@xxxyz/dsh-mcp-manager 2.1.2 → 2.1.4

package/README.md

@@ -126,6 +126,7 @@ dsh plugin --profile web remove @xxxyz/dsh-mcp-manager
 | 字段 | 说明 |
 |---|---|
 | `version` | loader 行 `config.version`，仅用于触发 HMR 重应用；官方通道安装下由 bundle 自动管理，无需手动修改。 |
+| `token` | **可选**访问令牌（写操作鉴权，纵深防御）。设置后写操作（增删改/启停/重启/导入导出/技能停用）须带 `x-dsh-token: <token>` 头；设置页提供令牌输入框（保存在浏览器 localStorage）。也可用环境变量 `DSH_MCP_MANAGER_TOKEN` 配置。默认关闭。 |
 
 loader 行必须为 **`insert` 块**形式（DSH patch 方言中普通 `- id:` 行只是对已存在条目的覆盖，无法新增插件）：
 
@@ -133,6 +134,8 @@ loader 行必须为 **`insert` 块**形式（DSH patch 方言中普通 `- id:`
 - insert:
     - id: dsh-mcp-manager
       name: '@xxxyz/dsh-mcp-manager'
+      config:
+        token: 你的访问令牌   # 可选：开启写操作鉴权
 ```
 
 > 无需手动写这行——`dsh plugin add` 的 bundle patch 会自动插入（见 `cordis.patch.yml`）。

package/README_EN.md

@@ -127,6 +127,7 @@ Configuration of the plugin itself on its loader row:
 | Field | Description |
 |---|---|
 | `version` | The loader row's `config.version`, only used to trigger an HMR re-apply; auto-managed by the bundle channel — no manual edits needed. |
+| `token` | **Optional** access token (write-op auth, defense in depth). When set, state-changing ops (add/edit/remove/enable/restart/import/export/skill-toggle) require the `x-dsh-token: <token>` header; the settings pages provide a token input (stored in browser localStorage). Can also be set via the `DSH_MCP_MANAGER_TOKEN` env var. Off by default. |
 
 The loader row must be an **`insert` block** (in DSH's patch dialect a plain `- id:` row only overrides existing entries and can never add a new plugin):
 
@@ -134,6 +135,8 @@ The loader row must be an **`insert` block** (in DSH's patch dialect a plain `-
 - insert:
     - id: dsh-mcp-manager
       name: '@xxxyz/dsh-mcp-manager'
+      config:
+        token: your-access-token   # optional: enable write-op auth
 ```
 
 > You don't need to write this row manually — `dsh plugin add` inserts it automatically via the bundle patch (see `cordis.patch.yml`).

package/lib/client.js

@@ -51,7 +51,9 @@ const factory = (require) => {
       '.skm-search{font-size:12px;padding:5px 8px;border-radius:6px;border:1px solid rgba(128,128,128,.5);background:transparent;color:inherit;width:100%;box-sizing:border-box}' +
       '.skm-group-title{font-size:12px;font-weight:600;opacity:.85;margin-top:4px;padding-bottom:2px;border-bottom:1px solid rgba(128,128,128,.25)}' +
       '.skm-provider-title{font-size:12px;font-weight:600;cursor:pointer;user-select:none;margin-top:4px;opacity:.9}' +
-      '.mcpm-version{margin-left:8px;font-size:11px;font-weight:500;opacity:.55;letter-spacing:.3px;vertical-align:middle}'
+      '.mcpm-version{margin-left:8px;font-size:11px;font-weight:500;opacity:.55;letter-spacing:.3px;vertical-align:middle}' +
+      '.mcpm-token{display:flex;align-items:center;gap:8px;font-size:12px;opacity:.85}' +
+      '.mcpm-token input{font-size:12px;padding:3px 6px;border-radius:5px;border:1px solid rgba(128,128,128,.5);background:transparent;color:inherit;flex:1;max-width:260px}'
 
     function ensureCss() {
       if (typeof document === 'undefined') return
@@ -64,13 +66,26 @@ const factory = (require) => {
       document.head.appendChild(tag)
     }
 
