dsh-email 0.14.1 → 0.14.4

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.14.4（2026-09-29）
+
+- 修复：SMTP 发送改为**每次发送独占连接**，取消（AbortSignal）时只销毁本次连接的 socket 并立即拒绝，不再影响同账号的其它发送，也不会在取消后仍把邮件发出去。
+- 修复：OAuth2 令牌刷新与取消的竞态——取消后即使令牌刷新成功也不再继续发送。
+- 测试：修正 TLS fixture 的两处握手缺陷（STARTTLS 明文阶段未发送 220；取消用例把 greeting 压住导致走不到 TLS 升级），TLS 与取消回归现可稳定通过（285 项）。
+## 0.14.3（2026-09-28）
+
+- 兼容验证更新到 Harness 0.2.0-rc.1：282 项邮件测试与 18 插件共同加载检查通过。
+- 运行时代码未变；同步中英文兼容性声明。
+
+## 0.14.2（2026-09-28）
+
+- 修复 [#17](https://github.com/STARDUSTLC666/dsh-email/issues/17)：空主机配合未修改的表单默认端口/TLS 不再覆盖服务商预设；Outlook 恢复 587/STARTTLS。旧设置转换和 Harness 0.1.7 已迁移配置共用归一化规则，保留自定义主机、非默认组合和不含占位 host 的显式端口覆盖。
+- 感谢 [SenkjM 的 PR #18](https://github.com/STARDUSTLC666/dsh-email/pull/18) 提供复现与修复方向。本次补齐新版运行时路径并避免误删明确的端口设置；282 项邮件测试通过。配置和界面验证不代表真实 SMTP 投递已验证。
+
 ## 0.14.1（2026-09-27）
 
 - 未补全的账号和服务器预设会显示未保存提示；避免草稿丢失和错误的“已保存”状态。测试连接只校验所选账号，错误直接指向设置页中的对应字段。

package/README.en.md

@@ -1,10 +1,10 @@
 # dsh-email
 
-## 0.14.1 update (2026-09-27)
+## 0.14.2 update (2026-09-28)
 
-Incomplete account and server-preset drafts display an unsaved status and are protected against accidental navigation. Connection tests validate the selected account independently and identify the relevant settings field.
+Fixes saved blank-host defaults overriding Outlook's 587/STARTTLS preset, including legacy settings migrated to Harness 0.1.7. Explicit custom hosts, ports and TLS choices remain effective. Thanks to [SenkjM for the reproduction and proposed fix in #17 / #18](https://github.com/STARDUSTLC666/dsh-email/pull/18).
 
-Validation host: Harness 0.1.7-rc.2 built from official sources, retaining the local tool-scheduler fix. Build and automated checks pass; interactive coverage and external-service limits are recorded in this release round.
+Validation host: Harness `0.2.0-rc.1` built from official sources (commit `407e65c8`) with Node `24.16.0` on 2026-09-28. All 282 plugin tests pass in an isolated environment; all 18 plugins mount together in one host registering 10 tools, with tool schemas and health-check contracts passing. No live ports or external services were exercised in this round.
 
 ![npm](https://img.shields.io/npm/v/dsh-email) ![downloads](https://img.shields.io/npm/dm/dsh-email) ![license](https://img.shields.io/github/license/STARDUSTLC666/dsh-email) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-email?style=social)
 
@@ -53,11 +53,7 @@ Example:
 - **0.10.8 and earlier**: see [CHANGELOG.md](CHANGELOG.md).
 ## Compatibility
 
-The current baseline is official-source Harness **0.1.7-alpha.2** (2026-09-23, with a local `Symbol.for` tool-scheduler fix). All 18 plugins load together. Legacy migration, editing and automatic saving in the real Web UI, refresh, revision conflicts and restart persistence have been checked with isolated fixture accounts. No live mailbox connection or sending was exercised in this round.
-
-2026-09-21: the current release package was installed through the official CLI in an isolated profile and co-loaded with the other two most-downloaded plugins on source-built Harness `0.1.6-alpha.2`. All 18 plugin tools registered; calendar/email configuration checks, PPT theme listing and 17-row table generation passed. The host is based on the official alpha.2 release plus the tool-scheduler `Symbol.for` fix (`93badd88`). This run did not connect to live mail or calendar services.
-
-Co-load verification was performed on 2026-09-16 with official source builds of Harness `0.1.5-rc.2` and `0.1.6-alpha.1`: all 18 components load alongside ModLens, with passing tool schemas, skill registration and offline read-only calls.
+The current baseline is official-source Harness **0.2.0-rc.1** (2026-09-28, with a local `Symbol.for` tool-scheduler fix). All 18 plugins load together. Settings coverage includes legacy migration, real Web UI editing and automatic saving, refresh, revision conflicts and restart persistence with isolated fixture accounts. No live mailbox connection or sending was exercised in this round.
 
