dsh-email 0.15.3 → 0.16.1

package/CHANGELOG.md

@@ -4,6 +4,15 @@
 
 [历史英文记录](docs/CHANGELOG.en.md)
 
+## 0.16.1 (2026-10-08)
+
+- 修复切换会话工作区后相对附件可能读取启动目录同名文件的问题：发信与草稿工具都按当前会话解析路径，绝对路径和无会话调用保持兼容。
+- 中英文账号页及模型工具说明区分逐次确认、主动启用的可信规则与禁止规则，提供 Full Access 下使用草稿手动核对的入口；修正配置文档中的禁止规则字段名。
+
+## 0.16.0 (2026-10-05)
+
+- 增加每账号收件人禁止地址与禁止域名；禁止规则优先于可信名单，并在所有发信路径的 SMTP 连接前拦截。草稿预览显示阻止原因并保留可编辑草稿。
+
 ## 0.15.3 (2026-10-04)
 
 - 完成 [#21](https://github.com/STARDUSTLC666/dsh-email/issues/21)：邮箱账号页新增「显示新邮件弹窗」开关，自动保存、重启后保留。关闭时隐藏当前卡片并停止自动邮件检查，不影响手动邮件工具。

package/README.en.md

@@ -6,7 +6,9 @@
 
 Read, send, search and organize email from DSH with multiple accounts.
 
-[![npm](https://img.shields.io/npm/v/dsh-email)](https://www.npmjs.com/package/dsh-email) [![downloads](https://img.shields.io/npm/dm/dsh-email)](https://www.npmjs.com/package/dsh-email)
+[![npm](https://img.shields.io/npm/v/dsh-email)](https://www.npmjs.com/package/dsh-email) [![downloads](https://raw.githubusercontent.com/STARDUSTLC666/dsh-suite/npm-downloads/assets/dsh-email-downloads.svg)](https://www.npmjs.com/package/dsh-email)
+
+Feedback and contributions are welcome: report [issues](https://github.com/STARDUSTLC666/dsh-email/issues) or submit [pull requests](https://github.com/STARDUSTLC666/dsh-email/pulls).
 
 ## What it does
 
@@ -15,7 +17,7 @@ Read, send, search and organize email from DSH with multiple accounts.
 - Configure multiple accounts, Outlook OAuth2 and send approval.
 - Turn new-mail popups off in settings; the preference survives restarts.
 - Prepare and edit local drafts, review To/Cc, content and attachment bytes, then confirm sending.
-- Manage trusted recipients per account and preview address, group and Cc matches.
+- Manage trusted and blocked recipients per account and preview address, group and Cc matches.
 
 ## Install
 

package/README.md

@@ -6,7 +6,9 @@
 
 在 DSH 中收发、搜索和整理邮件，支持多个邮箱账号。
 
-[![npm](https://img.shields.io/npm/v/dsh-email)](https://www.npmjs.com/package/dsh-email) [![downloads](https://img.shields.io/npm/dm/dsh-email)](https://www.npmjs.com/package/dsh-email)
+[![npm](https://img.shields.io/npm/v/dsh-email)](https://www.npmjs.com/package/dsh-email) [![downloads](https://raw.githubusercontent.com/STARDUSTLC666/dsh-suite/npm-downloads/assets/dsh-email-downloads.svg)](https://www.npmjs.com/package/dsh-email)
+
+欢迎使用，遇到问题或有改进建议，请提交 [issues](https://github.com/STARDUSTLC666/dsh-email/issues) 和 [PR](https://github.com/STARDUSTLC666/dsh-email/pulls)。
 
 ## 功能
 
@@ -15,7 +17,7 @@
 - 多账号设置，支持 Outlook OAuth2 和发信审批。
 - 新邮件弹窗可在设置中关闭，保存后重启仍生效。
 - 准备和编辑本地草稿，核对发件人、To/Cc、正文与附件预览后再确认发送。
-- 按账号管理可信收件人，预览规则如何匹配地址、地址组和抄送。
+- 按账号管理可信与禁止收件人，预览规则如何匹配地址、地址组和抄送。
 
 ## 安装
 

package/docs/CHANGELOG.en.md

@@ -4,6 +4,15 @@
 
 These English notes preserve the earlier translations. The main changelog contains the consolidated version history.
 
+## 0.16.1 (2026-10-08)
+
+- Resolve relative attachments against the current session workspace in both send and draft tools, preserving absolute paths and calls without session context.
+- Clarify saved trust, deny rules and Full Access confirmation behavior in both languages and model-facing descriptions; correct the documented deny-rule field names.
+
+## 0.16.0 (2026-10-05)
+
+- Add per-account blocked addresses and domains. Deny rules override trust and stop every sending path before SMTP connection. Draft previews explain the block and preserve editable drafts.
+
 ## 0.14.7 (2026-10-02)
 
 - Account cards display the effective IMAP/SMTP endpoints. Changing providers clears stale display values without persisting the endpoint summary into account configuration.

package/docs/DRAFTS.en.md

@@ -7,7 +7,7 @@
 Ask the assistant to use `email_draft`, or create a draft in Settings → Email → Drafts. The tool only saves a local draft; it does not submit mail. Parameters are `to`, `subject`, `text`, with optional `account`, `cc`, and an `attachments` array of local paths.
 
