dsh-mishu 0.5.0 → 0.5.4

package/README.md

@@ -54,7 +54,7 @@
 
 同一封邮件的往来回复算一件事。你在邮件客户端里看过之后，对应的事项会自动关闭。
 
-**密码放在系统钥匙串**：macOS 钥匙串、Windows 凭据管理器、Linux 密钥环（Secret Service）。密码只在设置页输入一次，直接交给钥匙串，不写进任何文件，接口也从不返回它。没有钥匙串的电脑，可以改用环境变量 `DSH_MISHU_SECRET_MAIL_<编号>`。
+**密码放在系统钥匙串**：macOS 钥匙串、Windows 凭据管理器、Linux 密钥环（Secret Service）。密码只在设置页输入一次，直接交给钥匙串，不写进任何文件，接口也从不返回它。没有钥匙串的电脑（比如没有桌面的 Linux 服务器），设置页会说明原因；账户照样能保存，密码改用环境变量 `DSH_MISHU_SECRET_MAIL_<编号>` 提供。
 
 ### 用法
 
@@ -72,6 +72,8 @@
 
 **设置**：点页面顶部的"设置"：语言、各类别提前几天提醒、GitHub（开关、token 从哪来、测试连接、在 GitHub 上标已读的方式）、邮箱账户（添加、测试连接、现在收一次、编辑、删除）。飞书即将接入。
 
+**重启 DSH**：页面顶部"设置"后面的按键。重装或升级插件后点它，桌面版会按正常方式退出（有任务在跑时会先问你），再自动打开。用 `dsh` 命令启动的 DSH 没法从页面重启（新的登录地址只会打印在那个终端里），按键会告诉你回终端按 Ctrl+C 再运行一次。Windows 和 Linux 桌面版的重启还没在真机上测过。
+
 **文字命令**：
 
 ```
@@ -97,10 +99,11 @@ agent 可用的工具：`mishu_add`（交代，需要你审批）、`mishu_list`
 
 ### GitHub token
 
-mishu 自己不保存 token。按顺序取：
+按顺序取，token 不写进任何文件：
 
 1. 环境变量（默认 `GITHUB_TOKEN`）
-2. `gh auth token`：装了 GitHub CLI，并运行过 `gh auth login` 就行
+2. 你在设置页填的 token：先拿到 GitHub 上检查，再存进系统钥匙串。要用 classic token，勾选 `notifications`（看私有仓库再勾 `repo`）；GitHub 的通知接口不认 fine-grained token
+3. `gh auth token`：装了 GitHub CLI，并运行过 `gh auth login` 就行。从 Dock、开始菜单启动的 DSH 拿到的 PATH 往往很短，所以小秘书除了 PATH，还会去 Homebrew、`~/.local/bin`、winget、Scoop 等常见安装位置找 `gh`
 
 ### 安装和配置
 
@@ -177,7 +180,7 @@ Default warning times: documents 90 days, bills 3, birthdays 7, renewals 7, ever
 
 A thread of replies is one item. Once you read it in your mail client, its item closes by itself.
 
-**Passwords live in the system keychain**: the macOS Keychain, Windows Credential Manager or the Linux keyring (Secret Service). You type a password once on the settings page; it goes straight to the keychain, is never written to a file and is never returned by any endpoint. Without a keychain, use the environment variable `DSH_MISHU_SECRET_MAIL_<id>`.
+**Passwords live in the system keychain**: the macOS Keychain, Windows Credential Manager or the Linux keyring (Secret Service). You type a password once on the settings page; it goes straight to the keychain, is never written to a file and is never returned by any endpoint. On a computer without one (a Linux server with no desktop, say), the settings page says why; accounts still save, and each password comes from the environment variable `DSH_MISHU_SECRET_MAIL_<id>`.
 
 ### Usage
 
@@ -195,6 +198,8 @@ Cards can be dragged: onto "Done for you" to mark done, onto "Keeping for you" t
 
 **Settings**: the "Settings" tab at the top of the page: language, warning days per category, GitHub (on/off, where the token comes from, connection test, how to mark read), mail accounts (add, test, check now, edit, delete). Feishu / Lark is coming.
 
+**Restart DSH**: the button after "Settings" at the top of the page. After reinstalling or upgrading plugins, click it: the desktop app quits the normal way (asking first if a task is running) and opens again. DSH started with the `dsh` command cannot be restarted from the page (its new sign-in address is printed only in that terminal), so the button tells you to press Ctrl+C there and run it again. Restarting the Windows and Linux desktop apps is not yet tested on real machines.
+
 **Text commands**:
 
 ```
@@ -220,10 +225,11 @@ Tools for the agent: `mishu_add` (needs your approval), `mishu_list`, `mishu_det
 
 ### GitHub token
 
-mishu never stores a token. It uses, in order:
+It uses, in order, and never writes a token to a file:
 
 1. an environment variable (default `GITHUB_TOKEN`)
-2. `gh auth token`: if the GitHub CLI is installed and you have run `gh auth login`
+2. a token you paste on the settings page: checked with GitHub first, then kept in the system keychain. Use a classic token with the `notifications` scope (plus `repo` for private repositories); GitHub's notifications API does not take fine-grained tokens
+3. `gh auth token`: if the GitHub CLI is installed and you have run `gh auth login`. DSH started from the Dock or Start menu often gets a short PATH, so besides PATH the secretary looks for `gh` where Homebrew, `~/.local/bin`, winget and Scoop put it
 