 **0.11.0 co-load verification (2026-09-18, locally built Harness `0.1.5-rc.2`, `web` profile)**: the plugin mounted without errors; the settings route answered GET with 200 and no `raw` field in the response; a `text/plain` POST was refused with **415**, proving the same-origin guard holds in the real host; under a `application/json` POST the card projection was correct, and an account pinning `authKind: password` reported both `authKindDeclared` and `authKind` as `password`; the panel actually rendered account cards, the eight provider presets with localized labels, the three-way authentication selector, the application (client) ID field with its hint, the missing-ID warning banner (so `--dsw-alias-state-warn-primary` is genuinely defined in the real host) and the Sign in with Microsoft button; the browser console was clean; save worked end to end, and afterwards `accountsYaml` was restored to empty with the original account intact. Offline tests: 231 green. **Still not done**: an end-to-end OAuth2 run against a real Outlook tenant (the device-code flow needs a human to authorize in a browser) and real sending; the `clientId` paths are covered only against a fake authority. Uses the `cordis.patch.yml` + `dsh.bundle.patch` bundle model. Node requirements are 22.19 or later within 22.x, or 24 or later. Live external-service workflows require separate configuration and validation.
 

package/README.md

@@ -2,11 +2,11 @@
 
 # dsh-email
 
-## 0.14.1 更新（2026-09-27）
+## 0.14.2 更新（2026-09-28）
 
-未补全的账号和服务器预设会显示未保存提示；避免草稿丢失和错误的“已保存”状态。测试连接只校验所选账号，错误直接指向设置页中的对应字段。
+修复保存过的空服务器默认值覆盖 Outlook 预设的问题：恢复 `587 / STARTTLS`，并覆盖 Harness 0.1.7 的旧配置迁移路径。明确设置的自定义主机、端口和 TLS 仍然生效。感谢 [SenkjM 在 #17 / #18 提供复现和修复方向](https://github.com/STARDUSTLC666/dsh-email/pull/18)。
 
-验证宿主：官方源码构建的 Harness 0.1.7-rc.2（保留本地工具调度器修复）。构建与自动测试通过；实际操作和外部服务限制见本轮验收记录。
+验证宿主：官方源码构建的 Harness `0.2.0-rc.1`（commit `407e65c8`）+ Node `24.16.0`（2026-09-28）。282 项插件测试在隔离环境全部通过；同一个宿主里 18 个插件共同加载，注册 10 个工具，工具 schema 与健康检查契约通过。本轮未启用真实端口与外部服务。
 
 > **让 agent 协助处理邮件**：收发、搜索、回复转发、附件、邮件整理与新邮件提醒，支持八种常见邮箱服务预设。
 
@@ -61,16 +61,10 @@ IMAP/SMTP email tools for DeepSeek Harness, with replies, forwarding, mailbox or
 - **0.10.8 及更早**：见 [CHANGELOG.md](CHANGELOG.md)。
 ## 兼容性
 