 1. Choose the sender account, edit To/Cc, subject and plain text, then save.
-2. Add attachments. Browser uploads become plugin-owned copies; tool-supplied paths remain references to the original files.
+2. Add attachments. Browser uploads become plugin-owned copies; tool-supplied paths remain references to the original files. Relative tool paths resolve against the current session workspace, while absolute paths remain exact. Calls without session context use the DSH startup directory.
 3. Review the actual sender and display name, every expanded To/Cc address, content, attachment names and sizes. Download preview attachments to inspect them.
 4. Acknowledge the review and confirm sending. Drafts require manual confirmation even when all recipients match trusted rules.
 

package/docs/DRAFTS.md

@@ -7,7 +7,7 @@
 让助手使用 `email_draft` 准备邮件，或在「设置 → 邮件 → 草稿」新建。这个工具只写本地草稿，不连接 SMTP 发信。参数为 `to`、`subject`、`text`，可选 `account`、`cc` 和本地附件路径数组 `attachments`。
 
 1. 选择发件账号，编辑 To、Cc、主题和纯文本正文，然后保存。
-2. 添加附件。网页文件选择器保存本插件的副本；工具提供的路径保留原文件引用。
+2. 添加附件。网页文件选择器保存本插件的副本；工具提供的路径保留原文件引用。工具中的相对路径按当前会话工作区解析，绝对路径保持原样；没有会话上下文时使用 DSH 启动目录。
 3. 点「检查发送预览」，核对真实发件地址与显示名、展开后的全部 To/Cc、正文、附件名称和大小。可下载本次预览的附件检查。
 4. 勾选已核对，再点「确认发送」。收件人规则即使全部匹配，草稿仍需这次手动确认。
 

package/docs/USAGE.en.md

@@ -2,6 +2,12 @@
 
 [Overview](../README.en.md) · [Changelog](../CHANGELOG.md) · [Validation](VALIDATION.md)
 
+## Current improvements
+
+Relative attachment paths in `email_send` and `email_draft` resolve against the current session workspace, avoiding a same-name file in the DSH startup directory after switching workspaces. Absolute paths remain exact; calls without session context retain startup-directory fallback.
+
+Set blocked addresses and domains per account in the Recipient Rules tab; the text configuration fields are `denyAddresses` / `denyDomains`. Rules cover To and Cc and remain active with send approval off. Domains match exactly, excluding subdomains unless listed. Remove blocked recipients and preview again before sending. Trust skips `email_send` plugin confirmation only when every To/Cc address matches and skipping has been explicitly enabled; host permissions still apply.
+
 ## Tools
 
 See the [draft workbench](DRAFTS.en.md) for editable drafts and per-account trusted recipients. The new workbench was validated with official Harness 0.2.0-rc.2.

package/docs/USAGE.md

@@ -2,6 +2,12 @@
 
 [返回简介](../README.md) · [更新记录](../CHANGELOG.md) · [验证记录](VALIDATION.md)
 
+## 本次改进
+
+`email_send` 和 `email_draft` 的相对附件路径以当前会话工作区为基准，避免切换工作区后误读 DSH 启动目录的同名文件；绝对路径保持原样，没有会话上下文时仍使用启动目录。
+
+在「收件人规则」页按账号设置禁止地址与域名；配置文本的字段为 `denyAddresses` / `denyDomains`。禁止规则覆盖 To、Cc，即使关闭发信确认也生效。域名按完整域名匹配，不自动包含子域名。移除被禁止的收件人并重新预览后才能确认发送；只有全部 To/Cc 匹配且主动开启的可信规则才会跳过 `email_send` 插件确认，宿主权限仍生效。
+
 ## 工具一览
 
 可编辑草稿和按账号的可信收件人规则见[草稿工作台](DRAFTS.md)。新工作台已用官方 Harness 0.2.0-rc.2 验收。

package/docs/VALIDATION.md

@@ -1,5 +1,7 @@
 # dsh-email 验证记录
 
+[0.16.1 会话附件与发信策略验收](validation/0.16.1.md)。
+
 [0.15.3 通知开关验收](validation/0.15.3.md)。
 
 [0.15.2 中英文界面验收](validation-language-2026-10-03.md)。

package/docs/validation/0.16.1.md

@@ -0,0 +1,21 @@
+# 0.16.1：会话附件与发信策略说明
+
+日期：2026-10-08。Windows / Node 24.16.0，官方 DSH 0.2.1-alpha.1 的隔离网页版。
+
+## 修复与回归
+
+- 在启动目录和会话工作区分别放置同名 `report.txt`，内容不同。`email_send` 实际文件读取和 `email_draft` 的附件预览均取得会话文件内容，启动目录原文件保持不变。
+- 绝对附件路径保持精确；没有会话时保留启动目录回退。三个新增回归通过，既有收件人拒绝、确认、取消、大小限制与草稿快照规则保持。
+- 中英文确认开关不再笼统声称 Full Access 必然拒绝：主动保存且启用的可信规则只跳过 `email_send` 插件确认，宿主权限仍生效；禁止规则始终优先。
+
+## 实际界面操作
+
+通过明确标记的脚本工具选择适配器，在聊天中用相对路径创建草稿；进入「设置 → 邮件 → 草稿」，检查发送预览，下载并核对附件，勾选核对框后向本机合成 SMTP 服务确认发送。服务器仅接收一封邮件，附件内容与当前会话文件一致；已发送草稿不再提供再次发送按钮。
+
+切换官方界面语言后核对英文账号页，确认说明、草稿入口和禁止规则提示均显示英文。1280×720 截图中相关说明可读，浏览器控制台无 error / warn，页面无空白或错误覆盖层。
+
+## 范围
+
+未操作用户原生 Electron 窗口，未使用真实邮箱凭据，未向外部邮箱发送测试邮件。脚本选工具验收不证明模型自主选工具能力；UI 的 SMTP 回执不代表外部收件箱送达。附件仅改变路径基准，不增加文件访问权限或关闭确认。
+
+开放反馈 [Email #19](https://github.com/STARDUSTLC666/dsh-email/issues/19) 的名单控件、匹配预览和显式开关均已具备；仍保留主动启用、域名精确匹配及宿主权限边界，咨询没有被自动关闭。

package/lib/approval.js

@@ -4,8 +4,6 @@ export function installSendApproval(ctx, runtime) {
         if (exec?.name !== 'email_send' && exec?.name !== 'email_reply')
             return next();
         const value = runtime.getSettingsValue();
-        if (value.sendApproval === false)
-            return next();
         try {
             runtime.getEffectiveSettings();
         }
@@ -18,12 +16,19 @@ export function installSendApproval(ctx, runtime) {
                 const settings = runtime.getEffectiveSettings(), account = typeof args.account === 'string' && args.account.trim() ? args.account.trim() : settings.defaultAccount;
                 if (settings.accounts.has(account) && typeof args.to === 'string' && (args.cc === undefined || typeof args.cc === 'string')) {
                     const policy = parseRecipientPolicies(value.trustedRecipientsYaml).get(account);
-                    if (policy?.skipApproval && (await matchRecipients(args.to, args.cc ?? '', policy)).skipsApproval)
-                        return next();
+                    if (policy) {
+                        const matching = await matchRecipients(args.to, args.cc ?? '', policy);
+                        if (matching.blocked)
+                            return { kind: 'deny', reason: '收件人被禁止规则拦截，邮件未发送：' + matching.rows.filter(row => row.blocked).map(row => row.address).join(', ') };
+                        if (matching.skipsApproval)
+                            return next();
+                    }
                 }
             }
             catch { /* Invalid rules or addresses keep the usual approval; never grant trust on a parse failure. */ }
         }
+        if (value.sendApproval === false)
+            return next();
         let reason;
         if (exec.name === 'email_send') {
             const args = (exec.arguments ?? {});

