dsh-mishu 0.5.4 → 0.6.2

package/lib/core/github/device.js

@@ -0,0 +1,129 @@
+/**
+ * "Sign in with GitHub" without pasting a token: GitHub's device flow.
+ *
+ * The secretary asks GitHub for a short code, you enter it at
+ * github.com/login/device (on any computer) and approve, and the secretary
+ * receives a token, checks it like a pasted one and keeps it in the
+ * keychain (or the secrets file). It needs the client id of a GitHub OAuth
+ * App with device flow enabled; the id is public, there is no secret.
+ *
+ * https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#device-flow
+ */
+import { bi, MishuError } from "../i18n.js";
+import { saveGithubToken } from "./token.js";
+/** Notifications, and repo so CI runs, pull requests and issues of private repositories can be looked up. */
+export const DEVICE_SCOPES = 'notifications repo';
+export class GithubDeviceLogin {
+    options;
+    current = { state: 'idle' };
+    /** Bumped by every start and cancel, so an older poll loop stops quietly. */
+    generation = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    status() {
+        if (this.current.state === 'waiting' && this.now() > this.current.expiresAt) {
+            this.current = { state: 'failed', message: EXPIRED };
+        }
+        return this.current;
+    }
+    cancel() {
+        this.generation++;
+        this.current = { state: 'idle' };
+    }
+    /** Ask GitHub for a code; polling for your approval runs in the background. */
+    async start() {
+        if (this.options.clientId === '') {
+            throw new MishuError(bi('还没有配置 GitHub 应用，没法用 GitHub 登录。可以改用下面的"粘贴 token"。', 'No GitHub app is configured, so signing in with GitHub is not available. Paste a token below instead.'));
+        }
+        const generation = ++this.generation;
+        const answer = await this.form('https://github.com/login/device/code', { client_id: this.options.clientId, scope: DEVICE_SCOPES });
+        const deviceCode = String(answer.device_code ?? '');
+        const userCode = String(answer.user_code ?? '');
+        if (deviceCode === '' || userCode === '')
+            throw new MishuError(failure(answer));
+        const expiresAt = this.now() + Number(answer.expires_in ?? 900) * 1000;
+        this.current = { state: 'waiting', userCode, verificationUri: String(answer.verification_uri ?? 'https://github.com/login/device'), expiresAt };
+        void this.poll(generation, deviceCode, Number(answer.interval ?? 5), expiresAt);
+        return this.current;
+    }
+    async poll(generation, deviceCode, interval, expiresAt) {
+        const stale = () => generation !== this.generation;
+        try {
+            while (!stale()) {
+                await this.sleep(interval * 1000);
+                if (stale())
+                    return;
+                if (this.now() > expiresAt) {
+                    this.current = { state: 'failed', message: EXPIRED };
+                    return;
+                }
+                const answer = await this.form('https://github.com/login/oauth/access_token', {
+                    client_id: this.options.clientId,
+                    device_code: deviceCode,
+                    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                });
+                if (stale())
+                    return;
+                if (typeof answer.access_token === 'string' && answer.access_token !== '') {
+                    const { login } = await saveGithubToken(this.options.secrets, answer.access_token, this.options.fetch);
+                    if (!stale())
+                        this.current = { state: 'done', login };
+                    return;
+                }
+                switch (answer.error) {
+                    case 'authorization_pending':
+                        break;
+                    case 'slow_down':
+                        interval = Number(answer.interval ?? interval + 5);
+                        break;
+                    case 'expired_token':
+                        this.current = { state: 'failed', message: EXPIRED };
+                        return;
+                    case 'access_denied':
+                        this.current = { state: 'failed', message: bi('你在 GitHub 上取消了授权。', 'You cancelled the authorization on GitHub.') };
+                        return;
+                    default:
+                        this.current = { state: 'failed', message: failure(answer) };
+                        return;
+                }
+            }
+        }
+        catch (error) {
+            if (!stale())
+                this.current = { state: 'failed', message: error instanceof MishuError ? error.text : bi(`连不上 GitHub：${error.message}`, `Could not reach GitHub: ${error.message}`) };
+        }
+    }
+    async form(url, fields) {
+        const post = this.options.post ?? globalThis.fetch;
+        const response = await post(url, {
+            method: 'POST',
+            headers: { accept: 'application/json', 'content-type': 'application/x-www-form-urlencoded', 'user-agent': 'dsh-mishu' },
+            body: new URLSearchParams(fields).toString(),
+        });
+        const text = await response.text();
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return { error: `http_${response.status}`, error_description: text.slice(0, 200) };
+        }
+    }
+    now() {
+        return (this.options.now ?? Date.now)();
+    }
+    sleep(ms) {
+        return (this.options.sleep ?? (wait => new Promise(resolve => setTimeout(resolve, wait))))(ms);
+    }
+}
+const EXPIRED = bi('登录码过期了，再点一次"用 GitHub 登录"。', 'The sign-in code expired; click "Sign in with GitHub" again.');
+function failure(answer) {
+    const what = String(answer.error_description ?? answer.error ?? 'unknown error');
+    if (answer.error === 'http_404' || /^not found$/i.test(String(answer.error ?? answer.message ?? ''))) {
+        return bi('GitHub 找不到这个应用：Client ID 不对。', 'GitHub does not know this app: the client id is wrong.');
+    }
+    if (answer.error === 'device_flow_disabled') {
+        return bi('这个 GitHub 应用没有打开"设备登录"（Enable Device Flow）。', 'This GitHub app does not have device flow enabled.');
+    }
+    return bi(`GitHub 登录没成功：${what}`, `Signing in with GitHub failed: ${what}`);
+}