-当前验证基线为官方源码构建的 Harness **0.1.7-alpha.2**（2026-09-23，含本地工具调度器 `Symbol.for` 修复）。18 个插件共同加载；邮件设置已通过旧配置迁移、真实网页编辑与自动保存、刷新恢复、修订冲突和重启持久化检查。本轮使用隔离测试账号，未连接真实邮箱或发送邮件。
-
-2026-09-21：当前发布包经官方 CLI 安装到隔离 profile，在源码构建的 Harness `0.1.6-alpha.2` 上与另外两个下载量前三插件共同加载，18 个插件工具注册正常；日历/邮件配置自检、PPT 主题查询和 17 行表格生成通过。测试本体基于官方 alpha.2 发布提交，另含工具调度器 `Symbol.for` 修复（`93badd88`）。本轮未连接真实邮箱或日历服务。
-
-2026-09-16 曾在官方源码构建的 Harness `0.1.5-rc.2` 和 `0.1.6-alpha.1` 上完成同载验证：18 个组件与 ModLens 同载，工具 schema、技能注册及离线只读调用检查通过。
+当前验证基线为官方源码构建的 Harness **0.2.0-rc.1**（2026-09-28，含本地工具调度器 `Symbol.for` 修复）。18 个插件共同加载；邮件设置覆盖旧配置迁移、真实网页编辑与自动保存、刷新恢复、修订冲突和重启持久化检查。本轮使用隔离测试账号，未连接真实邮箱或发送邮件。
 
 **0.11.0 的同载验证（2026-09-18，本地构建的 Harness `0.1.5-rc.2`，`web` profile）**：插件挂载无报错；设置路由 GET 返回 200 且响应中已无 `raw` 字段；用 `text/plain` 发 POST 被 **415** 拒绝（同源守卫在真实宿主下生效）；`application/json` 的 POST 下卡片投影正确，账号钉住 `authKind: password` 后 `authKindDeclared` 与 `authKind` 均为 `password`；设置面板实际渲染出账号卡片、8 个服务商预设的中文下拉、「认证方式」三态选择器、「应用（客户端）ID」输入格与提示、未填 ID 时的警示条（说明 `--dsw-alias-state-warn-primary` 在真实宿主下确有定义）与「登录 Microsoft 账号」按钮；浏览器控制台无报错；save 全链路可用，验证结束后已把 `accountsYaml` 还原为空、原有账号恢复。离线测试 231 项全绿。**仍未做**：真实 Outlook 租户的 OAuth2 端到端（设备码流程要真人在浏览器完成授权）与真实发信未测，`clientId` 相关路径目前只有假 authority 的用例覆盖。采用 `cordis.patch.yml` + `dsh.bundle.patch` 组合包模型。Node 要求为 22.19 及以上的 22.x，或 24 及以上。外部服务的实际业务操作需按各组件配置单独验证。
 
-2026-09-10，npm `dsh-email@0.10.6` 曾通过真实 QQ 邮箱目录、列表、读取和搜索，以及设置页“测试连接”“保存并应用”检查；授权码留空时能继续使用 `DSH_EMAIL_PASSWORD`。独立 SMTP 登录认证也已通过。此次复验未连接真实邮箱，未发送、修改或删除邮件。
-
 遵循官方[插件打包与安装要求](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/user/develop/basic/publish.md)：ESM 入口、预构建 `lib/`、`dsh.bundle.patch` 和 `cordis.patch.yml` 配置层；显式注入所需服务，提供 JSON Schema 参数、规范化输出和渲染函数，运行时不导入宿主内部服务；配置声明使用官方 `@deepseek-ai/schemastery` 公共包。使用 Node 22.19 及以上的 22.x 或 Node 24 及以上版本；Harness 仍在快速迭代，上述版本是实测基线。
 
 ## 安装

package/lib/config.d.ts

@@ -56,6 +56,18 @@ export interface SmtpConfig {
     port?: number;
     secure?: boolean;
 }
+/** Legacy form placeholders; an untouched blank-host endpoint delegates to its provider. */
+export declare const ENDPOINT_DEFAULTS: {
+    readonly imap: {
+        readonly port: 993;
+        readonly secure: true;
+    };
+    readonly smtp: {
+        readonly port: 465;
+        readonly secure: true;
+    };
+};
+export declare function normalizeSettingsEndpoint<T extends SmtpConfig>(value: T, kind: keyof typeof ENDPOINT_DEFAULTS): Omit<T, 'host' | 'port' | 'secure'> & SmtpConfig;
 /** One mailbox account. Top-level shorthand fields act as shared defaults. */
 export interface AccountConfig {
     /** Built-in provider name, or a custom serverPresets name. */

