provider && !(draftsNow[name].imap?.host && draftsNow[name].smtp?.host))) {
       // 服务商就是账号的连接身份：没有它，后端写回时会把 provider 键删掉，这个账号
       // 永远连不上。名字和它都属于「这还是一张半填的卡」，一起拦在这里。
-      setNotice({ kind: "error", text: t("card.errNoProvider") });
+      incomplete(t("card.errNoProvider"));
       return null;
     }
     if (built.some((card) => card.name === "defaultAccount")) {
-      setNotice({ kind: "error", text: t("card.errReservedName") });
+      incomplete(t("card.errReservedName"));
       return null;
     }
     if (built.length > 1 && String(defaultNow || "") === "") {
-      setNotice({ kind: "error", text: t("card.errNoDefault") });
+      incomplete(t("card.errNoDefault"));
       return null;
     }
     setNotice(null);
+    if (typeof props.onDraftStatus === "function") props.onDraftStatus(false);
     // 返回值只给 OAuth 登录用：它必须等这份配置真的落盘（后端按账号名去读 provider
     // 和端点）。其余调用方照旧忽略返回值。
     return props.onAutoSave(built, String(defaultNow || ""), immediate === true);
@@ -1888,9 +1897,11 @@ function ServerPresetsEditor(props) {
     const result = serializePresetDrafts(nextOrder.map((row) => row.key), nextDrafts);
     if (result.error !== undefined) {
       setNotice({ kind: "error", text: result.error });
+      if (typeof props.onDraftStatus === "function") props.onDraftStatus(true);
       return;
     }
     setNotice(null);
+    if (typeof props.onDraftStatus === "function") props.onDraftStatus(false);
     props.onAutoSave(result.text);
   };
 
@@ -2108,6 +2119,8 @@ function EmailSettingsSection() {
   const [error, setError] = useState("");
   /** 自动保存的可见状态：null 视同「已保存」（刚加载完、什么都没改）。 */
   const [saveState, setSaveState] = useState(null);
+  const [incompleteDrafts, setIncompleteDrafts] = useState({ accounts: false, presets: false });
+  const hasIncompleteDraft = incompleteDrafts.accounts || incompleteDrafts.presets;
   /** 卡片级提示（注释丢失、序列化失败…）：走卡片自己的 notice 位，不打断顶部状态。 */
   const [cardsNotice, setCardsNotice] = useState(null);
   /**
@@ -2162,6 +2175,7 @@ function EmailSettingsSection() {
       accountsYamlRef.current = next.accountsYaml || "";
       savedSignatureRef.current = signatureOf(next, next.accountsYaml || "");
       setSaveState(null);
+      setIncompleteDrafts({ accounts: false, presets: false });
       setCardsNotice(null);
       setCustomNames(presetNamesOf(next.serverPresets));
       setCardsDetail(snap.accountsDetail);
@@ -2183,6 +2197,7 @@ function EmailSettingsSection() {
    * 防抖那条路交不出 promise（定时器还没到点），返回 null。
    */
   const scheduleSave = (immediate) => {
+    setSaveState({ kind: "busy" });
     // 用户又改了：还在飞的那次保存结果就作废，别拿旧结果盖住新状态。
     seqRef.current += 1;
     if (saveTimerRef.current) clearTimeout(saveTimerRef.current);
@@ -2269,14 +2284,14 @@ function EmailSettingsSection() {
   // 有没落盘的内容（保存中或保存失败）才拦离开：这正是「编辑即保存」剩下的窗口。
   useEffect(() => {
     const guard = (e) => {
-      if (saveState === null || saveState.kind === "saved") return undefined;
+      if (!hasIncompleteDraft && (saveState === null || saveState.kind === "saved")) return undefined;
       e.preventDefault();
       e.returnValue = "";
       return "";
     };
     window.addEventListener("beforeunload", guard);
     return () => window.removeEventListener("beforeunload", guard);
-  }, [saveState]);
+  }, [saveState, hasIncompleteDraft]);
 
