dsh-email 0.14.6 → 0.14.7

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.14.7（2026-10-02）
+
+- Fix account cards displaying preset endpoints instead of explicitly configured servers; refresh the summary after saves and provider changes without persisting projections.
+- Upgrade ImapFlow, Mailparser, Nodemailer and the transitive IP address parser; use Nodemailer's bundled types.
+- Handle missing IMAP messages, empty searches and missing attachment streams with explicit recovery errors.
+- Add regression coverage for endpoint display and empty IMAP responses. Windows: 304 tests; production dependency audit: 0 findings.
+
 ## 0.14.6（2026-10-02）
 
 - 完成 [PR #18](https://github.com/STARDUSTLC666/dsh-email/pull/18) 的兼容合并：未修改的表单端点不再产出空对象，避免旧设置和不完整草稿覆盖配置文件里手动填写的 IMAP/SMTP 服务器。

package/README.en.md

@@ -1,5 +1,12 @@
 # dsh-email
 
+## 0.14.7 update (2026-10-02)
+
+- Account cards display the effective IMAP/SMTP endpoints. Changing providers clears stale display values without persisting the endpoint summary into account configuration.
+- Upgrade to ImapFlow 2.2.1, Mailparser 3.9.33 and Nodemailer 10.0.13, adapt upstream types and empty responses, and eliminate the production dependency audit findings.
+- Give recovery guidance when a message or attachment disappears during a request; empty search responses remain empty lists.
+- All 304 tests pass on Windows, including local SMTP TLS, STARTTLS, cancellation and OAuth2 protocol fixtures. Production mailbox login and delivery still require user acceptance.
+
 ## 0.14.6 update (2026-10-02)
 
 Completes [PR #18](https://github.com/STARDUSTLC666/dsh-email/pull/18): untouched saved form endpoints and partial drafts with empty endpoints preserve explicitly configured row IMAP/SMTP servers. The Outlook 587/STARTTLS fix and deliberate port/TLS overrides remain supported.

package/README.md

@@ -2,6 +2,13 @@
 
 # dsh-email
 
+## 0.14.7 更新（2026-10-02）
+
+- 账号卡片显示实际生效的 IMAP/SMTP 地址；切换服务商时清掉旧地址的显示，服务器摘要不会写回账号配置。
+- 升级 ImapFlow 2.2.1、Mailparser 3.9.33、Nodemailer 10.0.13，适配上游类型与空响应，生产依赖审计为 0。
+- 邮件或附件在请求期间消失时给出恢复提示；空搜索结果保持为空列表。
+- Windows 304 项测试通过，包括本地 SMTP TLS、STARTTLS、取消发送与 OAuth2 协议样例。真实邮箱登录与发信仍需使用者验收。
+
 ## 0.14.6 更新（2026-10-02）
 
 完成 [PR #18](https://github.com/STARDUSTLC666/dsh-email/pull/18)：旧设置里未修改的端点默认值，以及只包含空端点的不完整草稿，保留配置文件中手动填写的 IMAP/SMTP 服务器。沿用 Outlook 587/STARTTLS 修复，并保留用户明确指定的端口和 TLS 组合。

package/lib/client.js

@@ -751,9 +751,8 @@ function isOauthDraft(draft) {
 
 /**
  * 服务端卡片（永不含密码明文）-> 草稿。user 为空表示「就留空」，不是未加载。
- * 账号在 YAML 里只存 provider id：卡片带着的 imap/smtp 是「这个预设展开出来的
- * 端点」（快照算给你看的），不是账号自己的字段，所以一概不读 —— 读了就会在保存
- * 时把一份会过期的端点抄回 YAML。卡片上的端点显示改从 presets 查（providerMetaText）。
+ * 卡片的 imap/smtp 是后端计算的生效端点，只用于显示，不写回 YAML。
+ * 它们可能包含用户明确指定的服务器，不能用服务商默认值代替。
  * authKind/oauthState/oauthUser 是卡片的登录态投影，只用于显示与本地判定，
  * 不进 draftToInput（它们不是 YAML 的字段，后端认的是账号自己的 oauth 段）。
  */
@@ -848,6 +847,8 @@ function applyPreset(draft, provider) {
   const next = provider === undefined || provider === null ? "" : String(provider);
   return Object.assign({}, draft, {
     provider: next,
+    imap: undefined,
+    smtp: undefined,
     password: "",
     authKind: undefined,
     oauthState: "none",
@@ -938,25 +939,32 @@ function presetEndpointText(endpoint) {
 }
 