 ### Install and configure
 

package/lib/client.js

@@ -60,10 +60,16 @@ var mishuApi = {
   add: (lang, item) => post("/add", { lang, item }),
   ask: (lang, ask) => post("/ask", { lang, ask })
 };
+var restartApi = {
+  info: (lang) => post("/restart/info", { lang }),
+  restart: (lang) => post("/restart", { lang })
+};
 var settingsApi = {
   load: (lang) => post("/settings", { lang }),
   save: (lang, settings) => post("/settings/save", { lang, settings }),
   testGithub: (lang) => post("/github/test", { lang }),
+  saveToken: (lang, token) => post("/github/token/save", { lang, token }),
+  deleteToken: (lang) => post("/github/token/delete", { lang }),
   saveMail: (lang, account, password) => post("/mail/save", { lang, account, password }),
   testMail: (lang, account, password) => post("/mail/test", { lang, account, password }),
   deleteMail: (lang, id) => post("/mail/delete", { lang, id }),
@@ -132,6 +138,10 @@ var zh = {
   resize: "\u62D6\u52A8\u8C03\u6574\u5BBD\u5EA6\uFF0C\u53CC\u51FB\u6062\u590D\u7B49\u5BBD",
   tabBoard: "\u770B\u677F",
   tabSettings: "\u8BBE\u7F6E",
+  restart: "\u91CD\u542F DSH",
+  restartTip: "\u91CD\u88C5\u6216\u5347\u7EA7\u63D2\u4EF6\u540E\uFF0C\u53EF\u4EE5\u7528\u8FD9\u4E2A\u6309\u952E\u91CD\u542F\u672C DSH",
+  restartConfirm: "\u91CD\u542F DSH\uFF1F\u5B89\u88C5\u63D2\u4EF6\u6216\u8005\u63D2\u4EF6\u66F4\u65B0\u540E\u9700\u8981\u91CD\u542F DSH\u3002",
+  restarting: "\u6B63\u5728\u91CD\u542F\u2026\u7A97\u53E3\u4F1A\u5173\u6389\u518D\u81EA\u52A8\u6253\u5F00",
   all: "\u5168\u90E8",
   sourceGithub: "GitHub",
   sourceMail: "\u90AE\u4EF6",
@@ -147,6 +157,16 @@ var zh = {
   sToken: "Token",
   sTokenEnv: (name) => `\u4ECE\u73AF\u5883\u53D8\u91CF ${name} \u8BFB\u53D6`,
   sTokenGh: "\u7528 GitHub CLI\uFF08gh\uFF09\u767B\u5F55\u7684\u8D26\u53F7\uFF0Ctoken \u5728\u7CFB\u7EDF\u94A5\u5319\u4E32\u91CC",
+  sTokenKeychain: "\u4F60\u5728\u8FD9\u91CC\u586B\u7684 token\uFF0C\u5B58\u5728\u7CFB\u7EDF\u94A5\u5319\u4E32\u91CC",
+  sTokenPaste: "\u586B\u4E00\u4E2A GitHub token",
+  sTokenHow: "\u7528 classic token\uFF0C\u52FE\u9009 notifications\uFF1B\u8981\u770B\u79C1\u6709\u4ED3\u5E93\u518D\u52FE repo\u3002GitHub \u7684\u901A\u77E5\u63A5\u53E3\u4E0D\u8BA4 fine-grained token\u3002token \u53EA\u5B58\u8FDB\u7CFB\u7EDF\u94A5\u5319\u4E32\uFF0C\u4E0D\u5199\u8FDB\u4EFB\u4F55\u6587\u4EF6\u3002",
+  sTokenNew: "\u53BB GitHub \u751F\u6210\uFF08\u6743\u9650\u5DF2\u52FE\u597D\uFF09",
+  sTokenSave: "\u68C0\u67E5\u5E76\u4FDD\u5B58",
+  sTokenSaved: (login) => `\u4FDD\u5B58\u597D\u4E86\uFF0C\u8D26\u53F7 ${login}`,
+  sTokenReplace: "\u6362\u4E00\u4E2A token",
+  sTokenRemove: "\u79FB\u9664 token",
+  sTokenRemoveConfirm: "\u4ECE\u94A5\u5319\u4E32\u91CC\u79FB\u9664\u8FD9\u4E2A token\uFF1F",
+  sTokenNoKeychain: (env, why) => `\u8FD9\u53F0\u7535\u8111\u6CA1\u6709\u53EF\u7528\u7684\u7CFB\u7EDF\u94A5\u5319\u4E32\uFF08${why}\uFF09\uFF0Ctoken \u6CA1\u6CD5\u4FDD\u5B58\u3002\u53EF\u4EE5\u5728\u542F\u52A8 DSH \u7684\u73AF\u5883\u91CC\u8BBE\u7F6E ${env}\uFF0C\u518D\u91CD\u542F DSH\u3002`,
   sTest: "\u6D4B\u8BD5\u8FDE\u63A5",
   sTesting: "\u6B63\u5728\u6D4B\u8BD5\u2026",
   sGithubOk: (login) => `\u8FDE\u4E0A\u4E86\uFF0C\u8D26\u53F7 ${login}`,
@@ -160,7 +180,8 @@ var zh = {
   sMail: "\u90AE\u7BB1",
   sMailPrivacy: "\u53EA\u8BFB\uFF1A\u5C0F\u79D8\u4E66\u7528\u53EA\u8BFB\u65B9\u5F0F\u6253\u5F00\u6536\u4EF6\u7BB1\uFF0C\u53EA\u770B\u53D1\u4EF6\u4EBA\u3001\u6536\u4EF6\u4EBA\u3001\u6807\u9898\u548C\u51E0\u4E2A\u90AE\u4EF6\u5934\uFF0C\u4E0D\u8BFB\u6B63\u6587\uFF0C\u4E5F\u4E0D\u4F1A\u628A\u90AE\u4EF6\u6807\u6210\u5DF2\u8BFB\u3002",
   sSecretsAt: (kind) => `\u5BC6\u7801\u4FDD\u5B58\u5728\uFF1A${kind}\uFF08\u52A0\u5BC6\u4FDD\u5B58\uFF0C\u4E0D\u5199\u8FDB\u4EFB\u4F55\u6587\u4EF6\uFF09`,
-  sSecretsNone: "\u8FD9\u53F0\u7535\u8111\u4E0A\u6CA1\u627E\u5230\u53EF\u7528\u7684\u7CFB\u7EDF\u94A5\u5319\u4E32\uFF0C\u6CA1\u6CD5\u4FDD\u5B58\u5BC6\u7801\u3002\u53EF\u4EE5\u6539\u7528\u73AF\u5883\u53D8\u91CF\uFF0C\u540D\u5B57\u89C1\u6BCF\u4E2A\u8D26\u6237\u4E0B\u9762\u3002",
+  sSecretsNone: (why) => `\u8FD9\u53F0\u7535\u8111\u4E0A\u6CA1\u6709\u53EF\u7528\u7684\u7CFB\u7EDF\u94A5\u5319\u4E32\uFF1A${why}\u3002\u5BC6\u7801\u4E0D\u4F1A\u88AB\u4FDD\u5B58\uFF1B\u8D26\u6237\u7167\u6837\u80FD\u4FDD\u5B58\uFF0C\u5BC6\u7801\u7528\u73AF\u5883\u53D8\u91CF\u63D0\u4F9B\uFF0C\u53D8\u91CF\u540D\u5199\u5728\u6BCF\u4E2A\u8D26\u6237\u4E0B\u9762\u3002`,
+  sPasswordTestOnly: "\u6CA1\u6709\u94A5\u5319\u4E32\uFF1A\u8FD9\u91CC\u586B\u7684\u53EA\u7528\u6765\u6D4B\u8BD5\u8FDE\u63A5\uFF0C\u4E0D\u4F1A\u4FDD\u5B58",
   secretKinds: { macos: "macOS \u94A5\u5319\u4E32", windows: "Windows \u51ED\u636E\u7BA1\u7406\u5668", linux: "Linux \u5BC6\u94A5\u73AF\uFF08Secret Service\uFF09", memory: "\u5185\u5B58\uFF08\u6D4B\u8BD5\u7528\uFF09" },
   sNoAccounts: "\u8FD8\u6CA1\u6709\u6DFB\u52A0\u90AE\u7BB1\u3002",
   sAddAccount: "+ \u6DFB\u52A0\u90AE\u7BB1",
@@ -180,7 +201,7 @@ var zh = {
   sSince: "\u53EA\u770B\u6700\u8FD1\u51E0\u5929\u7684\u672A\u8BFB\u90AE\u4EF6",
   sEnabled: "\u542F\u7528",
   sMailOk: (n) => `\u8FDE\u4E0A\u4E86\uFF0C\u6700\u8FD1\u6709 ${n} \u5C01\u672A\u8BFB\u90AE\u4EF6`,
-  sEnvHint: (name) => `\u6CA1\u6709\u94A5\u5319\u4E32\u65F6\uFF0C\u53EF\u4EE5\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF ${name}`,