package/lib/core/github/token.js

@@ -12,6 +12,8 @@ import { bi, MishuError } from "../i18n.js";
 import { GitHubClient, GitHubError } from "./client.js";
 /** The keychain entry for a token pasted on the settings page. */
 export const GITHUB_SECRET = 'github';
+/** The OAuth App behind "Sign in with GitHub" (device flow, "DSH 小秘书"); public, not a secret. */
+export const GITHUB_CLIENT_ID = 'Ov23liejlNOyARQKgy5x';
 /** Opens GitHub's "new classic token" page with the two scopes ticked. */
 export const NEW_TOKEN_URL = 'https://github.com/settings/tokens/new?scopes=notifications,repo&description=DSH%20mishu';
 /** `ghPath` is for tests: a fixed path, or `null` for "not installed". */

package/lib/core/index.js

@@ -11,20 +11,21 @@ export { GitHubClient, GitHubError } from "./github/client.js";
 export { gatherFacts, Lookups, parseCheckSuiteTitle } from "./github/facts.js";
 export { CLOSING_REASONS, judge } from "./github/rules.js";
 export { syncGithub } from "./github/sync.js";
-export { deleteGithubToken, GITHUB_SECRET, NEW_TOKEN_URL, resolveGithubToken, saveGithubToken } from "./github/token.js";
+export { DEVICE_SCOPES, GithubDeviceLogin } from "./github/device.js";
+export { deleteGithubToken, GITHUB_CLIENT_ID, GITHUB_SECRET, NEW_TOKEN_URL, resolveGithubToken, saveGithubToken } from "./github/token.js";
 export { bi, decode, detectLang, errorText, LANGS, MishuError, pick } from "./i18n.js";
 export { addSeries, describeActiveSeries, describeSeries, resolveSeries, stopSeries, tickManual, upcoming, } from "./manual.js";
 export { DEFAULT_DEMOTION, isActive, isDemoted, setStatusByUser, snoozeByUser } from "./matters.js";
 export { CATEGORIES, CATEGORY_LABELS, DEFAULT_LEAD_DAYS, REPEATS } from "./recur.js";
 export { MishuStore } from "./store.js";
 export { addDays, dayOf, formatMoment } from "./time.js";
-export { MAIL_PRESETS, presetById, secretAccount } from "./mail/account.js";
+export { MAIL_PRESETS, normalizePassword, presetById, presetForAddress, providerMismatch, secretAccount } from "./mail/account.js";
 export { ImapFetcher } from "./mail/imap.js";
 export { judgeMail } from "./mail/rules.js";
 export { describeMailError, MAIL_SOURCE, mailReportKey, syncMail } from "./mail/sync.js";
 export { findProgram } from "./exec.js";
 export { restartPlan, scheduleRestart } from "./restart.js";
-export { MemorySecrets, secretEnvName, secretFromEnv, systemSecrets } from "./secrets.js";
+export { FileSecrets, KeychainOrFile, MemorySecrets, secretEnvName, secretFromEnv, systemSecrets } from "./secrets.js";
 export { deleteMailAccount, effectiveSettings, mailAccounts, saveMailAccount, saveSettings } from "./settings.js";
 export const DEFAULT_HOME = '~/.mishu';
 /** `~` and `~/…` expand to the home directory on every platform. */
@@ -37,5 +38,5 @@ export function expandHome(path) {
 }
 export function mishuPaths(home) {
     const root = expandHome(home);
-    return { root, db: join(root, 'mishu.db') };
+    return { root, db: join(root, 'mishu.db'), secrets: join(root, 'secrets.json') };
 }