+    // Optional access token for write ops (host config.token or
+    // DSH_MCP_MANAGER_TOKEN). Kept in localStorage so the user enters it once;
+    // sent as `x-dsh-token` on every request (host ignores it when unset).
+    let TOKEN = ''
+    try { TOKEN = window.localStorage.getItem('dsh-mcp-manager-token') || '' } catch (e) { /* storage unavailable */ }
+    function getToken() { return TOKEN }
+    function setToken(v) {
+      TOKEN = String(v || '').trim()
+      try { if (TOKEN) window.localStorage.setItem('dsh-mcp-manager-token', TOKEN); else window.localStorage.removeItem('dsh-mcp-manager-token') } catch (e) { /* ignore */ }
+    }
+
     function apiCall(op, args) {
       // `x-dsh-plugin` is the cross-site (CSRF) gate header the host half
       // requires on every request; a cross-origin page cannot attach it
       // without a CORS preflight that this route never answers.
+      const headers = { 'content-type': 'application/json', 'x-dsh-plugin': 'dsh-mcp-manager' }
+      if (TOKEN) headers['x-dsh-token'] = TOKEN
       return fetch('/dsh-mcp-manager/api', {
         method: 'POST',
-        headers: { 'content-type': 'application/json', 'x-dsh-plugin': 'dsh-mcp-manager' },
+        headers,
         body: JSON.stringify({ op, args: args || {} }),
       }).then((r) => r.json()).catch((e) => ({ ok: false, error: String((e && e.message) || e) }))
     }
@@ -88,6 +103,15 @@ const factory = (require) => {
       return v ? React.createElement('span', { className: 'mcpm-version' }, 'v' + v) : null
     }
 
+    // Optional access-token row: shown on both settings pages; only needed
+    // when the host has token auth enabled (write ops would 401 otherwise).
+    function TokenRow() {
+      const [val, setVal] = React.useState(getToken())
+      return React.createElement('label', { className: 'mcpm-token' },
+        '访问令牌（可选，写操作鉴权）',
+        React.createElement('input', { value: val, onChange: (e) => { setVal(e.target.value); setToken(e.target.value) }, placeholder: '留空 = 不鉴权' }))
+    }
+
     module.exports = {
       name: 'dsh-mcp-manager-client',
       inject: ['timer'],
@@ -233,6 +257,7 @@ const factory = (require) => {
 
           return React.createElement('div', { className: 'mcpm-wrap' },
             React.createElement('h2', null, 'MCP 服务管理', React.createElement(VersionBadge, null)),
+            React.createElement(TokenRow, null),
             React.createElement('div', { className: 'mcpm-sub' },
               '管理 dsh-mcp-client 服务：写入 项目级(web profile) / 全局(home) 的 cordis.patch.yml，经 HMR 实时生效；重启 DSH 后由 Loader 自动加载。'),
             restartInfo && React.createElement('div', { className: 'mcpm-msg info' },
@@ -355,6 +380,7 @@ const factory = (require) => {
           const visible = state.skills.filter((s) => !query || (s.name + ' ' + (s.description || '')).toLowerCase().includes(query))
           return React.createElement('div', { className: 'mcpm-wrap' },
             React.createElement('h2', null, 'Skills 管理', React.createElement(VersionBadge, null)),
+            React.createElement(TokenRow, null),
             React.createElement('div', { className: 'mcpm-sub' }, '查看与启停 DSH 技能（按层级分组，禁用即时生效，无需重启）'),
             msg && React.createElement('div', { className: 'mcpm-msg ' + msg.kind }, msg.text),
             React.createElement('input', { className: 'skm-search', placeholder: '搜索技能名称或描述…', value: q, onChange: (e) => setQ(e.target.value) }),

