dsh-email 0.16.1 → 0.16.2

package/CHANGELOG.md

@@ -4,6 +4,12 @@
 
 [历史英文记录](docs/CHANGELOG.en.md)
 
+## 0.16.2 (2026-10-08)
+
+- Windows 的 OAuth2 access / refresh token 改用当前用户 DPAPI 加密，旧的有效令牌自动原位迁移；不使用明文备份、命令参数或临时明文文件传输令牌。
+- 加密不可用、文件损坏、未知格式或解锁失败时保留原文件；通过私有临时文件与原子替换保存，POSIX 更新时也修正文件权限为 0600。
+- 复查 [PR #22](https://github.com/STARDUSTLC666/dsh-email/pull/22)：原建议仅导入加密函数，未实现存储变更。本次在 TypeScript 源码中完成实际修复。恢复方法及保护范围见 [使用说明](docs/USAGE.md) 和 [验收记录](docs/validation/0.16.2.md)。
+
 ## 0.16.1 (2026-10-08)
 
 - 修复切换会话工作区后相对附件可能读取启动目录同名文件的问题：发信与草稿工具都按当前会话解析路径，绝对路径和无会话调用保持兼容。

package/README.en.md

@@ -14,7 +14,7 @@ Feedback and contributions are welcome: report [issues](https://github.com/STARD
 
 - Read, send, reply and forward using IMAP and SMTP.
 - Manage attachments, search results and mailbox organization.
-- Configure multiple accounts, Outlook OAuth2 and send approval.
+- Configure multiple accounts, Outlook OAuth2, encrypted Windows login tokens and send approval.
 - Turn new-mail popups off in settings; the preference survives restarts.
 - Prepare and edit local drafts, review To/Cc, content and attachment bytes, then confirm sending.
 - Manage trusted and blocked recipients per account and preview address, group and Cc matches.

package/README.md

@@ -14,7 +14,7 @@
 
 - 通过 IMAP / SMTP 收发、回复和转发邮件。
 - 管理附件、搜索结果与邮箱整理操作。
-- 多账号设置，支持 Outlook OAuth2 和发信审批。
+- 多账号设置，支持 Outlook OAuth2、Windows 登录令牌加密和发信审批。
 - 新邮件弹窗可在设置中关闭，保存后重启仍生效。
 - 准备和编辑本地草稿，核对发件人、To/Cc、正文与附件预览后再确认发送。
 - 按账号管理可信与禁止收件人，预览规则如何匹配地址、地址组和抄送。

package/docs/CHANGELOG.en.md

@@ -4,6 +4,12 @@
 
 These English notes preserve the earlier translations. The main changelog contains the consolidated version history.
 
+## 0.16.2 (2026-10-08)
+
+- Encrypt Windows access / refresh tokens with current-user DPAPI and migrate valid legacy tokens in place, without plaintext backups or secrets in process arguments.
+- Preserve corrupt, unsupported or locked stores and fail closed when encryption is unavailable. Save through private atomic replacement; POSIX writes use 0600 files.
+- Replace the import-only suggestion in [PR #22](https://github.com/STARDUSTLC666/dsh-email/pull/22) with an implementation in the TypeScript source. See the usage guide for recovery and protection boundaries.
+
 ## 0.16.1 (2026-10-08)
 
 - Resolve relative attachments against the current session workspace in both send and draft tools, preserving absolute paths and calls without session context.