package/lib/client.js

@@ -288,10 +288,10 @@ var UI = {
     "provider.undefinedPresetSuffix": "（未定义预设）",
 
     // 全局设置
-    "global.sendApproval": "发信前弹确认（强烈建议保留；Full Access 模式下会被自动拒绝）",
+    "global.sendApproval": "模型发信前确认（建议保留；可信规则可按账号跳过）",
     "global.downloadDirLabel": "附件下载目录（默认保存在当前工作区）",
     "global.downloadDirPlaceholder": "留空使用默认",
-    "global.hint": "以上设置对所有账号统一生效。",
+    "global.hint": "以上设置对所有账号统一生效。需要插件确认的工具发信在 Full Access 下不会弹框；可改用草稿页手动核对并确认。禁止收件人规则始终生效。",
 
     // 自动保存状态条
     "status.saved": "已保存",
@@ -469,10 +469,10 @@ var UI = {
     "provider.undefinedPresetSuffix": "(undefined preset)",
 
     // 全局设置
-    "global.sendApproval": "Ask for confirmation before sending (strongly recommended; auto-denied under Full Access)",
+    "global.sendApproval": "Confirm model-initiated sends (recommended; saved trust can skip per account)",
     "global.downloadDirLabel": "Attachment download directory (defaults to the current workspace)",
     "global.downloadDirPlaceholder": "Leave empty for the default",
-    "global.hint": "These settings apply to every account.",
+    "global.hint": "These settings apply to every account. Tool sends that still require plugin confirmation cannot show a dialog under Full Access; use the Drafts tab to review and confirm manually. Blocked-recipient rules always apply.",
 
     // 自动保存状态条
     "status.saved": "Saved",
@@ -2209,7 +2209,8 @@ function DraftWorkbench({ active }) {
     h("h3", null, dt("发送前预览", "Review before sending")),
     h("p", null, dt("发件人：", "From: ") + (preview.from.name ? preview.from.name + " <" + preview.from.address + ">" : preview.from.address)),
     h("p", null, dt("主题：", "Subject: ") + preview.draft.subject),
-    h("ul", { className: "dshe-match-list" }, preview.matching.rows.map((row, index) => h("li", { key: index }, (row.field === "cc" ? "Cc: " : "To: ") + row.address + " · " + (row.matched ? dt("匹配可信规则", "Matches a trusted rule") : dt("需要确认", "Needs confirmation"))))),
+    preview.matching.blocked ? h("div", { className: "dshe-alert error", role: "alert" }, dt("有收件人命中禁止规则，无法发送。请修改草稿或收件人规则。", "A recipient is blocked. Change the draft or recipient rules before sending.")) : null,
+    h("ul", { className: "dshe-match-list" }, preview.matching.rows.map((row, index) => h("li", { key: index }, (row.field === "cc" ? "Cc: " : "To: ") + row.address + " · " + (row.blocked ? dt("禁止发送：", "Blocked: ") + row.value : row.matched ? dt("匹配可信规则", "Matches a trusted rule") : dt("需要确认", "Needs confirmation"))))),
     h("pre", null, preview.draft.text || dt("（空正文）", "(Empty body)")),
     preview.attachments.length ? h("ul", { className: "dshe-files" }, preview.attachments.map(file => h("li", { key: file.id }, [
       h("span", null, file.filename + " · " + Math.ceil(file.size / 1024) + " KiB"),
@@ -2219,7 +2220,7 @@ function DraftWorkbench({ active }) {
     h("label", { className: "dshe-check" }, [h("input", { type: "checkbox", checked: acknowledged, disabled: busy, onChange: event => setAcknowledged(event.target.checked) }), dt("我已核对发件人、所有收件人、正文和附件", "I checked the sender, all recipients, content and attachments")]),
     h("div", { className: "dshe-actions" }, [
       h("button", { type: "button", className: "dshe-btn", disabled: busy, onClick: () => run(async () => { await draftApi("cancelPreview", { id: selected.id }); setPreview(null); setAcknowledged(false); setNotice(dt("预览已取消，邮件未发送。", "Review cancelled. No email was sent.")); }) }, dt("取消预览", "Cancel review")),
-      h("button", { type: "button", className: "dshe-btn primary", disabled: busy || !acknowledged || dirty, onClick: () => run(async () => {
+      h("button", { type: "button", className: "dshe-btn primary", disabled: busy || !acknowledged || dirty || preview.matching.blocked, onClick: () => run(async () => {
         try { const result = await draftApi("send", { id: selected.id, preview: preview.id, confirmed: true }); adopt(result.draft); }
         finally { setPreview(null); setAcknowledged(false); const fresh = await reload(); const current = fresh.drafts.find(draft => draft.id === selected.id); if (current && current.state !== "draft") adopt(current); }
       }) }, busy ? dt("正在提交…", "Submitting…") : dt("确认发送", "Confirm send")),
@@ -2265,35 +2266,38 @@ function DraftWorkbench({ active }) {
 }
 