package/lib/core/mail/account.js

@@ -6,37 +6,93 @@
  * system keychain under `mail:<id>`, never in the notebook.
  */
 import { bi, MishuError } from "../i18n.js";
+/** Steps, and the same steps as one numbered paragraph. */
+function guide(steps) {
+    return {
+        steps,
+        howTo: bi(steps.map((step, i) => `${i + 1}. ${step.text.zh}`).join(' '), steps.map((step, i) => `${i + 1}. ${step.text.en}`).join(' ')),
+    };
+}
+const NETEASE = (name, url) => guide([
+    { text: bi(`打开 ${name} 邮箱网页版并登录。`, `Open ${name} Mail on the web and sign in.`), link: { url, label: bi(`打开 ${name} 邮箱`, `Open ${name} Mail`) } },
+    { text: bi('点上方的「设置」→「POP3/SMTP/IMAP」，开启「IMAP/SMTP 服务」。', 'Click Settings → POP3/SMTP/IMAP at the top and turn on "IMAP/SMTP".') },
+    { text: bi('按提示用手机验证，页面会给你一个「客户端授权码」，复制后粘贴到下面的密码框（不是邮箱登录密码）。', 'Verify with your phone as asked; the page shows a client authorization code. Copy it into the password box below (not your mail password).') },
+]);
 export const MAIL_PRESETS = [
     {
         id: 'qq', label: bi('QQ 邮箱', 'QQ Mail'), host: 'imap.qq.com', port: 993, secure: true, supported: true,
-        howTo: bi('在 QQ 邮箱网页版：设置 → 账号与安全 → 安全设置（旧版界面是 设置 → 账户），开启「IMAP/SMTP 服务」，按提示验证后生成 16 位授权码。这里填授权码，不是 QQ 密码；改过 QQ 密码后，旧授权码会失效。', 'In QQ Mail on the web: Settings → Account and Security → Security (Settings → Account in the older layout), turn on "IMAP/SMTP", verify, and generate a 16-character authorization code. Enter that code here, not your QQ password; changing your QQ password expires old codes.'),
+        domains: ['qq.com', 'vip.qq.com', 'foxmail.com'], passwordLength: 16,
+        ...guide([
+            { text: bi('打开 QQ 邮箱网页版并登录。', 'Open QQ Mail on the web and sign in.'), link: { url: 'https://mail.qq.com/', label: bi('打开 QQ 邮箱', 'Open QQ Mail') } },
+            { text: bi('点「设置」→「账号与安全」→「安全设置」（旧版界面是「设置」→「账户」），找到「IMAP/SMTP 服务」，点「开启」。', 'Click Settings → Account and Security → Security (Settings → Account in the older layout), find "IMAP/SMTP" and turn it on.') },
+            { text: bi('按提示用手机验证，页面会显示一个 16 位授权码，复制后粘贴到下面的密码框（不是 QQ 密码）。改过 QQ 密码后，旧授权码会失效。', 'Verify with your phone as asked; the page shows a 16-character authorization code. Copy it into the password box below (not your QQ password). Changing your QQ password expires old codes.') },
+        ]),
     },
     {
         id: '163', label: bi('网易 163 邮箱', 'NetEase 163'), host: 'imap.163.com', port: 993, secure: true, supported: true,
-        howTo: bi('在 163 邮箱网页版：设置 → POP3/SMTP/IMAP → 开启 IMAP 服务，设置客户端授权码。这里填授权码。', 'In 163 Mail on the web: Settings → POP3/SMTP/IMAP → turn on IMAP and set a client authorization code. Enter that code here.'),
+        domains: ['163.com'], ...NETEASE('163', 'https://mail.163.com/'),
     },
     {
         id: '126', label: bi('网易 126 邮箱', 'NetEase 126'), host: 'imap.126.com', port: 993, secure: true, supported: true,
-        howTo: bi('在 126 邮箱网页版：设置 → POP3/SMTP/IMAP → 开启 IMAP 服务，设置客户端授权码。这里填授权码。', 'In 126 Mail on the web: Settings → POP3/SMTP/IMAP → turn on IMAP and set a client authorization code. Enter that code here.'),
+        domains: ['126.com'], ...NETEASE('126', 'https://mail.126.com/'),
     },
     {
         id: 'gmail', label: bi('Gmail', 'Gmail'), host: 'imap.gmail.com', port: 993, secure: true, supported: true,
-        howTo: bi('Google 账号先开启两步验证，再到「安全性 → 应用专用密码」生成一个 16 位密码，填在这里。', 'Turn on 2-Step Verification for your Google account, then create an app password under Security → App passwords and enter it here.'),
+        domains: ['gmail.com', 'googlemail.com'], passwordLength: 16,
+        ...guide([
+            {
+                text: bi('开启 Google 账号的两步验证（已经开了就跳过这步）。', 'Turn on 2-Step Verification for your Google account (skip this if it is on).'),
+                link: { url: 'https://myaccount.google.com/signinoptions/twosv', label: bi('打开两步验证', 'Open 2-Step Verification') },
+            },
+            {