+  sEnvHint: (name) => `\u6CA1\u6709\u627E\u5230\u5BC6\u7801\u3002\u70B9\u300C\u7F16\u8F91\u300D\u91CD\u65B0\u586B\u4E00\u6B21\uFF1B\u8FD9\u53F0\u7535\u8111\u6CA1\u6709\u94A5\u5319\u4E32\u7684\u8BDD\uFF0C\u5728\u542F\u52A8 DSH \u7684\u73AF\u5883\u91CC\u8BBE\u7F6E ${name}=\u6388\u6743\u7801\uFF0C\u518D\u91CD\u542F DSH\u3002`,
   sNeverChecked: "\u8FD8\u6CA1\u6536\u8FC7",
   sFeishu: "\u98DE\u4E66",
   sComing: "\u5373\u5C06\u63A5\u5165",
@@ -245,6 +266,10 @@ var en = {
   resize: "Drag to resize; double-click to make them equal",
   tabBoard: "Board",
   tabSettings: "Settings",
+  restart: "Restart DSH",
+  restartTip: "After reinstalling or upgrading plugins, use this to restart DSH",
+  restartConfirm: "Restart DSH? DSH needs a restart after you install or update plugins.",
+  restarting: "Restarting\u2026 the window closes and opens again",
   all: "All",
   sourceGithub: "GitHub",
   sourceMail: "Mail",
@@ -260,6 +285,16 @@ var en = {
   sToken: "Token",
   sTokenEnv: (name) => `Read from the environment variable ${name}`,
   sTokenGh: "The account the GitHub CLI (gh) is signed in to; the token stays in the system keychain",
+  sTokenKeychain: "The token you pasted here, kept in the system keychain",
+  sTokenPaste: "Paste a GitHub token",
+  sTokenHow: "Use a classic token with the notifications scope, plus repo for private repositories. GitHub's notifications API does not take fine-grained tokens. The token goes to the system keychain only, never to a file.",
+  sTokenNew: "Create one on GitHub (scopes pre-ticked)",
+  sTokenSave: "Check and save",
+  sTokenSaved: (login) => `Saved; signed in as ${login}`,
+  sTokenReplace: "Use another token",
+  sTokenRemove: "Remove token",
+  sTokenRemoveConfirm: "Remove this token from the keychain?",
+  sTokenNoKeychain: (env, why) => `No usable system keychain on this computer (${why}), so the token cannot be saved. Set ${env} in the environment DSH starts from, then restart DSH.`,
   sTest: "Test connection",
   sTesting: "Testing\u2026",
   sGithubOk: (login) => `Connected as ${login}`,
@@ -273,7 +308,8 @@ var en = {
   sMail: "Mail",
   sMailPrivacy: "Read-only: the secretary opens your inbox read-only and looks at sender, recipients, subject and a few headers only. It never reads bodies and never marks mail read.",
   sSecretsAt: (kind) => `Passwords are kept in: ${kind} (encrypted, never written to a file)`,
-  sSecretsNone: "No usable system keychain on this computer, so passwords cannot be saved. Use the environment variable shown under each account instead.",
+  sSecretsNone: (why) => `No usable system keychain on this computer: ${why}. Passwords are not saved; you can still save accounts and give each password through the environment variable shown under it.`,
+  sPasswordTestOnly: "No keychain: used only to test the connection, not saved",
   secretKinds: { macos: "the macOS Keychain", windows: "Windows Credential Manager", linux: "the Linux keyring (Secret Service)", memory: "memory (tests)" },
   sNoAccounts: "No mail account yet.",
   sAddAccount: "+ Add a mail account",
@@ -293,7 +329,7 @@ var en = {
   sSince: "Only look at unread mail from the last \u2026 days",
   sEnabled: "Enabled",
   sMailOk: (n) => `Connected; ${n} unread messages recently`,
-  sEnvHint: (name) => `Without a keychain, set the environment variable ${name}`,
+  sEnvHint: (name) => `No password found. Click Edit and enter it again; if this computer has no keychain, set ${name}=<app password> in the environment DSH starts from, then restart DSH.`,
   sNeverChecked: "Not checked yet",
   sFeishu: "Feishu / Lark",
   sComing: "Coming soon",
@@ -366,6 +402,7 @@ function MishuSettings({ lang, locale, openChat: openChat2 }) {
   const [lead, setLead] = (0, import_react2.useState)({});
   const [githubTest, setGithubTest] = (0, import_react2.useState)();
   const [confirmOn, setConfirmOn] = (0, import_react2.useState)(false);
+  const [pasting, setPasting] = (0, import_react2.useState)(false);
   const [editing, setEditing] = (0, import_react2.useState)();
   const take = (result, saved) => {
     if (result.ok) {
@@ -426,15 +463,27 @@ function MishuSettings({ lang, locale, openChat: openChat2 }) {
       ] }),
       /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "mishu-row-explain", children: [
         /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: "mishu-row-label", children: t.sToken }),
-        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: token.found ? "" : "mishu-danger", children: token.found ? token.from === "env" ? t.sTokenEnv(view.github.tokenEnv) : t.sTokenGh : token.text })
+        /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: token.found ? "" : "mishu-danger", children: token.found ? token.from === "env" ? t.sTokenEnv(view.github.tokenEnv) : token.from === "keychain" ? t.sTokenKeychain : t.sTokenGh : token.text })
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "mishu-actions", children: [
+      token.found ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "mishu-actions", children: [
         /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { type: "button", className: "mishu-btn", onClick: () => {
           setGithubTest(t.sTesting);
           void settingsApi.testGithub(locale()).then((r) => setGithubTest(r.ok ? t.sGithubOk(r.login) : `${t.failed}${r.message}`));