package/lib/index.js

@@ -15,7 +15,7 @@ import { createRequire } from 'node:module';
 export default {
     name: 'dsh-mcp-manager-host',
     inject: ['timer', 'fs', 'settings', 'sandboxPolicy', 'webServer', 'tools', 'skills'],
-    apply(ctx) {
+    apply(ctx, config) {
         const fs = ctx.fs;
         const settings = ctx.settings;
         const sandboxPolicy = ctx.sandboxPolicy;
@@ -30,6 +30,21 @@ export default {
             PKG_VERSION = createRequire(import.meta.url)('../package.json').version || 'unknown';
         }
         catch (e) { /* keep unknown */ }
+        // Optional access token (defense in depth for LAN exposure). Enabled by
+        // setting `config.token` on this plugin's loader row (profile
+        // cordis.patch.yml override) or the DSH_MCP_MANAGER_TOKEN env var. When
+        // set, every state-changing op requires `x-dsh-token: <token>`. Read-only
+        // ops (plugin-version, mcpm-list, skill-list) stay open so the UI still
+        // renders; mcpm-export is guarded too because it leaks full configs.
+        // NOTE: the entry config arrives as the SECOND apply argument (Cordis
+        // calls `callback(ctx, config)`) — never read it off `ctx.config`, which
+        // is not an injected service and throws "cannot get property without
+        // inject" at boot.
+        const TOKEN = String(config?.token || process.env.DSH_MCP_MANAGER_TOKEN || '').trim();
+        const WRITE_OPS = new Set([
+            'mcpm-add', 'mcpm-edit', 'mcpm-remove', 'mcpm-set-enabled', 'mcpm-restart',
+            'mcpm-export', 'mcpm-import', 'skill-toggle',
+        ]);
         const wait = (ms) => ctx.timeout(ms);
         const message = (e) => String((e && e.message) || e);
         let writeChain = Promise.resolve();
@@ -145,6 +160,10 @@ export default {
             });
         }
         // ---------- path discovery ----------
+        // Known limitation: profile detection probes 'web' then 'headless' by
+        // presence of profiles/<name>/cordis.patch.yml, then falls back to any
+        // profile that has one, and finally to 'web'. A profile whose directory
+        // name matches none of these and has no patch file yet is not detected.
         let cached = null;
         async function ensurePaths() {
             if (cached)
@@ -274,6 +293,11 @@ export default {
             ].join('\n');
         }
         // ---------- YAML parsing (mini parser) ----------
+        // Known limitation: this hand-rolled parser assumes the exact indentation
+        // style that buildInsertBlock emits (config at 6 spaces, children at 8,
+        // nested maps/lists at 10+). Hand-edited patch files using different
+        // indentation may parse incorrectly — DSH itself only cares about the
+        // effective YAML it reads, and this parser exists purely for the UI.
         function splitKV(text) {
             const m = text.match(/^("(?:\\.|[^"])*"|'[^']*'|[^:]+?)\s*:\s*(.*)$/);
             if (!m)
@@ -778,14 +802,32 @@ export default {
             const block = buildInsertBlock(row);
             return withWriteLock(async () => {
                 if (oldAbs !== newAbs) {
-                    let c = await readPatch(oldAbs);
+                    // Level migration: remove from the old file, insert into the new one.
+                    // Not atomic, so keep the old content and restore it if the second
+                    // write fails — losing the entry is worse than a transient dup.
+                    const origOld = await readPatch(oldAbs);
+                    let c = origOld;
                     c = removeEntryAll(c, id);
-                    await writePatch(oldAbs, c);
+                    try {
+                        await writePatch(oldAbs, c);
+                    }
+                    catch (e) {
+                        return { ok: false, error: '写入失败: ' + message(e) };
+                    }
                     let c2 = await readPatch(newAbs);
                     c2 = appendBlock(c2, block);
                     if (cur.disabled)
                         c2 = appendBlock(c2, buildDisableBlock(id, true));
-                    await writePatch(newAbs, c2);
+                    try {
+                        await writePatch(newAbs, c2);
+                    }
+                    catch (e) {
+                        try {
+                            await writePatch(oldAbs, origOld);
+                        }
+                        catch (e2) { /* best effort */ }
+                        return { ok: false, error: '写入失败（已回滚）: ' + message(e) };
+                    }
                 }
                 else {
                     let c = await readPatch(newAbs);
@@ -810,6 +852,11 @@ export default {
             return withWriteLock(async () => {
                 let c = await readPatch(abs);
                 if (enabled) {
+                    // Drop every `disabled: true` override for this id. If the insert row
+                    // itself still says disabled (e.g. user hand-edited it), append an
+                    // explicit `disabled: false` override so the effective state flips.
+                    // Enable overrides are intentionally left in place — they are the
+                    // mechanism that lets a disabled-by-default row be turned on.
                     c = removeMarked(c, id, 'disable');
                     const { rows } = parseRows(c);
                     const row = rows.find((r) => r.id === id);
@@ -837,25 +884,30 @@ export default {
                 c = removeMarked(c, id, 'enable');
                 c = appendBlock(c, buildDisableBlock(id, true));
                 await writePatch(abs, c);
+                const warnings = [];
                 if (pluginInventory) {
-                    await waitFor(async () => {
+                    const off = await waitFor(async () => {
                         const e = await liveEntry(id);
                         return e ? e.enabled === false : false;