+                text: bi('打开「应用专用密码」页面，名字随便填（比如"小秘书"），点「创建」。如果页面说"设置不可用"，说明第 1 步还没做。', 'Open the App passwords page, type any name ("secretary") and click Create. If the page says the setting is not available, step 1 is not done yet.'),
+                link: { url: 'https://myaccount.google.com/apppasswords', label: bi('打开应用专用密码', 'Open App passwords') },
+            },
+            { text: bi('把弹出来的 16 位密码复制，粘贴到下面的密码框（带不带空格都行）。它只显示这一次。', 'Copy the 16-character password it shows into the password box below (spaces or not). It is shown only once.') },
+        ]),
         findMessage: id => `https://mail.google.com/mail/u/0/#search/rfc822msgid:${encodeURIComponent(id)}`,
     },
     {
         id: 'icloud', label: bi('iCloud 邮件', 'iCloud Mail'), host: 'imap.mail.me.com', port: 993, secure: true, supported: true,
-        howTo: bi('在 appleid.apple.com：登录与安全 → App 专用密码，生成一个填在这里。用户名一般是 @icloud.com 前面的部分。', 'At appleid.apple.com: Sign-In and Security → App-Specific Passwords; create one and enter it here. The user name is usually the part before @icloud.com.'),
+        domains: ['icloud.com', 'me.com', 'mac.com'],
+        ...guide([
+            { text: bi('打开 Apple 账户页面并登录。', 'Open your Apple Account page and sign in.'), link: { url: 'https://account.apple.com/account/manage', label: bi('打开 Apple 账户', 'Open Apple Account') } },
+            { text: bi('点「登录与安全」→「App 专用密码」，点「+」，名字随便填。', 'Click Sign-In and Security → App-Specific Passwords, click +, and type any name.') },
+            { text: bi('把显示的密码（xxxx-xxxx-xxxx-xxxx）复制，粘贴到下面的密码框。', 'Copy the password it shows (xxxx-xxxx-xxxx-xxxx) into the password box below.') },
+        ]),
     },
     {
         id: 'outlook', label: bi('Outlook / Hotmail', 'Outlook / Hotmail'), host: 'outlook.office365.com', port: 993, secure: true, supported: false,
+        domains: ['outlook.com', 'hotmail.com', 'live.com', 'msn.com'], steps: [],
         howTo: bi('微软已经不允许用密码登录 IMAP，需要 OAuth 授权，小秘书暂时还不支持。', 'Microsoft no longer allows password logins over IMAP; it needs OAuth, which the secretary does not support yet.'),
     },
     {
         id: 'custom', label: bi('其他（自己填服务器）', 'Other (enter the server)'), host: '', port: 993, secure: true, supported: true,
+        domains: [], steps: [],
         howTo: bi('填你的邮件服务商给的 IMAP 服务器、端口和密码（很多服务商要求用专门的客户端授权码）。', 'Enter the IMAP server, port and password your provider gives you (many require a separate app password).'),
     },
 ];
+/** The provider an address belongs to, from its domain; `undefined` when we do not know it. */
+export function presetForAddress(address) {
+    const domain = address.trim().toLowerCase().split('@')[1] ?? '';
+    return MAIL_PRESETS.find(p => p.domains.includes(domain));
+}
+/**
+ * The password as the server wants it. App passwords and codes are shown in
+ * groups ("abcd efgh ijkl mnop") and copied with the spaces; they never
+ * contain one, so spaces go when the provider fixes the length.
+ */
+export function normalizePassword(presetId, password) {
+    return presetById(presetId).passwordLength === undefined ? password : password.replace(/\s+/g, '');
+}
+/** An account whose address belongs to another provider than its server ("…@gmail.com" on imap.qq.com). */
+export function providerMismatch(account) {
+    const expected = presetForAddress(account.address);
+    if (expected === undefined || expected.id === account.preset || account.preset === 'custom')
+        return undefined;
+    const domain = account.address.split('@')[1];
+    return bi(`地址是 ${domain}，服务器却是 ${presetById(account.preset).label.zh}的 ${account.host}。点「编辑」把服务商改成「${expected.label.zh}」。`, `The address is ${domain} but the server is ${account.host} (${presetById(account.preset).label.en}). Click Edit and choose "${expected.label.en}".`);
+}
 export function presetById(id) {
     return MAIL_PRESETS.find(p => p.id === id) ?? MAIL_PRESETS[MAIL_PRESETS.length - 1];
 }