         }, children: t.sTest }),
+        token.from === "env" || pasting ? null : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { type: "button", className: "mishu-btn", onClick: () => setPasting(true), children: t.sTokenReplace }),
+        token.from === "keychain" ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { type: "button", className: "mishu-btn mishu-btn-quiet", onClick: () => {
+          if (window.confirm(t.sTokenRemoveConfirm)) void settingsApi.deleteToken(locale()).then((r) => {
+            setGithubTest(void 0);
+            take(r);
+          });
+        }, children: t.sTokenRemove }) : null,
         githubTest === void 0 ? null : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: "mishu-hint", children: githubTest })
-      ] }),
+      ] }) : null,
+      !token.found || pasting ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(TokenForm, { view, lang, locale, onSaved: (next, login) => {
+        setPasting(false);
+        setGithubTest(t.sTokenSaved(login));
+        take({ ok: true, view: next });
+      }, onCancel: token.found ? () => setPasting(false) : void 0 }) : null,
       /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("label", { className: "mishu-field", children: [
         t.sMarkRead,
         /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("select", { value: view.settings.markRead, onChange: (e) => {
@@ -461,7 +510,7 @@ function MishuSettings({ lang, locale, openChat: openChat2 }) {
     /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("section", { className: "mishu-panel", children: [
       /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("h2", { children: t.sMail }),
       /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "mishu-hint", children: t.sMailPrivacy }),
-      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: view.secrets.available ? "mishu-hint" : "mishu-hint mishu-warn", children: view.secrets.available ? t.sSecretsAt(secretKind) : t.sSecretsNone }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: view.secrets.available ? "mishu-hint" : "mishu-hint mishu-warn", children: view.secrets.available ? t.sSecretsAt(secretKind) : t.sSecretsNone(view.secrets.why ?? secretKind) }),
       view.accounts.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "mishu-empty", children: t.sNoAccounts }) : view.accounts.map((account) => /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(
         AccountRow,
         {
@@ -485,6 +534,45 @@ function MishuSettings({ lang, locale, openChat: openChat2 }) {
     ] })
   ] });
 }
+function TokenForm({ view, lang, locale, onSaved, onCancel }) {
+  const t = TEXT[lang];
+  const [token, setToken] = (0, import_react2.useState)("");
+  const [busy, setBusy] = (0, import_react2.useState)(false);
+  const [message, setMessage] = (0, import_react2.useState)();
+  if (!view.secrets.available) {
+    return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "mishu-hint mishu-warn", children: t.sTokenNoKeychain(view.github.tokenEnv, view.secrets.why ?? "") });
+  }
+  const save = async () => {
+    setBusy(true);
+    setMessage(void 0);
+    const r = await settingsApi.saveToken(locale(), token);
+    setBusy(false);
+    if (r.ok) {
+      setToken("");
+      onSaved(r.view, r.login);
+    } else {
+      setMessage(r.message);
+    }
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "mishu-add", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("label", { className: "mishu-field", children: [
+      t.sTokenPaste,
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("input", { type: "password", value: token, autoComplete: "off", spellCheck: false, placeholder: "ghp_\u2026", onChange: (e) => {
+        setToken(e.target.value);
+        setMessage(void 0);
+      } })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "mishu-hint", children: t.sTokenHow }),
+    message === void 0 ? null : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { className: "mishu-preview mishu-danger", children: message }),
+    /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "mishu-actions", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { type: "button", className: "mishu-btn", onClick: () => window.open(view.github.newTokenUrl, "_blank", "noopener"), children: t.sTokenNew }),
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { type: "button", className: "mishu-btn primary", disabled: busy || token.trim() === "", onClick: () => {
+        void save();
+      }, children: busy ? t.sTesting : t.sTokenSave }),
+      onCancel === void 0 ? null : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { type: "button", className: "mishu-btn", onClick: onCancel, children: t.sCancel })
+    ] })
+  ] });
+}
 function AccountRow({ account, lang, locale, openChat: openChat2, onEdit, onView }) {
   const t = TEXT[lang];
   const [busy, setBusy] = (0, import_react2.useState)(false);
@@ -578,11 +666,12 @@ function AccountForm({ draft, view, lang, locale, openChat: openChat2, onDone })
     ] }),
     /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("label", { className: "mishu-field", children: [
       t.sPassword,
-      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("input", { type: "password", value: password, autoComplete: "new-password", placeholder: existing ? t.sPasswordKeep : "", onChange: (e) => {