package/lib/config.js

@@ -34,6 +34,24 @@ export const OUTLOOK_IMAP_HOST = 'outlook.office365.com';
  * them, so such a release asks every built-in account to log in one more time.
  */
 export const OUTLOOK_OAUTH2_CLIENT_ID = '15dcd5aa-00dd-487f-82d7-1d2b2c299e14';
+/** Legacy form placeholders; an untouched blank-host endpoint delegates to its provider. */
+export const ENDPOINT_DEFAULTS = {
+    imap: { port: 993, secure: true }, smtp: { port: 465, secure: true },
+};
+export function normalizeSettingsEndpoint(value, kind) {
+    if (typeof value.host !== 'string' || value.host.trim() !== '')
+        return value;
+    const normalized = { ...value };
+    delete normalized.host;
+    const defaults = ENDPOINT_DEFAULTS[kind];
+    // A changed port or TLS choice is intentional; preserve that whole combination.
+    if ((value.port === undefined || value.port === defaults.port)
+        && (value.secure === undefined || value.secure === defaults.secure)) {
+        delete normalized.port;
+        delete normalized.secure;
+    }
+    return normalized;
+}
 export const PROVIDER_PRESETS = {
     qq: { imap: { host: 'imap.qq.com', port: 993, secure: true }, smtp: { host: 'smtp.qq.com', port: 465, secure: true } },
     '163': { imap: { host: 'imap.163.com', port: 993, secure: true }, smtp: { host: 'smtp.163.com', port: 465, secure: true } },
@@ -340,17 +358,21 @@ function resolveAccount(name, common, acc, allowEnvPassword, providers, known) {
     const authUser = (acc.authUser ?? common.authUser ?? '').trim() || user;
     const authPassword = (acc.authPassword ?? common.authPassword) || password;
     const senderName = (acc.senderName ?? common.senderName ?? '').trim();
+    const accountImap = acc.imap && normalizeSettingsEndpoint(acc.imap, 'imap');
+    const sharedImap = common.imap && normalizeSettingsEndpoint(common.imap, 'imap');
+    const accountSmtp = acc.smtp && normalizeSettingsEndpoint(acc.smtp, 'smtp');
+    const sharedSmtp = common.smtp && normalizeSettingsEndpoint(common.smtp, 'smtp');
     const imap = {
-        host: acc.imap?.host ?? common.imap?.host ?? preset?.imap.host,
-        port: acc.imap?.port ?? common.imap?.port ?? preset?.imap.port,
-        secure: acc.imap?.secure ?? common.imap?.secure ?? preset?.imap.secure,
-        connectionTimeoutMs: acc.imap?.connectionTimeoutMs ?? common.imap?.connectionTimeoutMs,
-        socketTimeoutMs: acc.imap?.socketTimeoutMs ?? common.imap?.socketTimeoutMs,
+        host: accountImap?.host ?? sharedImap?.host ?? preset?.imap.host,
+        port: accountImap?.port ?? sharedImap?.port ?? preset?.imap.port,
+        secure: accountImap?.secure ?? sharedImap?.secure ?? preset?.imap.secure,
+        connectionTimeoutMs: accountImap?.connectionTimeoutMs ?? sharedImap?.connectionTimeoutMs,
+        socketTimeoutMs: accountImap?.socketTimeoutMs ?? sharedImap?.socketTimeoutMs,
     };
     const smtp = {
-        host: acc.smtp?.host ?? common.smtp?.host ?? preset?.smtp.host,
-        port: acc.smtp?.port ?? common.smtp?.port ?? preset?.smtp.port,
-        secure: acc.smtp?.secure ?? common.smtp?.secure ?? preset?.smtp.secure,
+        host: accountSmtp?.host ?? sharedSmtp?.host ?? preset?.smtp.host,
+        port: accountSmtp?.port ?? sharedSmtp?.port ?? preset?.smtp.port,
+        secure: accountSmtp?.secure ?? sharedSmtp?.secure ?? preset?.smtp.secure,
     };
     const problems = [];
     if (user === '')