package/lib/core/mail/sync.js

@@ -11,15 +11,44 @@ import { bi } from "../i18n.js";
 import { presetById } from "./account.js";
 import { judgeMail } from "./rules.js";
 export const MAIL_SOURCE = 'mail';
-/** A connection or login failure, said so a person knows what to fix. */
-export function describeMailError(error, account) {
+/** What some providers' refusals mean, in words you can act on. */
+const KNOWN_REFUSALS = [
+    {
+        presets: ['gmail'], match: /application-specific password required/i,
+        text: bi('Google 不接受账号的登录密码：这里要填「应用专用密码」（16 位）。按步骤第 1、2 步生成一个，大约一分钟。', 'Google does not take your account password here: it needs an app password (16 characters). Steps 1 and 2 make one in about a minute.'),
+    },
+    {
+        presets: ['gmail'], match: /invalid credentials/i,
+        text: bi('Google 不认这个应用专用密码：可能抄错了，或者已经在 Google 账号里删掉了。按步骤第 2 步重新生成一个再试。', 'Google does not accept this app password: it may be mistyped or deleted from your Google account. Make a new one with step 2 and try again.'),
+    },
+    {
+        presets: ['gmail'], match: /web login required|log in via your web browser/i,
+        text: bi('Google 拦下了这次登录：先在浏览器里登录一次 Gmail，再回来试。', 'Google blocked this sign-in: sign in to Gmail in a browser once, then try again.'),
+    },
+    {
+        presets: ['qq'], match: /login fail/i,
+        text: bi('QQ 邮箱不让登录：最常见是还没开启 IMAP 服务，或者填的是 QQ 密码而不是授权码；改过 QQ 密码后，旧授权码也会失效。', 'QQ Mail refused the sign-in: usually IMAP is not turned on, or this is your QQ password instead of the authorization code; changing your QQ password also expires old codes.'),
+    },
+    {
+        presets: ['163', '126'], match: /unsafe login/i,
+        text: bi('网易邮箱拦下了这次登录：确认设置里已开启 IMAP 服务，并且填的是客户端授权码。', 'NetEase Mail blocked this sign-in: check that IMAP is turned on in its settings and that this is the client authorization code.'),
+    },
+];
+/**
+ * A connection or login failure, said so a person knows what to fix. With
+ * `steps` (the default) a login failure also repeats where the provider's
+ * app password comes from; the add-account dialog shows those steps already.
+ */
+export function describeMailError(error, account, options = {}) {
     const raw = error.responseText ?? error.message ?? String(error);
-    const auth = /auth|login|password|credential|AUTHENTICATIONFAILED|LOGIN failed/i.test(raw);
+    const known = KNOWN_REFUSALS.find(k => k.presets.includes(account.preset) && k.match.test(raw));
+    const auth = known !== undefined || /auth|login|password|credential|AUTHENTICATIONFAILED|LOGIN failed/i.test(raw);
     if (!auth)
         return bi(`连接 ${account.host}:${account.port} 失败：${raw}`, `Could not reach ${account.host}:${account.port}: ${raw}`);
     const preset = presetById(account.preset);
-    const howTo = preset.id === 'custom' ? undefined : preset.howTo;
-    return bi(`登录失败：服务器不接受这个用户名或密码（${raw}）。多数邮箱要先开启 IMAP，再填客户端授权码或应用专用密码，不是网页登录密码。${howTo === undefined ? '' : `\n${preset.label.zh}：${howTo.zh}`}`, `Login failed: the server rejected the user name or password (${raw}). Most providers need IMAP turned on and an app password, not your web password.${howTo === undefined ? '' : `\n${preset.label.en}: ${howTo.en}`}`);
+    const steps = options.steps !== false && preset.id !== 'custom' ? preset.howTo : undefined;
+    const what = known?.text ?? bi('登录失败：服务器不接受这个用户名或密码。多数邮箱要先开启 IMAP，再填客户端授权码或应用专用密码，不是网页登录密码。', 'Login failed: the server rejected the user name or password. Most providers need IMAP turned on and an app password, not your web password.');
+    return bi(`${what.zh}（服务器原话：${raw}）${steps === undefined ? '' : `\n${preset.label.zh}：${steps.zh}`}`, `${what.en} (The server said: ${raw})${steps === undefined ? '' : `\n${preset.label.en}: ${steps.en}`}`);
 }
 export function mailReportKey(accountId) {
     return `mail.lastSync.${accountId}`;