+      /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("input", { type: "password", value: password, autoComplete: "new-password", placeholder: existing && view.secrets.available ? t.sPasswordKeep : "", onChange: (e) => {
         setPassword(e.target.value);
         setMessage(void 0);
       } })
     ] }),
+    view.secrets.available ? null : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("p", { className: "mishu-hint mishu-warn", children: t.sPasswordTestOnly }),
     custom ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "mishu-row", children: [
       /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("label", { className: "mishu-field", children: [
         t.sHost,
@@ -603,7 +692,10 @@ function AccountForm({ draft, view, lang, locale, openChat: openChat2, onDone })
         t.sEnabled
       ] })
     ] }),
-    message === void 0 ? null : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("div", { className: `mishu-preview ${message.ok ? "" : "mishu-danger"}`, children: message.text }),
+    message === void 0 ? null : /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: `mishu-preview ${message.ok ? "" : "mishu-danger"}`, children: [
+      message.text,
+      message.ok || !preset.supported ? null : /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(AskAI, { topic: { kind: "mail-setup", preset: preset.id, error: message.text }, lang, locale, openChat: openChat2, compact: true })
+    ] }),
     /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: "mishu-actions", children: [
       /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("button", { type: "button", className: "mishu-btn", disabled: busy || !preset.supported, onClick: () => {
         void test();
@@ -796,7 +888,10 @@ function MishuBoard({ locale, openChat: openChat2 }) {
   );
   if (board === void 0) {
     return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("div", { className: "mishu-page", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("div", { className: "mishu-head", children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("h1", { children: t.title }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("div", { className: "mishu-head", children: /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("div", { className: "mishu-title", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("h1", { children: t.title }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(RestartButton, { lang, locale })
+      ] }) }),
       error === void 0 ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("p", { className: "mishu-empty", children: t.loading }) : /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("div", { className: "mishu-error", children: [
         t.failed,
         error
@@ -840,7 +935,8 @@ function MishuBoard({ locale, openChat: openChat2 }) {
         /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("div", { className: "mishu-tabs", role: "tablist", children: [
           /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("button", { type: "button", role: "tab", "aria-selected": tab === "board", className: tab === "board" ? "active" : "", onClick: () => setTab("board"), children: t.tabBoard }),
           /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("button", { type: "button", role: "tab", "aria-selected": tab === "settings", className: tab === "settings" ? "active" : "", onClick: () => setTab("settings"), children: t.tabSettings })
-        ] })
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(RestartButton, { lang, locale })
       ] }),
       /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("div", { className: "mishu-sources", children: [
         /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("span", { children: [
@@ -1086,6 +1182,33 @@ function AddForm({ lang, locale, onAdded }) {
     /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("p", { className: "mishu-hint", children: t.chatHint })
   ] });
 }
+function RestartButton({ lang, locale }) {
+  const t = TEXT[lang];
+  const [why, setWhy] = (0, import_react3.useState)();
+  const [status, setStatus] = (0, import_react3.useState)();
+  (0, import_react3.useEffect)(() => {
+    void restartApi.info(locale()).then((r) => {
+      if (r.ok && !r.supported) setWhy(r.why);
+    });
+  }, [locale]);
+  const restart = async () => {
+    if (why !== void 0) {
+      setStatus({ ok: false, text: why });
+      return;
+    }
+    if (!window.confirm(t.restartConfirm)) return;
+    setStatus({ ok: true, text: t.restarting });
+    const r = await restartApi.restart(locale());
+    if (!r.ok) setStatus({ ok: false, text: r.message });
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_jsx_runtime3.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("button", { type: "button", className: "mishu-btn", title: why === void 0 ? t.restartTip : `${t.restartTip}
+${why}`, disabled: status?.ok === true, onClick: () => {
+      void restart();
+    }, children: t.restart }),
+    status === void 0 ? null : /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("span", { className: status.ok ? "mishu-hint" : "mishu-hint mishu-warn", children: status.text })
+  ] });
+}
 