   /** 卡片序列化的往返序号：打字快时多个 serializeAccounts 会并发，只认最后一个。 */
   const cardsSeqRef = useRef(0);
@@ -2311,6 +2326,7 @@ function EmailSettingsSection() {
    */
   const onCardsAutoSave = async (cards, defaultAccount, immediate) => {
     const seq = ++cardsSeqRef.current;
+    setSaveState({ kind: "busy" });
     try {
       const result = await serializeCards(cards, defaultAccount);
       if (seq !== cardsSeqRef.current) return { ok: false, reason: "superseded" }; // 更晚的一次已经在路上，别用旧结果盖新状态
@@ -2332,8 +2348,10 @@ function EmailSettingsSection() {
       if (flushed && typeof flushed.then === "function") await flushed;
       return { ok: true };
     } catch (e) {
+      if (seq !== cardsSeqRef.current) return { ok: false, reason: "superseded" };
       const message = e && e.message ? e.message : String(e);
       setCardsNotice({ kind: "error", text: t("notice.cardsNotWritten", { message }) });
+      setSaveState({ kind: "error", text: message });
       return { ok: false, reason: message };
     }
   };
@@ -2359,7 +2377,7 @@ function EmailSettingsSection() {
 
   const accounts = snapshot && snapshot.accounts ? snapshot.accounts : [];
   const presetsMerged = presetsWithNames((snapshot && snapshot.presets) || undefined, customNames);
-  const statusText = saveState === null
+  const statusText = hasIncompleteDraft ? t("status.draft") : saveState === null
     ? t("status.saved")
     : saveState.kind === "busy"
       ? t("status.saving")
@@ -2367,9 +2385,11 @@ function EmailSettingsSection() {
         ? t("status.saved")
         : t("status.saveFailed", { message: saveState.text });
   const status = h("span", {
-    className: "dshe-auto-status" + (saveState === null ? "" : " is-" + saveState.kind),
-    onClick: saveState !== null && saveState.kind === "error" ? () => flushSave() : undefined,
-    style: saveState !== null && saveState.kind === "error" ? { cursor: "pointer" } : undefined,
+    role: "status",
+    "aria-live": "polite",
+    className: "dshe-auto-status" + (hasIncompleteDraft ? " is-draft" : saveState === null ? "" : " is-" + saveState.kind),
+    onClick: !hasIncompleteDraft && saveState !== null && saveState.kind === "error" ? () => flushSave() : undefined,
+    style: !hasIncompleteDraft && saveState !== null && saveState.kind === "error" ? { cursor: "pointer" } : undefined,
   }, statusText);
 
   return h("div", { className: "dshe-settings" }, [
@@ -2402,6 +2422,7 @@ function EmailSettingsSection() {
         presets: presetsMerged,
         extraNotice: cardsNotice,
         onAutoSave: onCardsAutoSave,
+        onDraftStatus: (blocked) => setIncompleteDrafts((current) => ({ ...current, accounts: blocked })),
         onTest: onCardTest,
         // OAuth2 登录成功后重拉整份快照：卡片的 authKind/oauthState/oauthUser 是
         // 服务端算出来的，只有新快照才拿得到（和加载走同一条路径）。
@@ -2412,6 +2433,7 @@ function EmailSettingsSection() {
         h(ServerPresetsEditor, {
           presets: presetsAtLoad,
           onAutoSave: (text) => update({ serverPresets: typeof text === "string" ? text : "" }),
+          onDraftStatus: (blocked) => setIncompleteDrafts((current) => ({ ...current, presets: blocked })),
         }),
       ]),
       snapshot && snapshot.writable === false
@@ -2513,7 +2535,7 @@ function startWhaleWidget() {
         const snap = await api();
         lastSnapshot = Date.now();
         if (snap && snap.whale) {
-          whaleUrl = snap.whale.url || "";
+          whaleUrl = (snap.whale.url || "").replace(/^\/_dsh\//, "_dsh/");
           whaleCredit = snap.whale.credit || "";
         }
         hasAccounts = !!(snap && snap.accounts && snap.accounts.length > 0);

package/lib/config.d.ts

@@ -256,8 +256,10 @@ export declare function serializeAccountsYaml(raw: unknown, defaultAccount?: str
  * Resolve and validate the raw row config. Throws with an actionable message
  * (in Chinese, since it is what the user and the model both read) when the
  * account is not fully specified.
+ * An explicit account resolves only that card for connection tests, without
+ * making named accounts eligible for the single-account environment password.
  */
-export declare function resolveEmailSettings(config: EmailConfig | undefined): ResolvedEmailSettings;
+export declare function resolveEmailSettings(config: EmailConfig | undefined, onlyAccount?: string): ResolvedEmailSettings;
 /** Every name a `provider:` may legally use, built-ins first. */
 export declare function providerNames(custom?: Record<string, ServerPreset>): string[];
 /**