package/lib/core/restart.js

@@ -15,14 +15,19 @@
  *   Windows  `taskkill /PID` without /F (a close request), then the app again
  *   Linux    SIGTERM to the app, then the app again
  *
+ * On a server set up with dsh-vps, DSH is a child of the dsh-gate login
+ * gateway (`$GATE_HOME/gate/server.js`, run by systemd), which starts DSH
+ * again whenever it exits and picks up the new sign-in token itself. There
+ * a restart is simply DSH exiting cleanly; the page reconnects.
+ *
  * DSH started with the `dsh` command is not restarted from here: its web
  * address (with a new sign-in token) is printed in that terminal, which a
  * detached replacement could not reach. The page says what to do instead.
  */
 import { execFileSync, spawn } from 'node:child_process';
-import { readlinkSync } from 'node:fs';
+import { readFileSync, readlinkSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { join, posix } from 'node:path';
 import { findProgram } from "./exec.js";
 import { bi } from "./i18n.js";
 /** `<x>.app` holding a macOS executable, if any. */
@@ -52,8 +57,21 @@ function bundleIdOf(app) {
         return undefined;
     }
 }
+function parentArguments(ppid) {
+    try {
+        return readFileSync(`/proc/${ppid}/cmdline`, 'utf8').split('\0').filter(Boolean);
+    }
+    catch {
+        return undefined;
+    }
+}
 function here() {
-    const facts = { env: process.env, platform: process.platform, execPath: process.execPath, ppid: process.ppid, electron: process.versions.electron, parentExe: undefined, bundleId: undefined };
+    const facts = {
+        env: process.env, platform: process.platform, execPath: process.execPath, ppid: process.ppid, electron: process.versions.electron,
+        parentExe: undefined, bundleId: undefined, parentArgs: undefined,
+    };
+    if (facts.platform === 'linux' && facts.env.GATE_HOME !== undefined)
+        facts.parentArgs = parentArguments(facts.ppid);
     if (facts.electron === undefined || facts.env.ELECTRON_RUN_AS_NODE !== '1' || facts.ppid <= 1)
         return facts;
     facts.parentExe = parentExecutable(facts.ppid, facts.platform);
@@ -68,6 +86,13 @@ function samePath(a, b, platform) {
 const FROM_TERMINAL = bi('这个 DSH 是用 dsh 命令启动的，小秘书没法替它重启：回到运行 dsh 的那个终端按 Ctrl+C，再运行同一条命令。', 'This DSH was started with the dsh command, so the secretary cannot restart it: press Ctrl+C in the terminal running dsh, then run the same command again.');
 /** How DSH can be restarted from here, or why it cannot. */
 export function restartPlan(facts = here()) {
+    // dsh-vps: the parent must be that very gateway, not just a shell that has GATE_HOME set.
+    const gateHome = facts.env.GATE_HOME;
+    if (gateHome !== undefined && gateHome !== '') {
+        const gate = posix.join(gateHome, 'gate', 'server.js');
+        if (facts.parentArgs?.includes(gate) === true)
+            return { kind: 'gate', gate };
+    }
     const desktop = facts.electron !== undefined && facts.env.ELECTRON_RUN_AS_NODE === '1' && facts.ppid > 1 && samePath(facts.parentExe, facts.execPath, facts.platform);
     if (!desktop)
         return { kind: 'none', why: FROM_TERMINAL };
@@ -140,8 +165,13 @@ export function restartHelperSource(plan, log, tools = MAC_TOOLS) {
         "main().catch(e => note('helper failed: ' + (e && e.stack || e)))",
     ].join('\n');
 }
-/** Start the helper and return where it logs. Runs with this process's Node (Electron as Node in the app). */
-export function scheduleRestart(plan) {
+/** Start the restart: under dsh-gate, exit; in the desktop app, start the helper and say where it logs. Runs with this process's Node (Electron as Node in the app). */
+export function scheduleRestart(plan, exit = () => process.kill(process.pid, 'SIGTERM')) {
+    if (plan.kind === 'gate') {
+        // Let the page receive its answer, then leave the normal way; the gateway starts DSH again.
+        setTimeout(exit, 400);
+        return { reconnect: true };
+    }
     const log = join(tmpdir(), `dsh-mishu-restart-${new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19)}.log`);
     const helper = spawn(process.execPath, ['-e', restartHelperSource(plan, log)], { detached: true, stdio: 'ignore', env: process.env, windowsHide: true });
     helper.unref();