 /**
- * 卡片 meta 行里的「连去哪」：账号只存 provider id，端点是预设展开的，所以这里
- * 一律回头查预设表，不读草稿自己的 imap/smtp（那份副本已经不存在了）。
- * 内置预设显示内置名 + 它的端点；自定义预设显示 label（没 label 用预设名）+ 端点；
- * 名字连预设都没定义时明说「未定义预设」；压根没选服务商就直说。
+ * 卡片显示后端的生效服务器，含手动覆盖；换服务商的未保存草稿才查预设。
+ * 保存后的新快照优先，避免自定义预设更新后继续显示旧地址。
  */
-function providerMetaText(draft, presets) {
+function providerMetaText(draft, presets, cards) {
   const provider = String(draft.provider || "").trim();
-  if (provider === "") return t("card.noProvider");
+  const saved = (cards || []).find(card => card.name === draft.name)
+    || (cards || []).find(card => card.name === draft.originalName);
+  const actual = saved && String(saved.provider || "").trim() === provider ? saved : draft;
+  const endpoints = fallback => ({
+    imap: actual.imap && actual.imap.host ? actual.imap : fallback && fallback.imap,
+    smtp: actual.smtp && actual.smtp.host ? actual.smtp : fallback && fallback.smtp,
+  });
+  const describe = (name, fallback) => {
+    const target = endpoints(fallback);
+    return name + t("card.builtinEndpoints", { imap: presetEndpointText(target.imap), smtp: presetEndpointText(target.smtp) });
+  };
+  if (provider === "") return actual.imap?.host || actual.smtp?.host ? describe(t("provider.custom")) : t("card.noProvider");
   const entry = PROVIDERS.filter(([value]) => value === provider)[0];
   if (entry) {
     const builtin = (presets && presets.builtin && presets.builtin[provider]) || undefined;
-    if (builtin === undefined) return t(entry[1]);
-    return t(entry[1]) + t("card.builtinEndpoints", { imap: presetEndpointText(builtin.imap), smtp: presetEndpointText(builtin.smtp) });
+    return describe(t(entry[1]), builtin);
   }
   const custom = (presets && presets.custom) || {};
   if (!Object.prototype.hasOwnProperty.call(custom, provider)) return provider + t("provider.undefinedPresetSuffix");
   const preset = custom[provider] || undefined;
-  if (preset === undefined) return presetLabelOf(provider, undefined);
-  return presetLabelOf(provider, preset) + t("card.customEndpoint", { endpoint: presetEndpointText(preset.imap) });
+  return describe(presetLabelOf(provider, preset), preset);
 }
 
 // ---------------------------------------------------------------------------
@@ -1717,7 +1725,7 @@ function AccountCardsEditor(props) {
           t("card.meta", {
             address: draft.user || t("card.noAddress"),
             folder: draft.inboxFolder || "INBOX",
-            provider: providerMetaText(draft, presets),
+            provider: providerMetaText(draft, presets, cards),
           })),
         status
           ? h("div", { className: "dshe-hint" + (status.kind === "error" ? " dshe-acc-warn" : "") }, status.text)