package/docs/USAGE.en.md

@@ -207,7 +207,7 @@ Microsoft has disabled username+password basic auth for Exchange Online: persona
 - **Body search**: the server side only searches subject / from / to / cc. Most servers (e.g. QQ) have unreliable IMAP `TEXT` / `HEADER` search, so with no results it falls back to a body scan of the most recent `bodySearchLimit` messages (slower; disable with `bodySearchFallback`).
 - **Attachments**: inline images aren't downloadable separately yet; a failed attachment match errors instead of downloading the wrong file (safe default).
 - **Password storage**: the authorization code saved in the settings page is written in plaintext to the local `settings.yaml` (the secret mark only keeps it out of logs / exports / diagnostics; no disk encryption). Don't hand `settings.yaml` to untrusted people.
-- **OAuth2 token storage**: access / refresh tokens are stored as plaintext JSON at `$DSH_HOME/data/dsh-email/oauth2-tokens.json` (deliberately kept out of `settings.yaml`, so they are not included in settings exports). The file is written with `mode: 0o600`, but that permission bit only takes effect **at file creation** and is **effectively a no-op on Windows** — do not hand this file to untrusted people. Tokens are bound to the issuing application ID; changing `clientId` requires re-login. Deleting an account cleans up its tokens.
+- **OAuth2 token storage**: `$DSH_HOME/data/dsh-email/oauth2-tokens.json` stays outside settings exports. Starting in 0.16.2, **Windows encrypts it with current-user DPAPI**, without an extra password. The first read of valid legacy credentials migrates them in place without a plaintext backup. Unavailable system PowerShell / DPAPI never falls back to plaintext; damaged, unsupported or locked stores are preserved with recovery guidance. macOS / Linux still use plaintext JSON, atomically replaced through a private `0600` file; this is not disk encryption. DPAPI does not isolate other programs running as the same Windows user. A different device / OS account requires login again, and older plugin versions cannot read the encrypted format. For recovery, safely retain and move aside the old file before logging in again. Do not share token files. Tokens remain bound to their application ID; changing `clientId` requires login again, and account deletion removes only that account's tokens.
 - **Local edits are undone by `pnpm install`**: if you deploy by editing files inside `node_modules/dsh-email/`, any `pnpm install` restores the registry version (0.10.7, for example). To keep changes long-term, install from a local path or a Git commit instead.
 
 ## Development

package/docs/USAGE.md

@@ -207,7 +207,7 @@ dsh plugin --profile web remove dsh-email
 - **正文搜索**：服务器端只搜 subject / from / to / cc；多数服务器（如 QQ）的 IMAP `TEXT` / `HEADER` 搜索不可靠，无结果时回退到最近 `bodySearchLimit` 封的正文扫描（较慢，可用 `bodySearchFallback` 关闭）。
 - **附件**：内嵌图片暂不支持单独下载；附件定位失败会直接报错而不是下载错误文件（安全默认）。
 - **密码落盘**：设置页保存的授权码以明文写在本机 `settings.yaml`（secret 标记只保证它不进日志 / 导出 / 诊断，不做磁盘加密）。请勿把 `settings.yaml` 交给不信任的人。
-- **OAuth2 token 落盘**：access / refresh token 以明文 JSON 存在 `$DSH_HOME/data/dsh-email/oauth2-tokens.json`（刻意不放进 `settings.yaml`，因此不会随设置导出）。写入时带了 `mode: 0o600`，但这个权限位只在**文件创建那一刻**生效，且**在 Windows 上等于无效**——请勿把该文件交给不信任的人。token 与签发它的应用 ID 绑定，换了 `clientId` 需要重新登录；删除账号会清理它的 token。
+- **OAuth2 token 落盘**：文件为 `$DSH_HOME/data/dsh-email/oauth2-tokens.json`，不随设置导出。0.16.2 起，**Windows 使用当前用户的 DPAPI 加密**，无需设置额外密码；首次读取旧的有效登录数据时自动原位迁移，不留下明文备份。系统 PowerShell / DPAPI 不可用时不会回退写明文；损坏、未知格式或无法解锁的文件保留，并提示恢复操作。macOS / Linux 仍使用明文 JSON，写入以权限 `0600` 的临时文件原子替换，不把这等同于磁盘加密。DPAPI 不隔离同一 Windows 用户运行的其他程序；换设备 / 系统账号需要重新登录，旧版插件也无法读取新的加密格式。遇到解锁问题时，先妥善保留并移走旧文件，再重新登录；请勿分享令牌文件。token 与应用 ID 绑定，换 `clientId` 需重新登录；删除账号只清理该账号的 token。
 - **本地改动会被 `pnpm install` 还原**：如果你是直接改 `node_modules/dsh-email/` 里的文件做本地部署，任何一次 `pnpm install` 都会把它还原成 registry 上的版本（例如 0.10.7）；要长期保留请改成从本地路径或 Git 提交安装。
 