 function RecipientRules({ active, onSaved }) {
-  const [data, setData] = useState(() => rulesUiCache && rulesUiCache.data), [account, setAccount] = useState(() => rulesUiCache && rulesUiCache.account || ""), [form, setForm] = useState(() => rulesUiCache && rulesUiCache.form || { addresses: "", domains: "", skipApproval: false });
+  const [data, setData] = useState(() => rulesUiCache && rulesUiCache.data), [account, setAccount] = useState(() => rulesUiCache && rulesUiCache.account || ""), [form, setForm] = useState(() => rulesUiCache && rulesUiCache.form || { addresses: "", domains: "", denyAddresses: "", denyDomains: "", skipApproval: false });
   const [base, setBase] = useState(() => rulesUiCache && rulesUiCache.base || ""), [busy, setBusy] = useState(false), [error, setError] = useState(""), [notice, setNotice] = useState(""), [pending, setPending] = useState(null), [to, setTo] = useState(() => rulesUiCache && rulesUiCache.to || ""), [cc, setCc] = useState(() => rulesUiCache && rulesUiCache.cc || ""), [match, setMatch] = useState(null);
   const operation = useRef(false), dirty = data && JSON.stringify(form) !== base;
   useEffect(() => { rulesUiCache = { data, account, form, base, to, cc }; }, [data, account, form, base, to, cc]);
-  const choose = (next, name) => { const rule = next.policies[name] || { addresses: [], domains: [], skipApproval: false }, fields = { addresses: rule.addresses.join("\n"), domains: rule.domains.join("\n"), skipApproval: rule.skipApproval }; setAccount(name); setForm(fields); setBase(JSON.stringify(fields)); setMatch(null); setPending(null); };
+  const choose = (next, name) => { const rule = next.policies[name] || { addresses: [], domains: [], skipApproval: false }, fields = { addresses: rule.addresses.join("\n"), domains: rule.domains.join("\n"), denyAddresses: (rule.denyAddresses || []).join("\n"), denyDomains: (rule.denyDomains || []).join("\n"), skipApproval: rule.skipApproval }; setAccount(name); setForm(fields); setBase(JSON.stringify(fields)); setMatch(null); setPending(null); };
   const run = async (fn) => { if (operation.current) return; operation.current = true; setBusy(true); setError(""); try { await fn(); } catch (e) { setError(e.message || String(e)); } finally { operation.current = false; setBusy(false); } };
   const load = async () => { const next = await draftApi("rules"); setData(next); choose(next, next.accounts.includes(account) ? account : next.accounts[0] || ""); };
   useEffect(() => { if (active && !dirty) run(load); }, [active]);
   useEffect(() => { const guard = event => { if (dirty) { event.preventDefault(); event.returnValue = ""; } }; window.addEventListener("beforeunload", guard); return () => window.removeEventListener("beforeunload", guard); }, [dirty]);
-  const policy = () => ({ skipApproval: form.skipApproval, addresses: form.addresses.split(/\r?\n/).map(row => row.trim()).filter(Boolean), domains: form.domains.split(/\r?\n/).map(row => row.trim()).filter(Boolean) });
+  const policy = () => ({ skipApproval: form.skipApproval, ...Object.fromEntries(['addresses', 'domains', 'denyAddresses', 'denyDomains'].map(key => [key, (form[key] || '').split(/\r?\n/).map(row => row.trim()).filter(Boolean)])) });
   const save = async () => { const next = await draftApi("saveRules", { account, policy: policy(), revision: data.revision }); setData(next); choose(next, account); onSaved(next.revision); setNotice(dt("此账号规则已保存。", "Rules saved for this account.")); return next; };
   const change = patch => { setForm(current => ({ ...current, ...patch })); setMatch(null); setNotice(""); };
   const request = target => { if (dirty) setPending(target); else if (target.kind === "reload") run(load); else choose(data, target.name); };
   return h("section", { className: "dshe-panel dshe-rule-panel", "aria-label": dt("可信收件人规则", "Trusted recipients") }, [
     h("p", { className: "dshe-hint" }, dt("默认每次确认。主动启用后，只有该账号的全部 To/Cc 都匹配时，email_send 才跳过插件确认；宿主权限仍然生效，草稿仍需手动确认。域名规则只匹配指定域名，不包含子域名。", "Approval is the default. When enabled, email_send skips this plugin's approval only if every To/Cc address matches this account's rules. Host permissions still apply, and drafts still need manual confirmation. Domain rules exclude subdomains.")),
+    h("p", { className: "dshe-hint" }, dt("禁止规则优先于可信规则，关闭发信确认也不能绕过；同样适用于草稿、回复与转发。禁止域名也仅精确匹配，不包含子域名。", "Blocked recipients take precedence over trusted rules, even with send approval off. Blocks also apply to drafts, replies and forwards. Blocked domains match exactly and exclude subdomains.")),
     error ? h("div", { className: "dshe-alert error", role: "alert" }, error) : null,
     notice ? h("div", { className: "dshe-alert success", role: "status" }, notice) : null,
-    data && data.sendApproval === false ? h("div", { className: "dshe-alert info" }, dt("全局发信确认目前已关闭；这份规则不会额外拦截 email_send。", "Global send approval is currently off. These rules do not add another email_send gate.")) : null,
+    data && data.sendApproval === false ? h("div", { className: "dshe-alert info" }, dt("全局发信确认目前已关闭；禁止规则仍然生效。", "Global send approval is off; blocked-recipient rules still apply.")) : null,