package/lib/config.js

@@ -201,8 +201,10 @@ function normalizeAccountForYaml(value) {
  * Resolve and validate the raw row config. Throws with an actionable message
  * (in Chinese, since it is what the user and the model both read) when the
  * account is not fully specified.
+ * An explicit account resolves only that card for connection tests, without
+ * making named accounts eligible for the single-account environment password.
  */
-export function resolveEmailSettings(config) {
+export function resolveEmailSettings(config, onlyAccount) {
     const raw = config ?? {};
     const common = {
         provider: raw.provider,
@@ -218,6 +220,10 @@ export function resolveEmailSettings(config) {
     const entries = parsedYaml !== undefined
         ? parsedYaml.map
         : (raw.accounts === undefined || Object.keys(raw.accounts).length === 0 ? undefined : raw.accounts);
+    const available = entries === undefined ? ['default'] : Object.keys(entries);
+    if (onlyAccount !== undefined && !available.includes(onlyAccount)) {
+        throw new Error(`未知账号 "${onlyAccount}"，可用：${available.join('、')}`);
+    }
     // The custom preset table is read once, here, and never stored on the result:
     // it is a lookup source for provider names, not part of the resolved config.
     // A broken preset text degrades to "no custom presets" — the account-level
@@ -237,11 +243,16 @@ export function resolveEmailSettings(config) {
     }
     else {
         for (const [name, acc] of Object.entries(entries)) {
+            if (onlyAccount !== undefined && name !== onlyAccount)
+                continue;
             accounts.set(name, resolveAccount(name, common, acc ?? {}, false, providers, known));
         }
     }
     let defaultName;
-    if (raw.defaultAccount !== undefined && raw.defaultAccount !== '') {
+    if (onlyAccount !== undefined) {
+        defaultName = onlyAccount;
+    }
+    else if (raw.defaultAccount !== undefined && raw.defaultAccount !== '') {
         if (!accounts.has(raw.defaultAccount)) {
             throw new Error(`dsh-email：defaultAccount "${raw.defaultAccount}" 不存在，可用账号：${[...accounts.keys()].join('、')}`);
         }
@@ -343,7 +354,7 @@ function resolveAccount(name, common, acc, allowEnvPassword, providers, known) {
     };
     const problems = [];
     if (user === '')
-        problems.push(`账号 "${name}" 的 user（邮箱地址）未填写`);
+        problems.push(`账号 "${name}" 的邮箱地址未填写`);
     // An explicit `authKind` outranks the derivation: a tenant that still accepts
     // an app password for Exchange Online, or a mailbox that worked before the
     // derivation existed, keeps working instead of being told「尚未登录」.
@@ -358,14 +369,14 @@ function resolveAccount(name, common, acc, allowEnvPassword, providers, known) {
     // in the OAuth2 store, and requiring a password would demand a secret
     // Microsoft no longer accepts for Exchange Online.
     if (!oauth2 && authPassword === '') {
-        problems.push(`账号 "${name}" 的 ${authUser === user ? 'password' : 'authPassword'} 未填写（单账号可用环境变量 ${EMAIL_PASSWORD_ENV}）`);
+        problems.push(`账号 "${name}" 的${authUser === user ? '授权码 / 应用专用密码' : '登录账号的密码'}未填写`);
     }
     if (imap.host === undefined || imap.host === '')
         problems.push(`账号 "${name}" 的 imap.host 未填写（可填 provider 预设：${known.join('/')}）`);
     if (smtp.host === undefined || smtp.host === '')
         problems.push(`账号 "${name}" 的 smtp.host 未填写（同上）`);
     if (problems.length > 0) {
-        throw new Error(`dsh-email 未配置：${problems.join('；')}。请在 profile 的 cordis.patch.yml 中覆盖 tool-email 行并重启（见插件 README）`);
+        throw new Error(`邮件账号配置不完整：${problems.join('；')}。请在「设置 → 邮件」补全对应账号，再点击「测试连接」。修改会自动保存并立即生效。`);
     }
     const clientId = (acc.clientId ?? common.clientId ?? '').trim();
     return {

package/lib/host-config.d.ts

@@ -0,0 +1,6 @@
+/** Harness 0.1.7 keeps editable fields in the profile and supplies live references. */
+import z from '@deepseek-ai/schemastery';
+import type { EmailConfig } from './config.js';
+export declare const Config: z;
+/** A live view also accepts ordinary values from older hosts and direct callers. */
+export declare function liveConfig(config: object): EmailConfig;