 ## 开发

package/docs/VALIDATION.md

@@ -1,5 +1,7 @@
 # dsh-email 验证记录
 
+[0.16.2 Windows 令牌加密与迁移验收](validation/0.16.2.md)。
+
 [0.16.1 会话附件与发信策略验收](validation/0.16.1.md)。
 
 [0.15.3 通知开关验收](validation/0.15.3.md)。

package/docs/validation/0.16.2.md

@@ -0,0 +1,28 @@
+# 0.16.2 · Windows OAuth2 令牌保护
+
+2026-10-08，Windows / Node 24.16.0。PR #22 提到了明文令牌存储问题，但 diff 仅向 `lib/oauth2.js` 增加未使用的加密函数导入，未改源码、读写或迁移；构建还会覆盖这行。此次修复在 TypeScript 源码实现。
+
+## 实现与保护范围
+
+- Windows 使用系统 PowerShell 调用 .NET `ProtectedData` / DPAPI，绑定 `CurrentUser`，加密整个有效令牌文档。静态脚本不携带凭据；输入输出通过匿名进程管道，隐藏窗口，超时 10 秒，输出有上限，不打印原始子进程异常。
+- 新文件只包含版本、保护机制与密文，没有 access / refresh token 或账号明文。首次读取有效旧文件时先加密成功，再原位替换；不生成明文备份。缓存只复用字节完全相同的已认证文档，每次仍读取文件，不掩盖密文被修改。
+- 私有临时文件写入、同步后再原子替换。加密不可用、未知格式、截断或解锁失败时不覆盖旧数据，不回退 Windows 明文写入。缺失文件仍表示未登录；格式损坏不再被错误地视为可覆盖的空账号集合。
+- POSIX 仍为明文 JSON，更新通过 0600 新文件替换，从而修正旧文件过宽的权限。没有将文件权限描述为加密。
+
+DPAPI 使用 Windows 登录身份提供保护，通常要求同一用户及机器；**同一用户运行的其他程序不在隔离范围内**。跨设备、换系统账号或退回旧插件格式时需要重新登录。与本机 `settings.yaml` 中密码账号授权码的保存方式无关，本次没有修改用户配置、密码或系统权限。
+
+参考：[微软 ProtectedData](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.protecteddata?view=netframework-4.8)、[CryptProtectData](https://learn.microsoft.com/en-us/windows/desktop/api/Dpapi/nf-dpapi-cryptprotectdata)、[Node 文件权限 API](https://nodejs.org/api/fs.html#fschmodpath-mode-callback)。
+
+## 验证
+
+完整邮件回归 346 项通过；最终存储专项 6 项通过，包括真实 Windows DPAPI 加解密、独立 Node 进程解锁、旧数据迁移保留多账号、删除仅影响指定账号、未知格式 / 损坏 / 截断文件保留、缓存后篡改真实密文仍被拒绝、加密不可用时不生成明文或破坏旧文件。设备码、刷新单次请求、撤销登录、SMTP OAuth2 重试与取消等已有协议回归仍通过。
+
+专项测试只使用 E 盘仓库下的隔离合成令牌，不读取本机账号令牌，不连接微软或实际邮箱，不泄露真实凭据。macOS / Linux 的原子保存与权限路径由 GitHub Linux CI 另行检查；Windows 专属原生用例在 Linux 明确跳过，不把模拟检查算作其他平台原生加密。
+
+隔离官方 Alpha 网页在 1280×720 实际操作通过：首次加载后三个合成 Outlook 账号都保持已登录，磁盘已变为密文；在账号页删除 spare 并确认，剩下 work / personal 的令牌和登录状态不变。人为破坏保护机制标识后，英文设置页显示保留原文件和恢复操作的完整提示，文件 SHA256 没有被页面改写；恢复原密文，再切换回邮件页，两账号重新正常显示。正常页面控制台没有 error / warn；故障步骤产生的拒绝响应属于预期检查。
+
+![删除一个账号后，其余账号仍登录](0.16.2-accounts-en.png)
+
+![英文界面的文件恢复说明](0.16.2-recovery-en.png)
+
+没有 API 密钥或真实凭据进入隔离环境，未调用测试连接或实际邮箱。真实微软账号授权、跨 Windows 用户解锁拒绝及原生 DSH 桌面操作不属于本次验收。