     h("div", { className: "dshe-field" }, [h("label", { htmlFor: "dshe-rule-account" }, dt("规则所属账号", "Account for these rules")), h("select", { id: "dshe-rule-account", value: account, disabled: busy, onChange: event => request({ kind: "account", name: event.target.value }) }, [h("option", { value: "", disabled: true }, dt("请选择已配置账号", "Choose a configured account")), ...(data ? data.accounts : []).map(name => h("option", { key: name, value: name }, name))])]),
     pending ? h("div", { className: "dshe-alert info" }, [dt("规则还未保存。", "Rules have unsaved edits."), h("div", { className: "dshe-actions" }, [h("button", { type: "button", className: "dshe-btn", disabled: busy, onClick: () => run(async () => { const next = await save(); if (pending.kind === "reload") await load(); else choose(next, pending.name); }) }, dt("保存并切换", "Save and switch")), h("button", { type: "button", className: "dshe-btn", disabled: busy, onClick: () => { if (pending.kind === "reload") run(load); else choose(data, pending.name); } }, dt("放弃编辑并切换", "Discard edits and switch")), h("button", { type: "button", className: "dshe-btn", onClick: () => setPending(null) }, dt("保留编辑", "Keep editing"))])]) : null,
     h("div", { className: "dshe-field" }, [h("label", { htmlFor: "dshe-rule-addresses" }, dt("可信邮箱地址（每行一个）", "Trusted email addresses (one per line)")), h("textarea", { id: "dshe-rule-addresses", rows: 4, value: form.addresses, placeholder: "name@example.com", disabled: busy || !account, onChange: event => change({ addresses: event.target.value }) })]),
     h("div", { className: "dshe-field" }, [h("label", { htmlFor: "dshe-rule-domains" }, dt("可信域名（每行一个，匹配该域所有邮箱）", "Trusted domains (one per line, all mailboxes in that domain)")), h("textarea", { id: "dshe-rule-domains", rows: 3, value: form.domains, placeholder: "example.com", disabled: busy || !account, onChange: event => change({ domains: event.target.value }) })]),
+    h("div", { className: "dshe-field" }, [h("label", { htmlFor: "dshe-rule-deny-addresses" }, dt("禁止邮箱地址（每行一个）", "Blocked email addresses (one per line)")), h("textarea", { id: "dshe-rule-deny-addresses", rows: 3, value: form.denyAddresses || '', placeholder: "blocked@example.com", disabled: busy || !account, onChange: event => change({ denyAddresses: event.target.value }) })]),
+    h("div", { className: "dshe-field" }, [h("label", { htmlFor: "dshe-rule-deny-domains" }, dt("禁止域名（每行一个）", "Blocked domains (one per line)")), h("textarea", { id: "dshe-rule-deny-domains", rows: 3, value: form.denyDomains || '', placeholder: "blocked.example.com", disabled: busy || !account, onChange: event => change({ denyDomains: event.target.value }) })]),
     h("label", { className: "dshe-check" }, [h("input", { type: "checkbox", checked: form.skipApproval, disabled: busy || !account, onChange: event => change({ skipApproval: event.target.checked }) }), dt("允许全部匹配时跳过 email_send 的插件确认", "Skip plugin approval for email_send when all addresses match")]),
     h("div", { className: "dshe-actions" }, [h("button", { type: "button", className: "dshe-btn primary", disabled: busy || !dirty || !account || data && !data.writable, onClick: () => run(save) }, dt("保存此账号规则", "Save rules for this account")), h("button", { type: "button", className: "dshe-btn", disabled: busy, onClick: () => request({ kind: "reload" }) }, dt("重新加载规则", "Reload rules"))]),
     h("div", { className: "dshe-hint", role: "status" }, dirty ? dt("未保存；匹配预览使用当前编辑的规则。", "Unsaved; matching uses the rules you are editing.") : dt("已保存的规则才会作用于模型发信。", "Only saved rules affect model-initiated sends.")),
     h("div", { className: "dshe-field" }, [h("label", { htmlFor: "dshe-rule-to" }, dt("试填收件人 To", "Try recipients To")), h("input", { id: "dshe-rule-to", type: "text", value: to, disabled: busy, onChange: event => { setTo(event.target.value); setMatch(null); } })]),
     h("div", { className: "dshe-field" }, [h("label", { htmlFor: "dshe-rule-cc" }, dt("试填抄送 Cc", "Try copy Cc")), h("input", { id: "dshe-rule-cc", type: "text", value: cc, disabled: busy, onChange: event => { setCc(event.target.value); setMatch(null); } })]),
     h("button", { type: "button", className: "dshe-btn", disabled: busy || !account, onClick: () => run(async () => setMatch(await draftApi("matchRules", { account, policy: policy(), to, cc }))) }, dt("检查规则匹配（不发送）", "Check matches (no email sent)")),
-    match ? h("div", { className: "dshe-review" }, [h("p", null, match.skipsApproval ? dt("全部 To/Cc 匹配，可跳过插件确认。", "All To/Cc match; plugin approval can be skipped.") : dt("不会跳过插件确认。", "Plugin approval will remain.")), h("ul", { className: "dshe-match-list" }, match.rows.map((row, index) => h("li", { key: index }, row.field.toUpperCase() + ": " + row.address + " · " + (row.matched ? dt("匹配：", "Match: ") + row.value : dt("未匹配", "No match")))))]) : null,
+    match ? h("div", { className: "dshe-review", role: "status" }, [h("p", null, match.blocked ? dt("收件人被禁止，无法发送。", "A recipient is blocked; sending is refused.") : match.skipsApproval ? dt("全部 To/Cc 匹配，可跳过插件确认。", "All To/Cc match; plugin approval can be skipped.") : dt("不会跳过插件确认。", "Plugin approval will remain.")), h("ul", { className: "dshe-match-list" }, match.rows.map((row, index) => h("li", { key: index }, row.field.toUpperCase() + ": " + row.address + " · " + (row.blocked ? dt("禁止：", "Blocked: ") + row.value : row.matched ? dt("匹配：", "Match: ") + row.value : dt("未匹配", "No match")))))]) : null,
   ]);
 }
 