 // src/client/styles.ts
 var v = (name, fallback) => `var(--dsw-alias-${name}, ${fallback})`;
@@ -1160,6 +1283,8 @@ var STYLES = `
 .mishu-field input,.mishu-field select{font:inherit;font-size:13px;color:${TEXT2};background:${LAYER2};border:1px solid ${LINE_STRONG};border-radius:6px;padding:4px 6px;width:100%}
 .mishu-row{display:grid;grid-template-columns:1fr 1fr;gap:6px}
 .mishu-preview{white-space:pre-wrap;font-size:12px;background:${LAYER2};border-radius:6px;padding:6px 8px;margin:4px 0 6px;color:${TEXT2}}
+.mishu-preview.mishu-danger{color:${DANGER}}
+.mishu-add>.mishu-hint{margin-bottom:8px}
 .mishu-title{display:flex;align-items:center;gap:14px;flex-wrap:wrap}
 .mishu-tabs{display:flex;gap:2px;background:${LAYER1};border-radius:8px;padding:2px}
 .mishu-tabs button{font:inherit;font-size:13px;color:${MUTED};background:transparent;border:0;border-radius:6px;padding:3px 12px;cursor:pointer}

package/lib/core/ask.js

@@ -125,8 +125,8 @@ export function buildAsk(store, request, options) {
         case 'mail-setup': {
             const preset = presetById(request.preset);
             return zh
-                ? `我想让小秘书只读地查看我的「${preset.label.zh}」收件箱，需要开通 IMAP 并拿到客户端授权码（或应用专用密码）。请一步步教我怎么做，包括在网页上点哪里、要注意什么。\n\n小秘书给的说明：${preset.howTo.zh}\nIMAP 服务器：${preset.host || '（自己填）'}:${preset.port}`
-                : `I want my secretary to read my ${preset.label.en} inbox (read-only), which needs IMAP turned on and an app password. Walk me through it step by step, including where to click and what to watch out for.\n\nThe secretary's note: ${preset.howTo.en}\nIMAP server: ${preset.host || '(enter your own)'}:${preset.port}`;
+                ? `我想让小秘书只读地查看我的「${preset.label.zh}」收件箱，需要开通 IMAP 并拿到客户端授权码（或应用专用密码）。请一步步教我怎么做，包括在网页上点哪里、要注意什么。\n\n小秘书给的说明：${preset.howTo.zh}\nIMAP 服务器：${preset.host || '（自己填）'}:${preset.port}${lines('\n测试连接时报错：', request.error)}`
+                : `I want my secretary to read my ${preset.label.en} inbox (read-only), which needs IMAP turned on and an app password. Walk me through it step by step, including where to click and what to watch out for.\n\nThe secretary's note: ${preset.howTo.en}\nIMAP server: ${preset.host || '(enter your own)'}:${preset.port}${lines('\nThe connection test said: ', request.error)}`;
         }
     }
 }

package/lib/core/exec.js

@@ -0,0 +1,68 @@
+/**
+ * Running the few helper programs the secretary uses (`security`,
+ * `secret-tool`, PowerShell, `gh`).
+ *
+ * An app started from the Dock, the Start menu or a service manager often
+ * gets a short PATH that misses where package managers put programs, so a
+ * program installed with Homebrew, winget or `~/.local/bin` looks missing.
+ * `findProgram` looks on PATH first, then in those usual places.
+ */
+import { execFile } from 'node:child_process';
+import { accessSync, constants } from 'node:fs';
+import { homedir } from 'node:os';
+import { posix, win32 } from 'node:path';
+/** The usual install places of command-line programs, after PATH. */
+export function usualDirs({ platform = process.platform, env = process.env, home = homedir() } = {}) {
+    if (platform === 'win32') {
+        const join = win32.join;
+        const local = env.LOCALAPPDATA ?? join(home, 'AppData', 'Local');
+        return [
+            join(env.SystemRoot ?? 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0'),
+            join(env.ProgramFiles ?? 'C:\\Program Files', 'GitHub CLI'),
+            join(local, 'Programs', 'GitHub CLI'),
+            join(local, 'Microsoft', 'WinGet', 'Links'),
+            join(home, 'scoop', 'shims'),
+            join(env.ProgramData ?? 'C:\\ProgramData', 'chocolatey', 'bin'),
+        ];
+    }
+    const join = posix.join;
+    const common = ['/usr/local/bin', '/usr/bin', '/bin', '/usr/sbin', join(home, '.local', 'bin'), join(home, 'bin')];
+    return platform === 'darwin'
+        ? ['/opt/homebrew/bin', ...common, '/opt/local/bin']
+        : [...common, '/snap/bin', '/home/linuxbrew/.linuxbrew/bin', join(home, '.linuxbrew', 'bin')];
+}
+/** The full path of a program, or `undefined` when it is not installed anywhere we know of. */
+export function findProgram(name, where = {}) {
+    const platform = where.platform ?? process.platform;
+    const env = where.env ?? process.env;
+    const path = platform === 'win32' ? win32 : posix;
+    const pathDirs = (env.PATH ?? env.Path ?? '').split(path.delimiter).filter(Boolean);
+    const names = platform === 'win32' && !/\.\w+$/.test(name) ? [`${name}.exe`, `${name}.cmd`] : [name];
+    for (const dir of [...pathDirs, ...usualDirs(where)]) {
+        for (const file of names) {
+            const full = path.join(dir, file);
+            try {
+                accessSync(full, platform === 'win32' ? constants.F_OK : constants.X_OK);
+                return full;
+            }
+            catch {
+                // not here
+            }
+        }
+    }
+    return undefined;
+}
+/** Run a program; `input` goes to its stdin (secrets never go on the command line). Never rejects. */
+export function runProgram(file, args, input, timeout = 15_000) {
+    return new Promise((resolve) => {
+        const child = execFile(file, args, { timeout, windowsHide: true, maxBuffer: 1 << 20 }, (error, stdout, stderr) => {
+            const code = error === null ? 0 : typeof error.code === 'number' ? error.code : 1;
+            const result = { code, stdout: String(stdout), stderr: String(stderr) };
+            if (error !== null && typeof error.code !== 'number')
+                result.failure = error.message;
+            resolve(result);
+        });
+        child.stdin?.on('error', () => { });
+        child.stdin?.end(input ?? '');
+    });
+}