package/lib/client.js

@@ -18,6 +18,10 @@ function emailError(error) {
   if (UI_LANG !== 'en') return message;
   if (error?.status === 401) return 'Your DSH session expired. Reopen DSH and try again.';
   if (!/[\u3400-\u9fff]/.test(message)) return message;
+  if (/未写入明文令牌/.test(message)) return 'Windows credential encryption is unavailable. Check system PowerShell / DPAPI and retry. No plaintext tokens were written.';
+  if (/无法读取或解锁 OAuth2 登录数据/.test(message)) return 'The OAuth login file could not be read or unlocked. Windows encrypted files require the original Windows user. Preserve and move aside oauth2-tokens.json before signing in again on a new device or recovering damaged data. The original file was not overwritten.';
+  if (/无法读取 OAuth2 登录数据/.test(message)) return 'The OAuth login file could not be read. Check file access permissions; the original file was not overwritten.';
+  if (/OAuth2 登录数据过大/.test(message)) return 'The OAuth login data exceeds the storage limit. The original file was not overwritten.';
   if (/结果.*未|不要.*重发|不要.*发送|本地保存失败|回执未能保存/.test(message)) return 'The send outcome is uncertain or its receipt could not be saved. Check the mailbox before sending again to avoid duplicate delivery.';
   if (/已提交|不能再次发送/.test(message)) return 'This draft was submitted or its outcome is uncertain. Check the mailbox before copying it to a new draft.';
   if (/预览已过期|draft-preview-expired/.test(message + ' ' + (error?.code || ''))) return 'The send review expired or was already used. Review the current draft again.';

package/lib/oauth2-storage.d.ts

@@ -0,0 +1,6 @@
+export declare class OAuth2StorageError extends Error {
+}
+export declare function readOAuth2Document(file: string): unknown;
+/** Encrypt before touching the destination, then replace it in one rename. */
+export declare function writeOAuth2Document(file: string, doc: unknown): void;
+export declare function isLegacyOAuth2Document(doc: unknown): boolean;