package/lib/host-config.js

@@ -0,0 +1,30 @@
+/** Harness 0.1.7 keeps editable fields in the profile and supplies live references. */
+import z from '@deepseek-ai/schemastery';
+const endpoint = () => z.object({
+    host: z.string(), port: z.number().min(1).max(65535), secure: z.boolean(),
+    connectionTimeoutMs: z.number(), socketTimeoutMs: z.number(),
+});
+export const Config = z.object({
+    provider: z.string().volatile(), user: z.string().volatile(),
+    password: z.string().role('secret').volatile(),
+    senderName: z.string().volatile(), authUser: z.string().volatile(),
+    authPassword: z.string().role('secret').volatile(),
+    clientId: z.string().volatile(), authKind: z.union(['password', 'oauth2']).volatile(),
+    imap: endpoint().volatile(), smtp: endpoint().volatile(),
+    inboxFolder: z.string().volatile(), sendApproval: z.boolean().volatile(),
+    maxBodyChars: z.number().volatile(), downloadDir: z.string().volatile(),
+    accounts: z.dict(z.any()).role('secret').volatile(), defaultAccount: z.string().volatile(),
+    accountsYaml: z.string().role('secret').volatile(), serverPresets: z.string().volatile(),
+    maxAttachmentBytes: z.number().volatile(), bodySearchFallback: z.boolean().volatile(),
+    bodySearchLimit: z.number().volatile(), idleTimeoutMs: z.number().volatile(),
+    legacySettingsImported: z.boolean().volatile(),
+});
+/** A live view also accepts ordinary values from older hosts and direct callers. */
+export function liveConfig(config) {
+    return new Proxy(config, {
+        get(target, key, receiver) {
+            const value = Reflect.get(target, key, receiver);
+            return value !== null && typeof value === 'object' && typeof value.get === 'function' ? value.get() : value;
+        },
+    });
+}

package/lib/index.d.ts

@@ -1,4 +1,5 @@
 import type { EmailConfig } from './config.js';
+export declare const Config: import("@deepseek-ai/schemastery").default;
 export declare const name = "tool-email";
 export declare const inject: string[];
 export type Config = EmailConfig;

package/lib/index.js

@@ -2,10 +2,21 @@ import { installSendApproval } from './approval.js';
 import { createEmailRuntime } from './runtime.js';
 import { buildEmailTools } from './tools.js';
 import { EmailSettingsBackend, installEmailSettingsWeb } from './web.js';
+import { liveConfig, Config as ConfigSchema } from './host-config.js';
+import { installLegacySettingsImport } from './legacy-settings.js';
+import { EmailSettingsSchema, SETTINGS_NAMESPACE } from './settings.js';
+export const Config = ConfigSchema;
 export const name = 'tool-email';
 export const inject = ['settings', 'tools'];
 /** Compose settings/pool lifecycle, tools, browser routes and the outgoing-mail gate. */
 export function apply(ctx, config = {}) {
+    config = liveConfig(config);
+    installLegacySettingsImport(ctx, config, SETTINGS_NAMESPACE, 'tool-email', Object.keys(EmailSettingsSchema.dict));
+    if (typeof ctx.settings.configure === 'function' && typeof ctx.inject === 'function') {
+        ctx.inject(['settings'], (settingsCtx) => {
+            settingsCtx.effect(() => settingsCtx.settings.configure({ auto: false }, ctx.fiber));
+        });
+    }
     const runtime = createEmailRuntime(ctx, config);
     const backend = new EmailSettingsBackend(ctx, runtime.settingsScope, config);
     backend.watchImpl = runtime.watch;

package/lib/legacy-settings.d.ts

@@ -0,0 +1,4 @@
+/** No backup is edited or deleted; the completion marker lives beside imported values. */
+export declare function importLegacySettings(ctx: any, config: Record<string, any>, namespace: string, entryId: string, fields: readonly string[], home?: string): Promise<boolean>;
+/** Defer persistence until the entry and settings provider are active. */
+export declare function installLegacySettingsImport(ctx: any, config: Record<string, any>, namespace: string, entryId: string, fields: readonly string[]): void;