package/lib/core/github/client.js

@@ -89,6 +89,16 @@ export class GitHubClient {
     user() {
         return this.get('/user');
     }
+    /** Whether this token may read notifications (fine-grained tokens get 403). */
+    async canReadNotifications() {
+        const url = `${API}/notifications?per_page=1`;
+        const { status, body } = await this.raw('GET', url);
+        if (status >= 200 && status < 300)
+            return true;
+        if (status === 403 || status === 404)
+            return false;
+        throw new GitHubError(status, url, body?.message ?? 'request failed');
+    }
     repo(fullName) {
         return this.get(`/repos/${fullName}`);
     }

package/lib/core/github/token.js

@@ -0,0 +1,79 @@
+/**
+ * Where the GitHub token comes from, in this order:
+ *
+ *   1. the environment variable named in the config (GITHUB_TOKEN)
+ *   2. a token you pasted on the settings page, kept in the system keychain
+ *   3. the GitHub CLI (`gh auth token`), which keeps its own in the keychain
+ *
+ * A token is never written to the notebook or a file.
+ */
+import { findProgram, runProgram } from "../exec.js";
+import { bi, MishuError } from "../i18n.js";
+import { GitHubClient, GitHubError } from "./client.js";
+/** The keychain entry for a token pasted on the settings page. */
+export const GITHUB_SECRET = 'github';
+/** Opens GitHub's "new classic token" page with the two scopes ticked. */
+export const NEW_TOKEN_URL = 'https://github.com/settings/tokens/new?scopes=notifications,repo&description=DSH%20mishu';
+/** `ghPath` is for tests: a fixed path, or `null` for "not installed". */
+export async function resolveGithubToken(options) {
+    const { envName, useGhCli, secrets } = options;
+    const fromEnv = envName === '' ? undefined : process.env[envName]?.trim();
+    if (fromEnv)
+        return { token: fromEnv, from: 'env' };
+    const stored = await secrets?.get(GITHUB_SECRET).catch(() => undefined);
+    if (stored)
+        return { token: stored, from: 'keychain' };
+    const none = bi(envName === '' ? '没有 GitHub token' : `没有 GitHub token（环境变量 ${envName} 是空的，钥匙串里也没有存）`, envName === '' ? 'no GitHub token' : `no GitHub token (environment variable ${envName} is empty and none is saved in the keychain)`);
+    const paste = bi('在小秘书的设置页填一个 token', 'paste a token on the secretary\'s settings page');
+    if (!useGhCli)
+        return { error: bi(`${none.zh}。${paste.zh}。`, `${none.en}. ${cap(paste.en)}.`) };
+    const gh = options.ghPath === undefined ? findProgram('gh') : options.ghPath ?? undefined;
+    if (gh === undefined) {
+        return {
+            error: bi(`${none.zh}，这台电脑上也没找到 GitHub CLI（gh）。${paste.zh}，或者装上 gh 后运行 gh auth login。`, `${none.en}, and the GitHub CLI (gh) is not installed on this computer. ${cap(paste.en)}, or install gh and run gh auth login.`),
+        };
+    }
+    const r = await runProgram(gh, ['auth', 'token'], undefined, 5000);
+    const token = r.stdout.trim();
+    if (r.code === 0 && token !== '')
+        return { token, from: 'gh' };
+    const why = (r.stderr.trim() || r.failure || `exit ${r.code}`).split('\n')[0].slice(0, 200);
+    return {
+        error: bi(`${none.zh}，gh 也没给出 token（${why}）。运行 gh auth login 登录，或者${paste.zh}。`, `${none.en}, and gh gave no token (${why}). Run gh auth login, or ${paste.en}.`),
+    };
+}
+function cap(text) {
+    return text.charAt(0).toUpperCase() + text.slice(1);
+}
+/**
+ * Check a pasted token with GitHub, then keep it in the keychain. It must
+ * read notifications, which only classic tokens with the `notifications`
+ * scope can (fine-grained tokens cannot reach that API).
+ */
+export async function saveGithubToken(secrets, raw, fetch) {
+    const token = raw.trim();
+    if (!/^[\w-]{20,255}$/.test(token)) {
+        throw new MishuError(bi('这不像 GitHub token：应该是一串没有空格的字母数字，classic token 以 ghp_ 开头', 'That does not look like a GitHub token: it should be letters and digits without spaces; classic tokens start with ghp_'));
+    }
+    const status = await secrets.status();
+    if (!status.available)
+        throw new MishuError(bi(`没法保存：${status.why.zh}`, `Cannot save it: ${status.why.en}`));
+    const gh = new GitHubClient({ token, ...fetch === undefined ? {} : { fetch } });
+    let login;
+    try {
+        login = (await gh.user()).login;
+    }
+    catch (error) {
+        if (error instanceof GitHubError && error.status === 401)
+            throw new MishuError(bi('GitHub 不认这个 token（可能填错了、过期了或被撤销了）', 'GitHub does not accept this token (mistyped, expired or revoked)'));
+        throw error;
+    }
+    if (!await gh.canReadNotifications()) {
+        throw new MishuError(bi(`这个 token 属于 ${login}，但读不了通知。GitHub 的通知接口只认 classic token：生成时勾选 notifications（要看私有仓库再勾 repo）。`, `This token belongs to ${login} but cannot read notifications. GitHub's notifications API only takes classic tokens: tick notifications when you create it (and repo for private repositories).`));
+    }
+    await secrets.set(GITHUB_SECRET, token);
+    return { login };
+}
+export async function deleteGithubToken(secrets) {
+    await secrets.delete(GITHUB_SECRET);
+}