package/lib/mail-client.js

@@ -356,7 +356,7 @@ export class EmailPool {
         // 附件索引只需要 MIME 结构：bodyStructure 已经给出每个附件的 part/名称/大小，
         // 不必为了拿它先拉整封 source（第一次就下载附件的邮件也一样）。
         const message = await client.fetchOne(uid, { uid: true, bodyStructure: true }, { uid: true });
-        if (message === false) {
+        if (message === false || message === undefined) {
             throw new MailError('找不到 uid=' + uid + ' 的邮件（可能已被删除，或不在文件夹 "' + folder + '"）');
         }
         signal?.throwIfAborted();
@@ -371,7 +371,7 @@ export class EmailPool {
         const full = message.source !== undefined
             ? message
             : await client.fetchOne(uid, { uid: true, source: true, bodyStructure: true }, { uid: true });
-        if (full === false || full.source === undefined) {
+        if (full === false || full === undefined || full.source === undefined) {
             throw new MailError('找不到 uid=' + uid + ' 的邮件（可能已被删除，或不在文件夹 "' + folder + '"）');
         }
         const body = await parseRawMessage(full.source, this.settings.maxBodyChars);
@@ -585,7 +585,7 @@ export class EmailPool {
             greetingTimeout: 10000,
             socketTimeout: 60000,
             getSocket: (options, callback) => {
-                const socket = createConnection({ host: options.host ?? cfg.smtp.host, port: options.port ?? cfg.smtp.port });
+                const socket = createConnection({ host: options.host ?? cfg.smtp.host, port: Number(options.port ?? cfg.smtp.port) });
                 onSocket(socket);
                 let settled = false;
                 const finish = (error, socketOptions) => {
@@ -715,6 +715,8 @@ export class EmailPool {
     async downloadPartText(client, uid, part, maxBytes, signal) {
         const dl = await client.download(uid, part.key, { uid: true, maxBytes });
         signal?.throwIfAborted();
+        if (dl.content === undefined)
+            throw new MailError('邮件正文分段已不存在；将尝试重新读取邮件');
         const buf = await collectStream(dl.content, maxBytes, signal);
         signal?.throwIfAborted();
         return buf.toString('utf8');
@@ -757,7 +759,7 @@ export class EmailPool {
                     query.before = until;
                 const found = await client.search(query, { uid: true });
                 signal?.throwIfAborted();
-                uids = found === false ? [] : found;
+                uids = Array.isArray(found) ? found : [];
                 scopeCount = uids.length;
             }
             else if (total > 0) {
@@ -785,7 +787,7 @@ export class EmailPool {
             const uidValidity = mailbox === false ? 0 : Number(mailbox.uidValidity ?? 0);
             const found = await client.search({ seen: false }, { uid: true });
             signal?.throwIfAborted();
-            const uids = (found === false ? [] : found).slice().sort((a, b) => b - a);
+            const uids = (Array.isArray(found) ? found : []).slice().sort((a, b) => b - a);
             return { account: name, folder: folderName, uidValidity, count: uids.length, uids };
         }, true, signal);
     }
@@ -822,7 +824,7 @@ export class EmailPool {
                 client.search({ cc: query, ...dateRange }, { uid: true }),
             ]);
             signal?.throwIfAborted();
-            const uids = [...new Set(found.flatMap(result => result === false ? [] : result))].sort((a, b) => b - a);
+            const uids = [...new Set(found.flatMap(result => Array.isArray(result) ? result : []))].sort((a, b) => b - a);
             if (uids.length > 0) {
                 // The sample has to cover the requested page (offset + limit) — the same
                 // window the fallback scan looks at — so one FETCH serves both the
@@ -938,7 +940,7 @@ export class EmailPool {
             // 先只要信封与 MIME 结构，正文按 text/* 分段下载：带 20 MiB 附件的邮件
             // 只为看正文时不再整封拉下来，附件元数据直接复用 bodyStructure。
             const message = await client.fetchOne(uid, { uid: true, envelope: true, bodyStructure: true }, { uid: true });
-            if (message === false) {
+            if (message === false || message === undefined) {
                 throw new MailError('找不到 uid=' + uid + ' 的邮件（可能已被删除，或不在文件夹 "' + folderName + '"；可用 email_list 重新获取 uid）');
             }
             signal?.throwIfAborted();
@@ -979,7 +981,7 @@ export class EmailPool {
             const full = message.source !== undefined
                 ? message
                 : await client.fetchOne(uid, { uid: true, source: true, bodyStructure: true }, { uid: true });
-            if (full === false || full.source === undefined) {
+            if (full === false || full === undefined || full.source === undefined) {
                 throw new MailError('找不到 uid=' + uid + ' 的邮件（可能已被删除，或不在文件夹 "' + folderName + '"；可用 email_list 重新获取 uid）');
             }
             const body = await parseRawMessage(full.source, this.settings.maxBodyChars);
@@ -995,7 +997,7 @@ export class EmailPool {
         return this.withImap(name, folderName, async (client) => {
             const before = await client.fetchOne(uid, { uid: true, flags: true }, { uid: true });
             signal?.throwIfAborted();
-            if (before === false) {
+            if (before === false || before === undefined) {
                 throw new MailError('找不到 uid=' + uid + ' 的邮件（可能已被删除，或不在文件夹 "' + folderName + '"；可用 email_list 重新获取 uid）');
             }
             let seen = before.flags?.has('\\Seen') === true;
@@ -1090,8 +1092,10 @@ export class EmailPool {
             }
             const dl = await client.download(uid, att.part, { uid: true, maxBytes: this.settings.maxAttachmentBytes });
             signal?.throwIfAborted();
+            if (dl.content === undefined)
+                throw new MailError('附件分段已不存在，请重新读取邮件后再下载');
             const buf = await collectStream(dl.content, this.settings.maxAttachmentBytes, signal);
-            const safeName = sanitizeFilename(dl.meta.filename ?? att.filename ?? attachments[index].filename);
+            const safeName = sanitizeFilename(dl.meta?.filename ?? att.filename ?? attachments[index].filename);
             // Default the destination to the session workspace so the model can
             // read the file back; an explicit downloadDir always wins.
             const dir = this.settings.downloadDirExplicit
@@ -1135,7 +1139,7 @@ export class EmailPool {
         // leaves a half-written mailbox state behind.
         const built = await this.withImap(name, folderName, async (client) => {
             const message = await client.fetchOne(uid, { uid: true, source: true }, { uid: true });
-            if (message === false || message.source === undefined) {
+            if (message === false || message === undefined || message.source === undefined) {
                 throw new MailError('找不到 uid=' + uid + ' 的邮件（可能已被删除，或不在文件夹 "' + folderName + '"；可用 email_list 重新获取 uid）');
             }
             const ids = extractMessageIds(message.source);