package/lib/legacy-settings.js

@@ -0,0 +1,64 @@
+/** Import only this plugin's retired settings section, preserving profile overrides. */
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { parse } from 'yaml';
+function plain(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function missing(legacy, current) {
+    const patch = {};
+    for (const [key, value] of Object.entries(legacy)) {
+        if (current[key] === undefined)
+            patch[key] = value;
+        else if (plain(value) && plain(current[key])) {
+            const nested = missing(value, current[key]);
+            if (Object.keys(nested).length)
+                patch[key] = nested;
+        }
+    }
+    return patch;
+}
+/** No backup is edited or deleted; the completion marker lives beside imported values. */
+export async function importLegacySettings(ctx, config, namespace, entryId, fields, home) {
+    if (typeof ctx.settings.register === 'function' || config.legacySettingsImported === true)
+        return false;
+    // Old namespaces were global. Do not copy credentials into unrelated custom instances.
+    if (ctx.fiber?.entry?.options.id !== entryId)
+        return false;
+    let base = home ?? (process.env.DSH_HOME?.trim() || join(homedir(), '.dsh'));
+    if (base === '~')
+        base = homedir();
+    else if (base.startsWith('~/') || base.startsWith('~\\'))
+        base = join(homedir(), base.slice(2));
+    let document;
+    for (const file of ['settings.yaml.imported', 'settings.yaml']) {
+        try {
+            document = parse(readFileSync(resolve(base, file), 'utf8'));
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw new Error('Cannot read legacy settings; original file preserved');
+        }
+    }
+    if (!plain(document) || !plain(document[namespace]))
+        return false;
+    const section = Object.fromEntries(fields.filter(key => Object.hasOwn(document[namespace], key)).map(key => [key, document[namespace][key]]));
+    if (Object.keys(section).length === 0)
+        return false;
+    await ctx.settings.update(entryId, { ...missing(section, { ...config }), legacySettingsImported: true });
+    return true;
+}
+/** Defer persistence until the entry and settings provider are active. */
+export function installLegacySettingsImport(ctx, config, namespace, entryId, fields) {
+    if (typeof ctx.settings.register === 'function' || typeof ctx.inject !== 'function')
+        return;
+    ctx.inject(['appReady'], (readyCtx) => {
+        readyCtx.effect(() => readyCtx.appReady.onReady(() => {
+            void importLegacySettings(ctx, config, namespace, entryId, fields).catch(() => {
+                ctx.logger?.warn?.(namespace + ': legacy settings could not be imported; the original settings file is preserved.');
+            });
+        }));
+    });
+}

package/lib/runtime.d.ts

@@ -6,10 +6,12 @@ import type { EmailWatchResult } from './types.js';
 export type EmailClient = Pick<EmailPool, 'list' | 'read' | 'mark' | 'search' | 'send' | 'reply' | 'folders' | 'downloadAttachment' | 'unseenUids' | 'fetchByUids' | 'startIdleSweep' | 'dispose'>;
 export interface EmailSettingsScope {
     get(): unknown;
+    namespace?: string;
+    config?: EmailConfig;
 }
 export interface EmailRuntimeContext {
     settings: {
-        register(namespace: string, schema: unknown, options: {
+        register?(namespace: string, schema: unknown, options: {
             base: Partial<EmailSettingsValue>;
             applies: 'live';
             validate(value: unknown): void;
@@ -19,6 +21,13 @@ export interface EmailRuntimeContext {
             user?: Partial<EmailSettingsValue>;
         }>;
     };
+    fiber?: {
+        entry?: {
+            options: {
+                id: string;
+            };
+        };
+    };
     effect(effect: () => () => void): unknown;
     logger?: {
         warn?(message: string): void;