package/lib/config.d.ts

@@ -1,3 +1,4 @@
+import { type RecipientPolicy } from './recipient-policy.js';
 /** The 8 built-in provider ids. A `provider` may also name a custom preset. */
 export type ProviderName = 'qq' | '163' | '126' | 'sina' | 'aliyun' | 'gmail' | 'outlook' | 'icloud';
 /**
@@ -217,6 +218,7 @@ export interface ResolvedEmailConfig {
 export declare function isOAuth2Account(provider: string | undefined, imapHost: string | undefined): boolean;
 /** Fully resolved plugin settings: the account map plus shared policy. */
 export interface ResolvedEmailSettings {
+    recipientPolicies?: Map<string, RecipientPolicy>;
     accounts: Map<string, ResolvedEmailConfig>;
     defaultAccount: string;
     sendApproval: boolean;

package/lib/config.js

@@ -1,6 +1,7 @@
 import { homedir } from 'node:os';
 import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
 import { join } from 'node:path';
+import { parseRecipientPolicies } from './recipient-policy.js';
 /**
  * The provider that authenticates with OAuth2 instead of a password.
  *
@@ -293,6 +294,7 @@ export function resolveEmailSettings(config, onlyAccount) {
     }
     return {
         accounts,
+        recipientPolicies: parseRecipientPolicies(raw.trustedRecipientsYaml),
         defaultAccount: defaultName,
         sendApproval: raw.sendApproval !== false,
         maxBodyChars: clampInt(raw.maxBodyChars, 20000, 1000, 200000),

package/lib/draft-web.js

@@ -3,7 +3,7 @@ import { createReadStream } from 'node:fs';
 import { mkdir, open, stat } from 'node:fs/promises';
 import { basename, dirname, resolve } from 'node:path';
 import { DraftError, DraftStore, draftFields } from './draft-store.js';
-import { matchRecipients, parseRecipientPolicies, serializeRecipientPolicies } from './recipient-policy.js';
+import { assertRecipientsAllowed, matchRecipients, parseRecipientPolicies, serializeRecipientPolicies, RecipientPolicyError } from './recipient-policy.js';
 import { messageOf, redactCredentials } from './mail-client.js';
 export const EMAIL_DRAFT_ROUTE = '/api/dsh-email/drafts';
 const MAX_BYTES = 20 * 1024 * 1024;
@@ -229,6 +229,7 @@ export class EmailDraftBackend {
                 editable(before);
                 if (before.revision !== plan.draft.revision || plan.key !== this.connection(before.account).key)
                     throw new DraftError('草稿、账号或规则已改变，请重新预览', 'draft-conflict');
+                await assertRecipientsAllowed(before.to, before.cc, this.connection(before.account).policy);
                 const pool = this.runtime.getPool();
                 current.throwIfAborted();
                 const pending = await this.store.change(id, before.revision, value => { editable(value); value.state = 'sending'; value.attemptAt = new Date(this.now()).toISOString(); }, current);
@@ -247,6 +248,10 @@ export class EmailDraftBackend {
                     receipt = await pool.sendPrepared(before.account, before.to, before.subject, before.text, before.cc, plan.attachments.map(({ filename, content }) => ({ filename, content })), current);
                 }
                 catch (error) {
+                    if (error instanceof RecipientPolicyError) {
+                        await this.store.change(id, pending.revision, value => { value.state = 'draft'; delete value.attemptAt; });
+                        throw error;
+                    }
                     const failed = await this.store.change(id, pending.revision, value => { value.state = 'uncertain'; value.error = '提交结果未确定；请先去邮箱核对，不会自动重发。' + this.safe(error); }).catch(() => null);
                     if (!failed)
                         throw new DraftError('提交结果未确定，且回执未能保存；请先去邮箱核对，不要直接重发', 'draft-storage');

package/lib/mail-client.js

@@ -4,6 +4,7 @@ import { createConnection } from 'node:net';
 import { mkdir, stat, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { getFreshAccessToken, OAuth2Error } from './oauth2.js';
+import { assertRecipientsAllowed } from './recipient-policy.js';
 import { flattenAddresses, parseRawMessage, sanitizeFilename, stripHtml, truncateText } from './parse.js';
 export class MailError extends Error {
     constructor(message) {
@@ -630,6 +631,10 @@ export class EmailPool {
      * single attempt they always had.
      */
     async sendMail(name, cfg, message, signal) {
+        signal?.throwIfAborted();
+        // This is shared by chat sends, prepared drafts, replies and forwards. Enforce
+        // before token refresh or opening any SMTP connection, even with approval off.
+        await assertRecipientsAllowed(message.to ?? '', message.cc ?? '', this.settings.recipientPolicies?.get(name));
         signal?.throwIfAborted();
         const attempt = async (forceToken) => {
             let token;

package/lib/recipient-policy.d.ts

@@ -2,14 +2,21 @@ export interface RecipientPolicy {
     skipApproval: boolean;
     addresses: string[];
     domains: string[];
+    denyAddresses?: string[];
+    denyDomains?: string[];
 }
 export interface RecipientMatch {
     field: 'to' | 'cc';
     address: string;
     matched: boolean;
+    blocked: boolean;
     rule: 'address' | 'domain' | '';
     value: string;
 }
+export declare class RecipientPolicyError extends Error {
+    readonly code = "recipient-denied";
+    constructor(addresses: string[]);
+}
 export declare function canonicalDomain(value: string): string;
 export declare function canonicalAddress(value: string): string;
 /** The public Nodemailer JSON transport compiles the same recipient envelope without delivery. */
@@ -23,4 +30,6 @@ export declare function matchRecipients(to: string, cc: string, policy?: Recipie
     rows: RecipientMatch[];
     allTrusted: boolean;
     skipsApproval: boolean;
+    blocked: boolean;
 }>;
+export declare function assertRecipientsAllowed(to: string, cc: string, policy?: RecipientPolicy): Promise<void>;