package/lib/oauth2-storage.js

@@ -0,0 +1,121 @@
+/** Windows DPAPI protects stored OAuth2 credentials with the current user's OS key. */
+import { spawnSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+const MAX_STORE_BYTES = 1024 * 1024;
+const PROTECTION = 'windows-dpapi-current-user';
+const ENTROPY = 'dsh-email/oauth2-tokens/v2';
+const STORAGE_MESSAGE = '无法读取或解锁 OAuth2 登录数据：Windows 加密文件需原 Windows 账号；损坏或换设备时请先保留并移走 oauth2-tokens.json，再重新登录。原文件未被覆盖。';
+const ENCRYPTION_MESSAGE = '无法安全保存 OAuth2 登录数据：Windows 用户加密不可用，请检查系统 PowerShell / DPAPI 后重试。未写入明文令牌。';
+export class OAuth2StorageError extends Error {
+}
+// Cache only one authenticated document. File bytes are checked on every read;
+// callers parse their own copy so deleting an account cannot mutate this cache.
+let cached;
+function dpapi(operation, input) {
+    const root = process.env.SystemRoot ?? process.env.WINDIR ?? 'C:\\Windows';
+    const executable = join(root, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    // This script is static: credentials go through stdin, never argv, an env var,
+    // a temporary plaintext file, a profile script or a generated shell command.
+    const script = `$ErrorActionPreference='Stop'; try {
+    Add-Type -AssemblyName System.Security
+    $bytes=[Convert]::FromBase64String([Console]::In.ReadToEnd())
+    $entropy=[Text.Encoding]::UTF8.GetBytes('${ENTROPY}')
+    $result=[Security.Cryptography.ProtectedData]::${operation}($bytes,$entropy,[Security.Cryptography.DataProtectionScope]::CurrentUser)
+    [Console]::Out.Write([Convert]::ToBase64String($result))
+  } catch { [Console]::Error.Write('DPAPI failed'); exit 1 }`;
+    const result = spawnSync(executable, ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], {
+        input: input.toString('base64'), encoding: 'utf8', windowsHide: true,
+        timeout: 10000, maxBuffer: MAX_STORE_BYTES * 4,
+    });
+    const output = result.stdout?.trim() ?? '';
+    if (result.error !== undefined || result.status !== 0 || output === '' || !/^[A-Za-z0-9+/]+={0,2}$/.test(output)) {
+        throw new OAuth2StorageError(operation === 'Protect' ? ENCRYPTION_MESSAGE : STORAGE_MESSAGE);
+    }
+    return Buffer.from(output, 'base64');
+}
+function isProtected(doc) {
+    return doc !== null && typeof doc === 'object' && !Array.isArray(doc)
+        && ((doc.version !== undefined && doc.version !== 1) || 'protection' in doc || 'ciphertext' in doc);
+}
+function parseDocument(raw) {
+    if (Buffer.byteLength(raw) > MAX_STORE_BYTES * 2)
+        throw new OAuth2StorageError(STORAGE_MESSAGE);
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new OAuth2StorageError(STORAGE_MESSAGE);
+    }
+}
+export function readOAuth2Document(file) {
+    const raw = readFileSync(file, 'utf8');
+    const doc = parseDocument(raw);
+    if (!isProtected(doc))
+        return doc;
+    if (process.platform !== 'win32' || doc.version !== 2 || doc.protection !== PROTECTION
+        || typeof doc.ciphertext !== 'string' || !/^[A-Za-z0-9+/]+={0,2}$/.test(doc.ciphertext)) {
+        throw new OAuth2StorageError(STORAGE_MESSAGE);
+    }
+    try {
+        const plaintext = cached?.file === file && cached.envelope === raw
+            ? cached.plaintext : dpapi('Unprotect', Buffer.from(doc.ciphertext, 'base64')).toString('utf8');
+        const value = JSON.parse(plaintext);
+        if (value === null || typeof value !== 'object' || Array.isArray(value)
+            || value.version !== 1)
+            throw new Error('Invalid protected document');
+        cached = { file, envelope: raw, plaintext };
+        return value;
+    }
+    catch {
+        throw new OAuth2StorageError(STORAGE_MESSAGE);
+    }
+}
+/** Encrypt before touching the destination, then replace it in one rename. */
+export function writeOAuth2Document(file, doc) {
+    // Never replace a locked, foreign-user, unsupported or damaged encrypted
+    // store with a new empty store during a login or account deletion.
+    let existing;
+    try {
+        existing = parseDocument(readFileSync(file, 'utf8'));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (isProtected(existing))
+        readOAuth2Document(file);
+    const plaintext = JSON.stringify(doc, null, 2) + '\n';
+    if (Buffer.byteLength(plaintext) > MAX_STORE_BYTES)
+        throw new OAuth2StorageError('OAuth2 登录数据过大，原文件未被覆盖。');
+    const raw = process.platform === 'win32'
+        ? JSON.stringify({ version: 2, protection: PROTECTION, ciphertext: dpapi('Protect', Buffer.from(plaintext)).toString('base64') }, null, 2) + '\n'
+        : plaintext;
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    const temp = file + '.' + randomUUID() + '.tmp';
+    let fd;
+    try {
+        fd = openSync(temp, 'wx', 0o600);
+        writeFileSync(fd, raw, 'utf8');
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        renameSync(temp, file);
+        cached = process.platform === 'win32' ? { file, envelope: raw, plaintext } : undefined;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+        try {
+            unlinkSync(temp);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+}
+export function isLegacyOAuth2Document(doc) {
+    return !isProtected(doc);
+}