package/lib/runtime.js

@@ -1,7 +1,8 @@
 /** Live settings, account-pool ownership, and independent tool/web watch cursors. */
-import { clampInt, presetNamesIn, resolveEmailSettings } from './config.js';
+import { clampInt, presetNamesIn, resolveEmailSettings, serializeAccountsYaml } from './config.js';
 import { EmailPool, messageOf } from './mail-client.js';
 import { EmailSettingsSchema, SETTINGS_NAMESPACE, toEmailConfig, toSettingsBase, validateSettingsValue } from './settings.js';
+import { liveConfig } from './host-config.js';
 function fingerprintSettings(settings) {
     return JSON.stringify({
         accounts: [...settings.accounts.entries()].map(([name, account]) => [name, account]),
@@ -18,17 +19,44 @@ function fingerprintSettings(settings) {
 }
 /** Register live settings and own exactly one pool for their effective value. */
 export function createEmailRuntime(ctx, config, createPool = settings => new EmailPool(settings)) {
-    const settingsScope = ctx.settings.register(SETTINGS_NAMESPACE, EmailSettingsSchema, {
+    config = liveConfig(config);
+    const legacy = typeof ctx.settings.register === 'function';
+    const namespace = legacy ? SETTINGS_NAMESPACE : ctx.fiber?.entry?.options.id ?? 'tool-email';
+    const settingsScope = legacy ? ctx.settings.register(SETTINGS_NAMESPACE, EmailSettingsSchema, {
         base: toSettingsBase(config),
         applies: 'live',
         // The provider dropdown offers the custom preset names beside the built-ins,
         // so validation must accept whatever the table in effect defines.
         validate: value => validateSettingsValue(value, presetNamesIn(value?.serverPresets ?? config.serverPresets)),
-    });
+    }) : {
+        namespace,
+        config,
+        get: () => {
+            let endpointDefaults = {};
+            try {
+                const settings = resolveEmailSettings({ ...config });
+                const account = settings.accounts.get(settings.defaultAccount);
+                if (account)
+                    endpointDefaults = { imap: account.imap, smtp: account.smtp };
+            }
+            catch { /* A fresh installation remains editable before credentials exist. */ }
+            const shared = Object.fromEntries(['provider', 'user', 'password', 'senderName', 'authUser', 'authPassword', 'clientId', 'authKind', 'imap', 'smtp', 'inboxFolder']
+                .filter(key => config[key] !== undefined).map(key => [key, config[key]]));
+            const cards = config.accounts && Object.keys(config.accounts).length > 0
+                ? Object.fromEntries(Object.entries(config.accounts).map(([key, account]) => [key, { ...shared, ...account }]))
+                : typeof config.user === 'string' && config.user !== '' ? { default: shared } : {};
+            return EmailSettingsSchema({ ...toSettingsBase(config), ...endpointDefaults,
+                accountsYaml: config.accountsYaml ?? serializeAccountsYaml(cards, config.defaultAccount),
+                serverPresets: config.serverPresets ?? '',
+            });
+        },
+    };
     const getSettingsValue = () => settingsScope.get();
     const getEffectiveSettings = () => {
         // Form defaults must not overwrite row settings or provider presets.
-        const descriptor = (ctx.settings.describe?.() ?? []).find(row => row.ns === SETTINGS_NAMESPACE);
+        if (!legacy)
+            return resolveEmailSettings({ ...config });
+        const descriptor = (ctx.settings.describe?.() ?? []).find(row => row.ns === namespace);
         const value = getSettingsValue();
         // serverPresets is a *lookup source* for provider ids, not part of the
         // resolved config: it is handed to resolution here and never stored on the