package/lib/recipient-policy.js

@@ -1,6 +1,10 @@
 import nodemailer from 'nodemailer';
 import { domainToASCII } from 'node:url';
 import { parse, stringify } from 'yaml';
+export class RecipientPolicyError extends Error {
+    code = 'recipient-denied';
+    constructor(addresses) { super('收件人被禁止规则拦截，邮件未发送 / Recipients blocked; no email sent: ' + addresses.join(', ')); this.name = 'RecipientPolicyError'; }
+}
 const normalizer = nodemailer.createTransport({ jsonTransport: true, disableFileAccess: true, disableUrlAccess: true });
 export function canonicalDomain(value) {
     const domain = domainToASCII(value.trim().replace(/\.$/, '')).toLowerCase();
@@ -57,8 +61,8 @@ export function parseRecipientPolicies(text) {
         throw new Error('规则应按账号名填写，最多 50 个账号');
     const policies = new Map();
     for (const [account, raw] of Object.entries(data)) {
-        if (!account.trim() || account.length > 200 || !plain(raw) || Object.keys(raw).some(key => !['skipApproval', 'addresses', 'domains'].includes(key)))
-            throw new Error('账号规则只支持 skipApproval、addresses 与 domains');
+        if (!account.trim() || account.length > 200 || !plain(raw) || Object.keys(raw).some(key => !['skipApproval', 'addresses', 'domains', 'denyAddresses', 'denyDomains'].includes(key)))
+            throw new Error('账号规则只支持 skipApproval、addresses、domains、denyAddresses 与 denyDomains');
         if (raw.skipApproval !== undefined && typeof raw.skipApproval !== 'boolean')
             throw new Error('skipApproval 必须是布尔值');
         const list = (key, convert) => {
@@ -67,7 +71,7 @@ export function parseRecipientPolicies(text) {
                 throw new Error(key + ' 必须为字符串数组，最多 100 项');
             return [...new Set(values.map(value => convert(value)))];
         };
-        policies.set(account, { skipApproval: raw.skipApproval === true, addresses: list('addresses', canonicalAddress), domains: list('domains', canonicalDomain) });
+        policies.set(account, { skipApproval: raw.skipApproval === true, addresses: list('addresses', canonicalAddress), domains: list('domains', canonicalDomain), denyAddresses: list('denyAddresses', canonicalAddress), denyDomains: list('denyDomains', canonicalDomain) });
     }
     return policies;
 }
@@ -76,13 +80,24 @@ export function serializeRecipientPolicies(policies) {
 }
 export async function matchRecipients(to, cc, policy) {
     const rows = (await normalizeRecipients(to, cc)).map(row => {
-        if (policy?.addresses.includes(row.address))
-            return { ...row, matched: true, rule: 'address', value: row.address };
         const domain = row.address.slice(row.address.lastIndexOf('@') + 1);
+        if (policy?.denyAddresses?.includes(row.address))
+            return { ...row, matched: false, blocked: true, rule: 'address', value: row.address };
+        if (policy?.denyDomains?.includes(domain))
+            return { ...row, matched: false, blocked: true, rule: 'domain', value: domain };
+        if (policy?.addresses.includes(row.address))
+            return { ...row, matched: true, blocked: false, rule: 'address', value: row.address };
         if (policy?.domains.includes(domain))
-            return { ...row, matched: true, rule: 'domain', value: domain };
-        return { ...row, matched: false, rule: '', value: '' };
+            return { ...row, matched: true, blocked: false, rule: 'domain', value: domain };
+        return { ...row, matched: false, blocked: false, rule: '', value: '' };
     });
     const allTrusted = rows.length > 0 && rows.every(row => row.matched);
-    return { rows, allTrusted, skipsApproval: policy?.skipApproval === true && allTrusted };
+    return { rows, allTrusted, skipsApproval: policy?.skipApproval === true && allTrusted, blocked: rows.some(row => row.blocked) };
+}
+export async function assertRecipientsAllowed(to, cc, policy) {
+    if (!policy?.denyAddresses?.length && !policy?.denyDomains?.length)
+        return;
+    const matching = await matchRecipients(to, cc, policy);
+    if (matching.blocked)
+        throw new RecipientPolicyError(matching.rows.filter(row => row.blocked).map(row => row.address));
 }

package/lib/runtime.js

@@ -71,6 +71,7 @@ export function createEmailRuntime(ctx, config, createPool = settings => new Ema
         });
     };
     let pool = null;
+    let poolSettings = null;
     let poolFingerprint = '';
     let disposed = false;
     const getPool = () => {
@@ -81,9 +82,14 @@ export function createEmailRuntime(ctx, config, createPool = settings => new Ema
         if (pool === null || fingerprint !== poolFingerprint) {
             pool?.dispose();
             pool = createPool(effective);
+            poolSettings = effective;
             pool.startIdleSweep();
             poolFingerprint = fingerprint;
         }
+        // Rules change without disrupting an IMAP connection or watch cursor. The
+        // pool reads this shared settings object at its SMTP submission boundary.
+        if (poolSettings)
+            poolSettings.recipientPolicies = effective.recipientPolicies;
         return pool;
     };
     // Tool and browser watches share the implementation but never consume each

package/lib/tool-contract.js

@@ -297,8 +297,8 @@ export const descriptions = {
     "email_read": 'Read one full email message by its uid (from email_list or email_search). Returns the plain-text body (HTML mail is converted; oversized bodies are truncated) plus attachment metadata; use email_attachment to download one.',
     "email_mark": 'Change an existing message: mark it read/unread, star/unstar it, or move it to another folder. Use after email_list/email_search when the user wants to tidy the mailbox (archive, clear unread, flag important mail). Moving uses the server MOVE/COPY so the uid changes; the new uid is reported when the server provides it.',
     "email_search": 'Search emails by a keyword. The server first searches sender, recipients and subject; those hits are re-verified against the envelopes and, when none of them really carries the keyword (some servers answer every search with the same uids), recent messages are scanned locally including their body while bodySearchFallback is enabled. offset skips the newest matches for paging; since/until still constrain both paths. Returns the same compact rows as email_list.',
-    "email_send": 'Send an email from a configured account, optionally with file attachments (absolute paths, or relative to the dsh process cwd). Sending asks the user for approval (recipient, subject and attachment count are shown) unless sendApproval is disabled; in Full Access mode the approval policy never asks, so the send is refused with an explanation instead. Never invent recipients or content without the user\'s instruction.',
-    "email_reply": 'Reply to, reply-all to, or forward an existing message (mode: reply | reply-all | forward). Recipients come from the original message (your own address is excluded automatically), the subject gets a single Re:/Fwd: prefix, the original text is quoted underneath, and In-Reply-To/References headers keep mail clients threading correctly. mode=forward needs the to parameter. Like email_send, this asks the user for approval before sending. Never invent recipients or content without the user\'s instruction.',
+    "email_send": 'Send an email from a configured account, optionally with file attachments (absolute paths, or relative to the current session workspace; process cwd is the fallback without a session). Saved blocked-address/domain rules reject To/Cc recipients even when sendApproval is off. Plugin confirmation is required by default, unless sendApproval is disabled or every To/Cc recipient matches saved trust rules with skipApproval enabled. Host permissions still apply. Full Access refuses a send that still requires plugin confirmation; use email_draft for human review and explicit sending. Never invent recipients or content without the user\'s instruction.',
+    "email_reply": 'Reply to, reply-all to, or forward an existing message (mode: reply | reply-all | forward). Recipients come from the original message (your own address is excluded automatically), the subject gets a single Re:/Fwd: prefix, the original text is quoted underneath, and In-Reply-To/References headers keep mail clients threading correctly. mode=forward needs the to parameter. Plugin confirmation is required unless sendApproval is disabled; trusted-recipient skipping only applies to email_send. Blocked recipients still stop delivery before SMTP and host permissions remain in effect. Never invent recipients or content without the user\'s instruction.',
     "email_folders": 'List the mailbox folders of an account (INBOX, Sent, Trash, custom folders, ...). Use the returned path values as the folder argument of the other email tools.',
     "email_health": 'Self-check for dsh-email: summarizes configured accounts (provider / IMAP / SMTP hosts) without any network connection and never shows passwords. Run this first when troubleshooting.',
     "email_attachment": 'Download one attachment of a message to a local file (size capped by maxAttachmentBytes). The index matches the attachments array of email_read. Returns the absolute path of the written file.',
@@ -340,7 +340,7 @@ export const parameters = {
         subject: { type: 'string', required: true, description: 'Email subject' },
         text: { type: 'string', description: 'Plain-text body' },
         cc: { type: 'string', description: 'CC recipient(s), comma-separated' },
-        attachments: { type: 'array', items: { type: 'string' }, description: 'File paths to attach (absolute, or relative to the dsh process cwd)' },
+        attachments: { type: 'array', items: { type: 'string' }, description: 'File paths to attach (absolute, or relative to the current session workspace; process cwd is the fallback without a session)' },
         account: { type: 'string', description: ACCOUNT_HINT },
     }),
     "email_reply": compileParameters({