package/lib/core/secrets.js

@@ -7,9 +7,17 @@
  *
  * Secrets travel to the helper on stdin only, never as command-line
  * arguments, which other processes on the machine could read. Everything is
- * stored under the service name "dsh-mishu". When no keychain is available,
- * `secretFromEnv` is the documented fallback.
+ * stored under the service name "dsh-mishu".
+ *
+ * A computer without a usable keychain (a Linux server with no desktop,
+ * say) keeps them in `secrets.json` in the notebook directory instead:
+ * mode 600, so only your own system account can read it. That is how gh,
+ * git and Thunderbird manage on such machines, and it is said plainly on
+ * the settings page: protected by file permissions, not encrypted.
+ * `secretFromEnv` remains a last resort.
  */
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
 import { findProgram, runProgram } from "./exec.js";
 import { bi } from "./i18n.js";
 export const SERVICE = 'dsh-mishu';
@@ -168,3 +176,95 @@ export function secretFromEnv(account) {
     const value = process.env[secretEnvName(account)];
     return value === undefined || value === '' ? undefined : value;
 }
+/**
+ * Secrets in one JSON file, readable by your system account only (600).
+ * Written to a temporary file first and renamed, so a crash never leaves
+ * half a file; a file that cannot be read is never overwritten.
+ */
+export class FileSecrets {
+    kind = 'file';
+    path;
+    constructor(path) { this.path = path; }
+    async status() { return { available: true }; }
+    read() {
+        if (!existsSync(this.path))
+            return {};
+        // Put the permissions back if something loosened them.
+        if (process.platform !== 'win32' && (statSync(this.path).mode & 0o077) !== 0)
+            chmodSync(this.path, 0o600);
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(this.path, 'utf8'));
+        }
+        catch (error) {
+            throw new Error(`${this.path} cannot be read (${error.message}); fix or remove it`);
+        }
+        const secrets = parsed.secrets;
+        return typeof secrets === 'object' && secrets !== null ? { ...secrets } : {};
+    }
+    write(secrets) {
+        mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+        const temp = `${this.path}.${process.pid}.tmp`;
+        writeFileSync(temp, `${JSON.stringify({ version: 1, secrets }, null, 2)}\n`, { mode: 0o600 });
+        renameSync(temp, this.path);
+    }
+    async get(account) { return this.read()[account]; }
+    async set(account, secret) {
+        checkAccount(account);
+        checkSecret(secret);
+        this.write({ ...this.read(), [account]: secret });
+    }
+    async delete(account) {
+        const secrets = this.read();
+        if (!(account in secrets))
+            return;
+        delete secrets[account];
+        this.write(secrets);
+    }
+}
+/**
+ * The keychain when it works, else the file. Reads look in both, so a
+ * secret saved to the file before a keychain was set up is still found;
+ * saving to the keychain removes the file's copy.
+ */
+export class KeychainOrFile {
+    keychain;
+    file;
+    usable;
+    constructor(keychain, file) {
+        this.keychain = keychain;
+        this.file = file;
+    }
+    get kind() { return this.keychain.kind; }
+    keychainStatus() {
+        // Asked once per run: a missing helper does not appear while DSH runs.
+        this.usable ??= this.keychain.status().catch((error) => ({ available: false, why: bi(error.message, error.message) }));
+        return this.usable;
+    }
+    async status() {
+        const keychain = await this.keychainStatus();
+        return keychain.available ? keychain : { available: true, file: { path: this.file.path, why: keychain.why } };
+    }
+    async get(account) {
+        if ((await this.keychainStatus()).available) {
+            const stored = await this.keychain.get(account);
+            if (stored !== undefined)
+                return stored;
+        }
+        return this.file.get(account);
+    }
+    async set(account, secret) {
+        if ((await this.keychainStatus()).available) {
+            await this.keychain.set(account, secret);
+            await this.file.delete(account);
+        }
+        else {
+            await this.file.set(account, secret);
+        }
+    }
+    async delete(account) {
+        if ((await this.keychainStatus()).available)
+            await this.keychain.delete(account);
+        await this.file.delete(account);
+    }
+}

package/lib/core/settings.js

@@ -6,7 +6,7 @@
  * password goes to the system keychain (see secrets.ts), never here.
  */
 import { MishuError, bi } from "./i18n.js";
-import { resolveAccount, secretAccount } from "./mail/account.js";
+import { normalizePassword, resolveAccount, secretAccount } from "./mail/account.js";
 import { MAIL_SOURCE } from "./mail/sync.js";
 import { CATEGORIES } from "./recur.js";
 import { secretFromEnv } from "./secrets.js";
@@ -70,7 +70,7 @@ export async function saveMailAccount(store, secrets, input, password, now) {
     const account = resolveAccount({ ...existing, ...input }, id);
     const keychain = (await secrets.status()).available;
     if (keychain && password !== undefined && password !== '')
-        await secrets.set(secretAccount(id), password);
+        await secrets.set(secretAccount(id), normalizePassword(account.preset, password));
     else if (keychain && existing === undefined && await secrets.get(secretAccount(id)) === undefined && secretFromEnv(secretAccount(id)) === undefined) {
         throw new MishuError(bi('新邮箱要填密码（授权码）', 'a new account needs its password (app password)'));
     }