package/lib/settings.d.ts

@@ -1,4 +1,3 @@
-import z from 'schemastery';
 import { type EmailConfig } from './config.js';
 /** Settings-document namespace this plugin owns (editable from the Web settings page). */
 export declare const SETTINGS_NAMESPACE = "dsh-email";
@@ -7,63 +6,63 @@ export declare const SETTINGS_NAMESPACE = "dsh-email";
  * The form edits the default/shorthand account; its advanced YAML area
  * edits named accounts through accountsYaml.
  */
-export declare const EmailSettingsSchema: z<Schemastery.ObjectS<{
-    provider: z<string, string>;
-    user: z<string, string>;
-    password: z<string, string>;
-    inboxFolder: z<string, string>;
-    sendApproval: z<boolean, boolean>;
-    maxBodyChars: z<number, number>;
-    downloadDir: z<string, string>;
-    accountsYaml: z<string, string>;
-    serverPresets: z<string, string>;
-    imap: z<Schemastery.ObjectS<{
-        host: z<string, string>;
-        port: z<number, number>;
-        secure: z<boolean, boolean>;
-    }>, Schemastery.ObjectT<{
-        host: z<string, string>;
-        port: z<number, number>;
-        secure: z<boolean, boolean>;
-    }>>;
-    smtp: z<Schemastery.ObjectS<{
-        host: z<string, string>;
-        port: z<number, number>;
-        secure: z<boolean, boolean>;
-    }>, Schemastery.ObjectT<{
-        host: z<string, string>;
-        port: z<number, number>;
-        secure: z<boolean, boolean>;
-    }>>;
-}>, Schemastery.ObjectT<{
-    provider: z<string, string>;
-    user: z<string, string>;
-    password: z<string, string>;
-    inboxFolder: z<string, string>;
-    sendApproval: z<boolean, boolean>;
-    maxBodyChars: z<number, number>;
-    downloadDir: z<string, string>;
-    accountsYaml: z<string, string>;
-    serverPresets: z<string, string>;
-    imap: z<Schemastery.ObjectS<{
-        host: z<string, string>;
-        port: z<number, number>;
-        secure: z<boolean, boolean>;
-    }>, Schemastery.ObjectT<{
-        host: z<string, string>;
-        port: z<number, number>;
-        secure: z<boolean, boolean>;
-    }>>;
-    smtp: z<Schemastery.ObjectS<{
-        host: z<string, string>;
-        port: z<number, number>;
-        secure: z<boolean, boolean>;
-    }>, Schemastery.ObjectT<{
-        host: z<string, string>;
-        port: z<number, number>;
-        secure: z<boolean, boolean>;
-    }>>;
-}>>;
+export declare const EmailSettingsSchema: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{
+    provider: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    user: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    password: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    inboxFolder: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    sendApproval: import("@deepseek-ai/schemastery").default<boolean, boolean, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    maxBodyChars: import("@deepseek-ai/schemastery").default<number, number, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    downloadDir: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    accountsYaml: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    serverPresets: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    imap: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{
+        host: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        port: import("@deepseek-ai/schemastery").default<number, number, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        secure: import("@deepseek-ai/schemastery").default<boolean, boolean, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        host: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        port: import("@deepseek-ai/schemastery").default<number, number, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        secure: import("@deepseek-ai/schemastery").default<boolean, boolean, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    }>>, "plain">;
+    smtp: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{
+        host: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        port: import("@deepseek-ai/schemastery").default<number, number, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        secure: import("@deepseek-ai/schemastery").default<boolean, boolean, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        host: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        port: import("@deepseek-ai/schemastery").default<number, number, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        secure: import("@deepseek-ai/schemastery").default<boolean, boolean, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    }>>, "plain">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    provider: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    user: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    password: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    inboxFolder: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    sendApproval: import("@deepseek-ai/schemastery").default<boolean, boolean, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    maxBodyChars: import("@deepseek-ai/schemastery").default<number, number, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    downloadDir: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    accountsYaml: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    serverPresets: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    imap: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{
+        host: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        port: import("@deepseek-ai/schemastery").default<number, number, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        secure: import("@deepseek-ai/schemastery").default<boolean, boolean, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        host: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        port: import("@deepseek-ai/schemastery").default<number, number, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        secure: import("@deepseek-ai/schemastery").default<boolean, boolean, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    }>>, "plain">;
+    smtp: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{
+        host: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        port: import("@deepseek-ai/schemastery").default<number, number, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        secure: import("@deepseek-ai/schemastery").default<boolean, boolean, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        host: import("@deepseek-ai/schemastery").default<string, string, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        port: import("@deepseek-ai/schemastery").default<number, number, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+        secure: import("@deepseek-ai/schemastery").default<boolean, boolean, Mode extends "volatile" | "volatile-defined" ? "volatile-defined" : "defined">;
+    }>>, "plain">;
+}>>, "plain">;
 export interface EmailSettingsValue {
     provider: string;
     user: string;

package/lib/web.d.ts

@@ -178,6 +178,8 @@ export declare class EmailSettingsBackend {
     constructor(ctx: any, scope: any, rowConfig: EmailConfig);
     /** Wired by apply(): the email_watch core; 'web' keeps its own cursor scope. */
     watchImpl?: (account: string, folder: string, limit: number, scope: string) => Promise<EmailWatchResult>;
+    private get namespace();
+    private get currentConfig();
     private userSection;
     /** Effective config for the stored value (row + user-set fields only). */
     private effectiveStored;