package/lib/oauth2.d.ts

@@ -71,9 +71,9 @@ interface OAuthFailure {
  * normal state, not an error: the user simply has not finished in the browser.
  */
 export declare function classifyOAuthFailure(payload: unknown, httpStatus?: number): OAuthFailure;
-/** Read the store. A missing or unreadable file is 「no tokens」, never a crash. */
+/** Missing/legacy malformed entries mean no tokens; unreadable or corrupt files fail closed. */
 export declare function readTokenStore(): OAuth2TokenStore;
-/** Persist the store. Owner-only where the platform honours the mode; utf8, no BOM. */
+/** Windows: current-user DPAPI. POSIX: private atomic file. Never write plaintext on Windows. */
 export declare function writeTokenStore(store: OAuth2TokenStore): void;
 /** Drop one account's tokens (a dead refresh token, or a mailbox that moved). */
 export declare function clearTokenFor(name: string): boolean;

package/lib/oauth2.js

@@ -18,10 +18,10 @@
  * fingerprint and are never logged. Every message that leaves this module is
  * the text the user reads in Chinese, without any token material in it.
  */
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { join } from 'node:path';
 import { clampInt, OUTLOOK_OAUTH2_CLIENT_ID } from './config.js';
+import { isLegacyOAuth2Document, OAuth2StorageError, readOAuth2Document, writeOAuth2Document } from './oauth2-storage.js';
 /** The authority that serves both endpoints. `common` accepts any work/school/personal tenant. */
 export const OAUTH2_TENANT = 'common';
 export const DEVICE_CODE_URL = 'https://login.microsoftonline.com/' + OAUTH2_TENANT + '/oauth2/v2.0/devicecode';
@@ -143,14 +143,18 @@ export function classifyOAuthFailure(payload, httpStatus = 0) {
     return { ...base, message: '登录失败：' + detail + (aadsts !== '' ? '（AADSTS' + aadsts + '）' : '') };
 }
 // --- token store -------------------------------------------------------------
-/** Read the store. A missing or unreadable file is 「no tokens」, never a crash. */
+/** Missing/legacy malformed entries mean no tokens; unreadable or corrupt files fail closed. */
 export function readTokenStore() {
     let doc;
     try {
-        doc = JSON.parse(readFileSync(oauth2TokenFile(), 'utf8'));
+        doc = readOAuth2Document(oauth2TokenFile());
     }
-    catch {
-        return { version: 1, accounts: {} };
+    catch (error) {
+        if (error instanceof OAuth2StorageError)
+            throw new OAuth2Error(error.message);
+        if (error.code === 'ENOENT')
+            return { version: 1, accounts: {} };
+        throw new OAuth2Error('无法读取 OAuth2 登录数据，请检查文件访问权限。原文件未被覆盖。');
     }
     if (doc === null || typeof doc !== 'object' || Array.isArray(doc))
         return { version: 1, accounts: {} };
@@ -163,7 +167,10 @@ export function readTokenStore() {
                 accounts[name] = entry;
         }
     }
-    return { version: 1, accounts };
+    const store = { version: 1, accounts };
+    if (process.platform === 'win32' && isLegacyOAuth2Document(doc) && Object.keys(accounts).length > 0)
+        writeTokenStore(store);
+    return store;
 }
 /** Keep only well-formed entries: a half-written file must not poison a login. */
 function tokenEntryOf(value) {
@@ -180,11 +187,16 @@ function tokenEntryOf(value) {
         expiresAt: typeof doc.expiresAt === 'number' && Number.isFinite(doc.expiresAt) ? doc.expiresAt : 0,
     };
 }
-/** Persist the store. Owner-only where the platform honours the mode; utf8, no BOM. */
+/** Windows: current-user DPAPI. POSIX: private atomic file. Never write plaintext on Windows. */
 export function writeTokenStore(store) {
-    const file = oauth2TokenFile();
-    mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, JSON.stringify(store, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+    try {
+        writeOAuth2Document(oauth2TokenFile(), store);
+    }
+    catch (error) {
+        if (error instanceof OAuth2StorageError)
+            throw new OAuth2Error(error.message);
+        throw error;
+    }
 }
 /** Drop one account's tokens (a dead refresh token, or a mailbox that moved). */
 export function clearTokenFor(name) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-email",
-  "version": "0.16.1",
+  "version": "0.16.2",
   "description": "在 DSH 中收发、搜索和整理邮件，支持多个邮箱账号。",
   "type": "module",
   "main": "lib/index.js",