package/lib/core/index.js

@@ -2,10 +2,8 @@
  * mishu core — everything that does not depend on DSH.
  * Nothing under `src/core` may import DSH; `tests/boundary.test.ts` enforces it.
  */
-import { execFile } from 'node:child_process';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { bi } from "./i18n.js";
 export { buildAsk, detailText } from "./ask.js";
 export { buildBoard, buildDetail } from "./board.js";
 export { renderBrief, renderClosed, renderMatter, reasonLabel, sortOpen } from "./brief.js";
@@ -13,6 +11,7 @@ export { GitHubClient, GitHubError } from "./github/client.js";
 export { gatherFacts, Lookups, parseCheckSuiteTitle } from "./github/facts.js";
 export { CLOSING_REASONS, judge } from "./github/rules.js";
 export { syncGithub } from "./github/sync.js";
+export { deleteGithubToken, GITHUB_SECRET, NEW_TOKEN_URL, resolveGithubToken, saveGithubToken } from "./github/token.js";
 export { bi, decode, detectLang, errorText, LANGS, MishuError, pick } from "./i18n.js";
 export { addSeries, describeActiveSeries, describeSeries, resolveSeries, stopSeries, tickManual, upcoming, } from "./manual.js";
 export { DEFAULT_DEMOTION, isActive, isDemoted, setStatusByUser, snoozeByUser } from "./matters.js";
@@ -23,6 +22,8 @@ export { MAIL_PRESETS, presetById, secretAccount } from "./mail/account.js";
 export { ImapFetcher } from "./mail/imap.js";
 export { judgeMail } from "./mail/rules.js";
 export { describeMailError, MAIL_SOURCE, mailReportKey, syncMail } from "./mail/sync.js";
+export { findProgram } from "./exec.js";
+export { restartPlan, scheduleRestart } from "./restart.js";
 export { MemorySecrets, secretEnvName, secretFromEnv, systemSecrets } from "./secrets.js";
 export { deleteMailAccount, effectiveSettings, mailAccounts, saveMailAccount, saveSettings } from "./settings.js";
 export const DEFAULT_HOME = '~/.mishu';
@@ -38,28 +39,3 @@ export function mishuPaths(home) {
     const root = expandHome(home);
     return { root, db: join(root, 'mishu.db') };
 }
-/**
- * A GitHub token without storing one: the named environment variable, else
- * the GitHub CLI (`gh auth token`, which reads the system credential store).
- */
-export async function resolveGithubToken(envName, useGhCli) {
-    const fromEnv = envName === '' ? undefined : process.env[envName]?.trim();
-    if (fromEnv)
-        return { token: fromEnv, from: 'env' };
-    if (!useGhCli)
-        return { error: bi(`没有 GitHub token：环境变量 ${envName} 是空的`, `no GitHub token: environment variable ${envName} is empty`) };
-    return new Promise((resolve) => {
-        execFile('gh', ['auth', 'token'], { timeout: 5000, windowsHide: true }, (error, stdout) => {
-            const token = stdout?.trim();
-            if (error !== null || !token) {
-                const why = error?.message ?? 'empty output';
-                resolve({
-                    error: bi(`没有 GitHub token：环境变量 ${envName} 是空的，gh auth token 也没拿到（${why}）。先运行 gh auth login，或设置 ${envName}`, `no GitHub token: environment variable ${envName} is empty and gh auth token failed (${why}). Run gh auth login, or set ${envName}`),
-                });
-            }
-            else {
-                resolve({ token, from: 'gh' });
-            }
-        });
-    });
-}

package/lib/core/mail/account.js

@@ -9,7 +9,7 @@ import { bi, MishuError } from "../i18n.js";
 export const MAIL_PRESETS = [
     {
         id: 'qq', label: bi('QQ 邮箱', 'QQ Mail'), host: 'imap.qq.com', port: 993, secure: true, supported: true,
-        howTo: bi('在 QQ 邮箱网页版：设置 → 账号 → 开启「IMAP/SMTP 服务」，按提示生成授权码。这里填授权码，不是 QQ 密码。', 'In QQ Mail on the web: Settings → Account → turn on "IMAP/SMTP" and generate an authorization code. Enter that code here, not your QQ password.'),
+        howTo: bi('在 QQ 邮箱网页版：设置 → 账号与安全 → 安全设置（旧版界面是 设置 → 账户），开启「IMAP/SMTP 服务」，按提示验证后生成 16 位授权码。这里填授权码，不是 QQ 密码；改过 QQ 密码后，旧授权码会失效。', 'In QQ Mail on the web: Settings → Account and Security → Security (Settings → Account in the older layout), turn on "IMAP/SMTP", verify, and generate a 16-character authorization code. Enter that code here, not your QQ password; changing your QQ password expires old codes.'),
     },
     {
         id: '163', label: bi('网易 163 邮箱', 'NetEase 163'), host: 'imap.163.com', port: 993, secure: true, supported: true,
@@ -53,8 +53,10 @@ export function resolveAccount(input, id) {
     if (!preset.supported)
         throw new MishuError(bi(`${preset.label.zh}暂时不支持：${preset.howTo.zh}`, `${preset.label.en} is not supported yet: ${preset.howTo.en}`));
     const host = preset.id === 'custom' ? String(input.host ?? '').trim() : preset.host;
-    if (!/^[\w.-]+$/.test(host))
-        throw new MishuError(bi('IMAP 服务器地址不对', 'invalid IMAP server'));
+    // A name with a dot (imap.example.com), a full IPv4 address, or localhost; a bare number is a port typed in the wrong box.
+    if (!/^[\w-]+(\.[\w-]+)+$/.test(host) && host !== 'localhost' || /^\d+$/.test(host)) {
+        throw new MishuError(bi(`IMAP 服务器地址不对：${host || '（空）'}，应该像 imap.example.com`, `invalid IMAP server: ${host || '(empty)'}; it should look like imap.example.com`));
+    }
     const port = preset.id === 'custom' ? Number(input.port ?? 993) : preset.port;
     if (!Number.isInteger(port) || port < 1 || port > 65535)
         throw new MishuError(bi('端口要是 1 到 65535 的整数', 'the port must be a whole number from 1 to 65535'));