package/lib/dsh/api.js

@@ -9,7 +9,7 @@
  * travel inward: they go straight to the keychain, and no endpoint ever
  * returns one.
  */
-import { addDays, addSeries, bi, buildAsk, buildBoard, buildDetail, dayOf, deleteGithubToken, deleteMailAccount, describeMailError, MishuError, describeSeries, detectLang, errorText, GitHubClient, MAIL_PRESETS, mailReportKey, NEW_TOKEN_URL, resolveSeries, saveGithubToken, saveMailAccount, saveSettings, secretAccount, secretEnvName, setStatusByUser, snoozeByUser, stopSeries, tickManual, } from "../core/index.js";
+import { addDays, addSeries, bi, buildAsk, buildBoard, buildDetail, dayOf, deleteGithubToken, deleteMailAccount, describeMailError, MishuError, describeSeries, detectLang, errorText, GitHubClient, MAIL_PRESETS, mailReportKey, NEW_TOKEN_URL, normalizePassword, providerMismatch, resolveSeries, saveGithubToken, saveMailAccount, saveSettings, secretAccount, secretEnvName, setStatusByUser, snoozeByUser, stopSeries, tickManual, } from "../core/index.js";
 import { resolveAccount } from "../core/mail/account.js";
 export const API_BASE = '/api/dsh-mishu';
 class ApiError extends Error {
@@ -88,6 +88,7 @@ export function apiHandlers(runtime, clock = Date.now) {
             ...a,
             hasPassword: (await runtime.mailPassword(a.id)) !== undefined,
             envName: secretEnvName(secretAccount(a.id)),
+            mismatch: providerMismatch(a)?.[lang] ?? null,
             report: store.get(mailReportKey(a.id)) ?? null,
         })));
         return {
@@ -97,11 +98,21 @@ export function apiHandlers(runtime, clock = Date.now) {
                 tokenEnv: runtime.config.github.tokenEnv,
                 token: 'error' in token ? { found: false, text: token.error[lang] } : { found: true, from: token.from },
                 newTokenUrl: NEW_TOKEN_URL,
+                deviceLogin: runtime.config.github.clientId !== '',
                 lastSync: store.get('github.lastSync') ?? null,
             },
-            secrets: { kind: runtime.secrets.kind, available: secrets.available, ...secrets.available ? {} : { why: secrets.why[lang] } },
+            secrets: {
+                kind: runtime.secrets.kind,
+                available: secrets.available,
+                ...secrets.available ? {} : { why: secrets.why[lang] },
+                ...secrets.available && secrets.file !== undefined ? { file: { path: secrets.file.path, why: secrets.file.why[lang] } } : {},
+            },
             accounts,
-            presets: MAIL_PRESETS.map(p => ({ id: p.id, label: p.label[lang], host: p.host, port: p.port, secure: p.secure, supported: p.supported, howTo: p.howTo[lang] })),
+            presets: MAIL_PRESETS.map(p => ({
+                id: p.id, label: p.label[lang], host: p.host, port: p.port, secure: p.secure, supported: p.supported, howTo: p.howTo[lang],
+                domains: p.domains, passwordLength: p.passwordLength ?? null,
+                steps: p.steps.map(step => ({ text: step.text[lang], ...step.link === undefined ? {} : { link: { url: step.link.url, label: step.link.label[lang] } } })),
+            })),
         };
     };
     return {
@@ -208,6 +219,17 @@ export function apiHandlers(runtime, clock = Date.now) {
             const { login } = await saveGithubToken(runtime.secrets, typeof body.token === 'string' ? body.token : '');
             return { login, view: await settingsView(lang) };
         },
+        /** "Sign in with GitHub": a code to enter on github.com; the host waits for your approval. */
+        '/github/device/start': async (body) => ({ login: deviceView(await runtime.githubLogin.start(), langOf(body)) }),
+        '/github/device/status': async (body) => {
+            const lang = langOf(body);
+            const state = runtime.githubLogin.status();
+            return { login: deviceView(state, lang), ...state.state === 'done' ? { view: await settingsView(lang) } : {} };
+        },
+        '/github/device/cancel': async (body) => {
+            runtime.githubLogin.cancel();
+            return { login: deviceView(runtime.githubLogin.status(), langOf(body)) };
+        },
         '/github/token/delete': async (body) => {
             await deleteGithubToken(runtime.secrets);
             return { view: await settingsView(langOf(body)) };
@@ -222,7 +244,8 @@ export function apiHandlers(runtime, clock = Date.now) {
             const lang = langOf(body);
             const input = accountInput(body.account);
             const draft = resolveAccount(input, input.id ?? 0);
-            const secret = password(body) ?? (input.id === undefined ? undefined : await runtime.mailPassword(input.id));
+            const typed = password(body);
+            const secret = typed !== undefined ? normalizePassword(draft.preset, typed) : input.id === undefined ? undefined : await runtime.mailPassword(input.id);
             if (secret === undefined)
                 throw new ApiError(lang === 'zh' ? '先填密码（授权码）再测试' : 'Enter the password (app password) first');
             try {
@@ -230,7 +253,8 @@ export function apiHandlers(runtime, clock = Date.now) {
                 return { unread: messages.length };
             }
             catch (error) {
-                throw new MishuError(describeMailError(error, draft));
+                // The dialog shows the provider's steps already; the error only says what went wrong.
+                throw new MishuError(describeMailError(error, draft, { steps: false }));
             }
         },
         '/mail/delete': async (body) => {
@@ -249,8 +273,7 @@ export function apiHandlers(runtime, clock = Date.now) {
             const plan = runtime.restarter.plan();
             if (plan.kind === 'none')
                 throw new ApiError(plan.why[langOf(body)]);
-            const { log } = runtime.restarter.schedule(plan);
-            return { restarting: true, log };
+            return { restarting: true, ...runtime.restarter.schedule(plan) };
         },
         '/mail/sync': async (body) => {
             const lang = langOf(body);
@@ -262,6 +285,10 @@ export function apiHandlers(runtime, clock = Date.now) {
         },
     };
 }
+/** The page's view of a sign-in: messages in its language. */
+function deviceView(state, lang) {
+    return state.state === 'failed' ? { state: 'failed', message: state.message[lang] } : { ...state };
+}
 /** Run one handler; failures become `{ ok: false, message }` in the caller's language. */
 export async function handle(handler, request, fixedLang) {
     let body = {};