package/lib/tools.js

@@ -1,3 +1,4 @@
+import { resolve } from 'node:path';
 import { clampInt, PROVIDER_PRESETS } from './config.js';
 import { messageOf } from './mail-client.js';
 import { NOT_LOGGED_IN_MESSAGE, oauth2StateOf } from './oauth2.js';
@@ -5,16 +6,22 @@ import { descriptions, parameters, MAX_LIMIT, MARK_ACTIONS, REPLY_MODES, executi
 /** 单次工具调用的 deadline：普通查询 60s，正文扫描/watch 这类整批操作 120s。 */
 const QUERY_TIMEOUT_MS = 60000;
 const BATCH_TIMEOUT_MS = 120000;
+function attachmentPaths(value, exec) {
+    const context = exec;
+    const cwd = context?.agent?.session?.header?.cwd;
+    const base = typeof cwd === 'string' && cwd.trim() ? cwd : process.cwd();
+    return normalizeAttachmentPaths(value)?.map(path => resolve(base, path));
+}
 export function buildEmailTools(runtime, drafts) {
     const { getPool, getEffectiveSettings, watch: watchCore } = runtime;
     return [
         ...(drafts ? [{
                 name: 'email_draft',
                 description: '准备可编辑的本地邮件草稿，不投递邮件。用户在设置 → 邮件 → 草稿中编辑、检查附件预览并明确确认后才发送。可在邮箱尚未配置时准备文字草稿；不用于回复原邮件线程。',
-                parameters: { type: 'object', properties: { account: { type: 'string', description: '发件账号名，省略时使用默认账号' }, to: { type: 'string', description: 'To 地址，支持显示名和地址组' }, cc: { type: 'string' }, subject: { type: 'string' }, text: { type: 'string', description: '纯文本正文' }, attachments: { type: 'array', items: { type: 'string' }, description: '最多 10 个本地附件路径，用户在预览中检查后才提交' } }, required: ['to', 'subject', 'text'], additionalProperties: false },
+                parameters: { type: 'object', properties: { account: { type: 'string', description: '发件账号名，省略时使用默认账号' }, to: { type: 'string', description: 'To 地址，支持显示名和地址组' }, cc: { type: 'string' }, subject: { type: 'string' }, text: { type: 'string', description: '纯文本正文' }, attachments: { type: 'array', items: { type: 'string' }, description: '最多 10 个本地附件路径；相对路径以当前会话工作区为基准，用户在预览中检查后才提交' } }, required: ['to', 'subject', 'text'], additionalProperties: false },
                 output: { schema: { type: 'object', properties: { id: { type: 'string' }, state: { type: 'string' }, subject: { type: 'string' } }, required: ['id', 'state', 'subject'] }, render: (_args, value) => [{ type: 'text', text: '本地草稿已保存，邮件未发送。请在设置 → 邮件 → 草稿中打开并检查。\n草稿编号：' + value.id + '\n主题：' + value.subject }] },
                 timeoutMs: QUERY_TIMEOUT_MS,
-                async execute(args, exec) { const draft = await drafts.create(args, executionSignal(exec)); return { id: draft.id, state: draft.state, subject: draft.subject }; },
+                async execute(args, exec) { const input = args; const draft = await drafts.create({ ...input, attachments: attachmentPaths(input.attachments, exec) }, executionSignal(exec)); return { id: draft.id, state: draft.state, subject: draft.subject }; },
             }] : []),
         {
             name: 'email_list',
@@ -110,7 +117,7 @@ export function buildEmailTools(runtime, drafts) {
                     throw new Error('to 不能为空');
                 if (typeof args.subject !== 'string' || args.subject.trim() === '')
                     throw new Error('subject 不能为空');
-                return await getPool().send(args.account, args.to.trim(), args.subject.trim(), typeof args.text === 'string' ? args.text : undefined, typeof args.cc === 'string' && args.cc.trim() !== '' ? args.cc.trim() : undefined, normalizeAttachmentPaths(args.attachments), executionSignal(exec));
+                return await getPool().send(args.account, args.to.trim(), args.subject.trim(), typeof args.text === 'string' ? args.text : undefined, typeof args.cc === 'string' && args.cc.trim() !== '' ? args.cc.trim() : undefined, attachmentPaths(args.attachments, exec), executionSignal(exec));
             }
         },
         {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-email",
-  "version": "0.15.3",
+  "version": "0.16.1",
   "description": "在 DSH 中收发、搜索和整理邮件，支持多个邮箱账号。",
   "type": "module",
   "main": "lib/index.js",