package/lib/mail-client.d.ts

@@ -108,8 +108,7 @@ export declare function extractMessageIds(source: Buffer): {
  */
 export declare function buildReplyMessage(original: OriginalDigest, mode: EmailReplyMode, selfAddress: string | readonly string[], text: string, forwardTo?: string): BuiltReply;
 /**
- * One mailbox pool for the whole plugin: pooled IMAP connections per
- * account plus pooled SMTP transporters, with idle sweep and error eviction.
+ * One mailbox pool for the whole plugin: pooled IMAP connections per account.
  */
 export declare class EmailPool {
     private readonly settings;
@@ -155,14 +154,13 @@ export declare class EmailPool {
     startIdleSweep(): void;
     dispose(): void;
     /**
-     * A pooled transporter for one account. The token is captured when the
-     * transporter is built; an OAuth2 token that turns out to be stale is
-     * re-minted in sendMail, which rebuilds the transporter.
+     * Create an unpooled sender with its own socket. The socket callback exposes
+     * only the public SMTP transport hook to the cancellation owner.
      */
     private transporter;
-    private dropTransporter;
     /**
-     * Send through the pooled transporter while making cancellation close it.
+     * Give each send its own SMTP connection so cancellation can close that
+     * operation without closing another send for the same account.
      *
      * An OAuth2 transporter carries a token that was minted when it was built,
      * so a rejection is retried once against a freshly built one (and a fresh