package/lib/web.js

@@ -757,12 +757,16 @@ export class EmailSettingsBackend {
     }
     /** Wired by apply(): the email_watch core; 'web' keeps its own cursor scope. */
     watchImpl;
+    get namespace() { return this.scope.namespace ?? SETTINGS_NAMESPACE; }
+    get currentConfig() { return this.scope.config ?? this.rowConfig; }
     userSection() {
-        const descriptor = (this.ctx.settings.describe?.() ?? []).find((row) => row.ns === SETTINGS_NAMESPACE);
+        const descriptor = (this.ctx.settings.describe?.() ?? []).find((row) => row.ns === this.namespace);
         return descriptor?.user;
     }
     /** Effective config for the stored value (row + user-set fields only). */
     effectiveStored() {
+        if (this.scope.config)
+            return { ...this.currentConfig };
         const stored = this.scope.get();
         const merged = { ...this.rowConfig, ...toEmailConfig(stored, this.userSection()) };
         // toEmailConfig drops serverPresets — it must never enter the fingerprint —
@@ -771,14 +775,14 @@ export class EmailSettingsBackend {
         return { ...merged, ...(typeof stored?.serverPresets === 'string' ? { serverPresets: stored.serverPresets } : {}) };
     }
     async snapshot() {
-        const descriptor = (this.ctx.settings.describe?.() ?? []).find((row) => row.ns === SETTINGS_NAMESPACE);
+        const descriptor = (this.ctx.settings.describe?.() ?? []).find((row) => row.ns === this.namespace);
         const value = this.scope.get();
         const whale = findWhaleAsset();
         const presets = presetsSnapshot(value.serverPresets);
         // The cards describe the *effective* accountsYaml — the same text the
         // advanced editor shows, and the same source the accounts field reads.
         const effective = this.effectiveStored();
-        const draft = readAccountsDraft(effective.accountsYaml ?? '', presets.custom, effective.defaultAccount, tokenLookup());
+        const draft = readAccountsDraft(this.scope.config ? value.accountsYaml : effective.accountsYaml ?? '', presets.custom, effective.defaultAccount, tokenLookup());
         return {
             settings: {
                 value,
@@ -813,7 +817,17 @@ export class EmailSettingsBackend {
         // one of them is a legal choice rather than an unknown provider.
         validateSettingsValue(value, presetNamesIn(value?.serverPresets ?? this.scope.get()?.serverPresets));
         const before = accountNamesOf(this.scope.get());
-        await this.ctx.settings.replace(SETTINGS_NAMESPACE, value, expectedRevision);
+        if (this.scope.config) {
+            // The card editor takes ownership of legacy shorthand/maps. Clear only
+            // the superseded account storage, so removing the last card cannot
+            // resurrect a hidden old account on the next read.
+            const section = Object.hasOwn(value, 'accountsYaml')
+                ? { ...value, accounts: {}, user: '', password: '', authUser: '', authPassword: '' }
+                : value;
+            await this.ctx.settings.update(this.namespace, section, expectedRevision);
+        }
+        else
+            await this.ctx.settings.replace(this.namespace, value, expectedRevision);
         // A deleted account must not leave its refresh token behind: the store is
         // keyed by account name, so the credential of a mailbox that is no longer
         // configured would sit on disk, and a later account reusing that name would
@@ -841,12 +855,12 @@ export class EmailSettingsBackend {
         // does for the stored settings (it never enters the resolved fingerprint).
         const draft = toEmailConfig(value, null);
         const presets = value?.serverPresets ?? this.scope.get()?.serverPresets;
+        const requested = typeof accountName === 'string' && accountName.trim() !== '' ? accountName.trim() : '';
         const settings = resolveEmailSettings({
-            ...this.rowConfig,
+            ...this.currentConfig,
             ...draft,
             ...(typeof presets === 'string' ? { serverPresets: presets } : {}),
-        });
-        const requested = typeof accountName === 'string' && accountName.trim() !== '' ? accountName.trim() : '';
+        }, requested || undefined);
         const available = [...settings.accounts.keys()];
         const name = requested !== '' ? requested : settings.defaultAccount;
         const cfg = settings.accounts.get(name);
@@ -1070,7 +1084,7 @@ export class EmailSettingsBackend {
                 const presets = typeof body.serverPresets === 'string'
                     ? customPresetsOf(body.serverPresets).custom
                     : customPresetsOf(this.scope.get().serverPresets).custom;
-                const draft = readAccountsDraft(text, presets, this.rowConfig.defaultAccount, tokenLookup());
+                const draft = readAccountsDraft(text, presets, this.currentConfig.defaultAccount, tokenLookup());
                 this.responseJson(res, 200, {
                     ok: true,
                     value: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-email",
-  "version": "0.13.2",
+  "version": "0.14.1",
   "description": "DSH 邮件插件：IMAP/SMTP 收发搜索、回复转发、附件与整理，多账号卡片设置页、Outlook OAuth2 登录与发信审批。",
   "type": "module",
   "main": "lib/index.js",
@@ -65,7 +65,8 @@
     "mailparser": "^3.9.22",
     "nodemailer": "^9.0.5",
     "schemastery": "^3.18.0",
-    "yaml": "^2.9.0"
+    "yaml": "^2.9.0",
+    "@deepseek-ai/schemastery": "^3.18.3"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",