package/lib/web.js

@@ -56,9 +56,8 @@ function accountEndpoint(preset, own, fallback) {
  * render as a card. Nothing here resolves, validates or touches the network —
  * an unknown provider degrades that one card's endpoints, never the list.
  *
- * The endpoints are read from the *preset* only: an account stores a provider
- * id, so a stale hand-written `imap.host` in an existing YAML must not show up
- * in the editor as if it still drove the connection.
+ * Explicit account endpoints override the preset, exactly as in connection
+ * resolution. The card reports them for display without writing them back.
  *
  * `tokens` is the OAuth2 login state, looked up once per snapshot rather than
  * per card: the token file is read from disk, and a card is rendered on every

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-email",
-  "version": "0.14.6",
+  "version": "0.14.7",
   "description": "DSH 邮件插件：IMAP/SMTP 收发搜索、回复转发、附件与整理，多账号卡片设置页、Outlook OAuth2 登录与发信审批。",
   "type": "module",
   "main": "lib/index.js",
@@ -61,16 +61,15 @@
     }
   },
   "dependencies": {
-    "imapflow": "^1.7.0",
-    "mailparser": "^3.9.22",
-    "nodemailer": "^9.0.5",
+    "imapflow": "^2.2.1",
+    "mailparser": "^3.9.33",
+    "nodemailer": "^10.0.13",
     "schemastery": "^3.18.0",
     "yaml": "^2.9.0",
     "@deepseek-ai/schemastery": "^3.18.3"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
-    "@types/nodemailer": "^8.0.1",
     "typescript": "^5.7.3"
   }
 }