package/lib/mail-client.js

@@ -1,5 +1,6 @@
 import { ImapFlow } from 'imapflow';
 import nodemailer from 'nodemailer';
+import { createConnection } from 'node:net';
 import { mkdir, stat, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { getFreshAccessToken, OAuth2Error } from './oauth2.js';
@@ -293,8 +294,7 @@ const READ_CACHE_TTL_MS = 10 * 60 * 1000;
 /** Folder names change rarely; a short TTL keeps email_folders off the wire. */
 const FOLDER_CACHE_TTL_MS = 60 * 1000;
 /**
- * One mailbox pool for the whole plugin: pooled IMAP connections per
- * account plus pooled SMTP transporters, with idle sweep and error eviction.
+ * One mailbox pool for the whole plugin: pooled IMAP connections per account.
  */
 export class EmailPool {
     settings;
@@ -566,41 +566,64 @@ export class EmailPool {
         this.idleTimer = undefined;
         for (const name of [...this.imaps.keys()])
             void this.evictImap(name);
-        for (const transporter of this.smtps.values())
+        for (const [transporter, socket] of this.smtps) {
+            socket?.destroy();
             transporter.close();
+        }
         this.smtps.clear();
     }
     /**
-     * A pooled transporter for one account. The token is captured when the
-     * transporter is built; an OAuth2 token that turns out to be stale is
-     * re-minted in sendMail, which rebuilds the transporter.
+     * Create an unpooled sender with its own socket. The socket callback exposes
+     * only the public SMTP transport hook to the cancellation owner.
      */
-    transporter(name, cfg, accessToken) {
-        let t = this.smtps.get(name);
-        if (t === undefined) {
-            t = nodemailer.createTransport({
-                pool: true,
-                host: cfg.smtp.host,
-                port: cfg.smtp.port,
-                secure: cfg.smtp.secure,
-                auth: smtpAuthOf(cfg, accessToken),
-                connectionTimeout: 30000,
-                greetingTimeout: 10000,
-                socketTimeout: 60000,
-                maxConnections: 2,
-                maxMessages: 50,
-            });
-            this.smtps.set(name, t);
-        }
-        return t;
-    }
-    dropTransporter(name, transporter) {
-        if (this.smtps.get(name) === transporter)
-            this.smtps.delete(name);
-        transporter.close();
+    transporter(name, cfg, accessToken, signal, onSocket) {
+        const transporter = nodemailer.createTransport({
+            host: cfg.smtp.host,
+            port: cfg.smtp.port,
+            secure: cfg.smtp.secure,
+            auth: smtpAuthOf(cfg, accessToken),
+            connectionTimeout: 30000,
+            greetingTimeout: 10000,
+            socketTimeout: 60000,
+            getSocket: (options, callback) => {
+                const socket = createConnection({ host: options.host ?? cfg.smtp.host, port: options.port ?? cfg.smtp.port });
+                onSocket(socket);
+                let settled = false;
+                const finish = (error, socketOptions) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    clearTimeout(timer);
+                    socket.removeListener('connect', onConnect);
+                    socket.removeListener('error', onError);
+                    signal?.removeEventListener('abort', onAbort);
+                    if (error !== null)
+                        socket.destroy();
+                    callback(error, socketOptions);
+                };
+                const onConnect = () => {
+                    if (signal?.aborted === true) {
+                        finish(signal.reason instanceof Error ? signal.reason : new Error('SMTP connection aborted'));
+                    }
+                    else
+                        finish(null, { connection: socket });
+                };
+                const onError = (error) => finish(error);
+                const onAbort = () => finish(signal?.reason instanceof Error ? signal.reason : new Error('SMTP connection aborted'));
+                const timer = setTimeout(() => finish(new Error('SMTP connection timeout')), 30000);
+                socket.once('connect', onConnect);
+                socket.once('error', onError);
+                signal?.addEventListener('abort', onAbort, { once: true });
+                if (signal?.aborted === true)
+                    onAbort();
+            },
+        });
+        this.smtps.set(transporter, undefined);
+        return transporter;
     }
     /**
-     * Send through the pooled transporter while making cancellation close it.
+     * Give each send its own SMTP connection so cancellation can close that
+     * operation without closing another send for the same account.
      *
      * An OAuth2 transporter carries a token that was minted when it was built,
      * so a rejection is retried once against a freshly built one (and a fresh
@@ -610,44 +633,78 @@ export class EmailPool {
     async sendMail(name, cfg, message, signal) {
         signal?.throwIfAborted();
         const attempt = async (forceToken) => {
-            const token = cfg.authKind === 'oauth2' ? await getFreshAccessToken(name, cfg, { force: forceToken }) : undefined;
-            const transporter = this.transporter(name, cfg, token);
-            const onAbort = () => {
-                this.dropTransporter(name, transporter);
-            };
-            signal?.addEventListener('abort', onAbort, { once: true });
+            let token;
+            if (cfg.authKind === 'oauth2') {
+                const refreshing = getFreshAccessToken(name, cfg, { force: forceToken });
+                if (signal === undefined)
+                    token = await refreshing;
+                else {
+                    let onAbort;
+                    const aborted = new Promise((_resolve, reject) => {
+                        onAbort = () => reject(signal.reason ?? new DOMException('The operation was aborted', 'AbortError'));
+                        signal.addEventListener('abort', onAbort, { once: true });
+                        if (signal.aborted)
+                            onAbort();
+                    });
+                    try {
+                        token = await Promise.race([refreshing, aborted]);
+                    }
+                    finally {
+                        if (onAbort !== undefined)
+                            signal.removeEventListener('abort', onAbort);
+                    }
+                }
+            }
+            signal?.throwIfAborted();
+            let smtpSocket;
+            const transporter = this.transporter(name, cfg, token, signal, socket => {
+                smtpSocket = socket;
+                this.smtps.set(transporter, socket);
+            });
+            let onAbort;
+            const aborted = signal === undefined ? undefined : new Promise((_resolve, reject) => {
+                onAbort = () => {
+                    smtpSocket?.destroy();
+                    transporter.close();
+                    reject(new MailError('SMTP发送已取消；服务器是否已接收邮件无法确认，请先检查邮箱再决定是否重发'));
+                };
+                signal.addEventListener('abort', onAbort, { once: true });
+            });
             try {
-                const info = await transporter.sendMail(message);
-                signal?.throwIfAborted();
+                const sending = transporter.sendMail(message);
+                const info = aborted === undefined ? await sending : await Promise.race([sending, aborted]);
                 return info;
             }
             finally {
-                signal?.removeEventListener('abort', onAbort);
+                if (onAbort !== undefined)
+                    signal?.removeEventListener('abort', onAbort);
+                smtpSocket?.destroy();
+                transporter.close();
+                this.smtps.delete(transporter);
             }
         };
         try {
             return await attempt(false);
         }
         catch (error) {
-            signal?.throwIfAborted();
+            if (signal?.aborted === true)
+                throw error;
             if (cfg.authKind !== 'oauth2')
                 throw error;
-            // A pooled connection that already authenticated can fail for reasons no
+            // A connection that already authenticated can fail for reasons no
             // token can fix (a rejected recipient, a full mailbox). Only a credential
             // rejection is worth a second, freshly-tokened attempt — and a token
             // store that refused outright is reported as itself.
             if (!looksLikeAuthFailure(error))
                 throw this.oauth2ErrorOf(error);
-            // The cached transporter holds the old token: it has to go, or the retry
-            // would reuse the very credential that was just refused.
-            const stale = this.smtps.get(name);
-            if (stale !== undefined)
-                this.dropTransporter(name, stale);
+            // A fresh transporter is created for the retry so it cannot reuse the
+            // credential that was just refused.
             try {
                 return await attempt(true);
             }
             catch (retryError) {
-                signal?.throwIfAborted();
+                if (signal !== undefined && Boolean(signal.aborted))
+                    throw retryError;
                 throw this.oauth2ErrorOf(retryError);
             }
         }

package/lib/settings.js

@@ -1,5 +1,5 @@
 import z from 'schemastery';
-import { PROVIDER_NAMES } from './config.js';
+import { ENDPOINT_DEFAULTS, normalizeSettingsEndpoint, PROVIDER_NAMES } from './config.js';
 /** Settings-document namespace this plugin owns (editable from the Web settings page). */
 export const SETTINGS_NAMESPACE = 'dsh-email';
 /**
@@ -22,13 +22,13 @@ export const EmailSettingsSchema = z.object({
     serverPresets: z.string().default(''),
     imap: z.object({
         host: z.string().default(''),
-        port: z.number().default(993),
-        secure: z.boolean().default(true),
+        port: z.number().default(ENDPOINT_DEFAULTS.imap.port),
+        secure: z.boolean().default(ENDPOINT_DEFAULTS.imap.secure),
     }),
     smtp: z.object({
         host: z.string().default(''),
-        port: z.number().default(465),
-        secure: z.boolean().default(true),
+        port: z.number().default(ENDPOINT_DEFAULTS.smtp.port),
+        secure: z.boolean().default(ENDPOINT_DEFAULTS.smtp.secure),
     }),
 });
 /** Project the row config (cordis.patch.yml) into the settings-schema base shape. */
@@ -45,15 +45,15 @@ export function toSettingsBase(config) {
         ...(config.imap !== undefined ? {
             imap: {
                 host: config.imap.host ?? '',
-                port: config.imap.port ?? 993,
-                secure: config.imap.secure ?? true,
+                port: config.imap.port ?? ENDPOINT_DEFAULTS.imap.port,
+                secure: config.imap.secure ?? ENDPOINT_DEFAULTS.imap.secure,
             },
         } : {}),
         ...(config.smtp !== undefined ? {
             smtp: {
                 host: config.smtp.host ?? '',
-                port: config.smtp.port ?? 465,
-                secure: config.smtp.secure ?? true,
+                port: config.smtp.port ?? ENDPOINT_DEFAULTS.smtp.port,
+                secure: config.smtp.secure ?? ENDPOINT_DEFAULTS.smtp.secure,
             },
         } : {}),
     };
@@ -131,7 +131,9 @@ export function toEmailConfig(value, user) {
     // serverPresets is intentionally NOT projected: it is UI-side metadata that
     // resolution never reads, and projecting it would put it into the resolved
     // fingerprint, so saving a preset would dispose every live IMAP connection.
-    const imapValue = draft.imap;
+    // Only a persisted blank host signals a placeholder. A schema-added blank
+    // host must not erase an explicit port-only override from the raw document.
+    const imapValue = user?.imap?.host !== undefined && draft.imap ? normalizeSettingsEndpoint(draft.imap, 'imap') : draft.imap;
     const imapKeys = user === null ? imapValue : user?.imap;
     if (isSet(imapKeys) && isSet(imapValue)) {
         const imap = {};
@@ -145,7 +147,7 @@ export function toEmailConfig(value, user) {
             imap.secure = imapValue.secure;
         out.imap = imap;
     }
-    const smtpValue = draft.smtp;
+    const smtpValue = user?.smtp?.host !== undefined && draft.smtp ? normalizeSettingsEndpoint(draft.smtp, 'smtp') : draft.smtp;
     const smtpKeys = user === null ? smtpValue : user?.smtp;
     if (isSet(smtpKeys) && isSet(smtpValue)) {
         const smtp = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-email",
-  "version": "0.14.1",
+  "version": "0.14.4",
   "description": "DSH 邮件插件：IMAP/SMTP 收发搜索、回复转发、附件与整理，多账号卡片设置页、Outlook OAuth2 登录与发信审批。",
   "type": "module",
   "main": "lib/index.js",