                     }, 5000, 300);
+                    if (!off)
+                        warnings.push('loader 未在 5 秒内停用该服务');
                 }
                 await wait(1000);
                 c = await readPatch(abs);
                 c = removeMarked(c, id, 'disable');
                 await writePatch(abs, c);
                 if (pluginInventory) {
-                    await waitFor(async () => {
+                    const on = await waitFor(async () => {
                         const e = await liveEntry(id);
                         return e ? e.enabled === true : false;
                     }, 5000, 300);
+                    if (!on)
+                        warnings.push('loader 未在 5 秒内重新启用该服务');
                 }
                 else
                     await wait(1500);
-                return { ok: true };
+                return warnings.length ? { ok: true, warning: warnings.join('；') } : { ok: true };
             });
         }
         async function mcpmRemove(args) {
@@ -917,28 +969,27 @@ export default {
                     continue;
                 }
                 const row = norm.row;
-                const existing = await collectAll();
-                if (existing.ids.has(row.id)) {
-                    skipped.push({ id: row.id, reason: 'id 已存在' });
-                    continue;
-                }
-                if (existing.serverNames.has(row.serverName)) {
-                    skipped.push({ id: row.id, reason: 'serverName 已存在' });
-                    continue;
-                }
-                const abs = row.level === 'global' ? p.globalPatch : p.projectPatch;
+                // Existence checks run INSIDE the write lock so two concurrent imports
+                // (or an import racing an add) cannot both pass the same-id/same-name
+                // check and duplicate rows (TOCTOU).
                 const res = await withWriteLock(async () => {
+                    const existing = await collectAll();
+                    if (existing.ids.has(row.id))
+                        return { skipped: true, reason: 'id 已存在' };
+                    if (existing.serverNames.has(row.serverName))
+                        return { skipped: true, reason: 'serverName 已存在' };
+                    const abs = row.level === 'global' ? p.globalPatch : p.projectPatch;
                     let c = await readPatch(abs);
                     c = appendBlock(c, buildInsertBlock(row));
                     if (row.disabled)
                         c = appendBlock(c, buildDisableBlock(row.id, true));
                     await writePatch(abs, c);
-                    return { ok: true };
+                    return { added: true };
                 });
-                if (res && res.ok)
+                if (res.added)
                     added.push(row.id);
                 else
-                    skipped.push({ id: row.id, reason: (res && res.error) || '写入失败' });
+                    skipped.push({ id: row.id, reason: (res && res.reason) || '写入失败' });
             }
             return { ok: true, added, skipped };
         }
@@ -1042,9 +1093,21 @@ export default {
         }));
         // ---------- HTTP API route (UI half), registered defensively ----------
         if (webServer) {
+            // Cap request bodies (1 MiB) — the API has no legitimate large payloads,
+            // and unbounded buffering would let a local attacker exhaust memory.
+            const MAX_BODY = 1024 * 1024;
             const readBody = (req) => new Promise((resolve, reject) => {
                 const chunks = [];
-                req.on('data', (c) => chunks.push(String(c)));
+                let size = 0;
+                req.on('data', (c) => {
+                    const s = String(c);
+                    size += s.length;
+                    if (size > MAX_BODY) {
+                        reject(new Error('request body too large'));
+                        return;
+                    }
+                    chunks.push(s);
+                });
                 req.on('end', () => resolve(chunks.join('')));
                 req.on('error', reject);
             });
@@ -1098,8 +1161,18 @@ export default {
                             try {
                                 payload = JSON.parse((await readBody(req)) || '{}');
                             }
-                            catch (e) { /* fallthrough */ }
+                            catch (e) {
+                                if (String(e?.message).includes('body too large')) {
+                                    res.end(JSON.stringify({ ok: false, error: '请求体过大' }));
+                                    return;
+                                }
+                                /* otherwise fall through with {} */
+                            }
                             const op = String(payload.op || '');
+                            if (TOKEN && WRITE_OPS.has(op) && hdr('x-dsh-token') !== TOKEN) {
+                                res.end(JSON.stringify({ ok: false, error: '缺少或错误的访问令牌（x-dsh-token）' }));
+                                return;
+                            }
                             const fn = handlers[op];
                             if (!fn) {
                                 res.end(JSON.stringify({ ok: false, error: '未知操作: ' + op }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xxxyz/dsh-mcp-manager",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "description": "DSH-standard MCP manager plugin: Settings UI + HTTP API + model-facing mcp_manager_* tools. Install with one command: dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest",
   "type": "module",
   "main": "lib/index.js",
@@ -27,7 +27,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "npm run build && node --test",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "lint": "node --check lib/client.js && node --check lib/index.js"
   },
   "keywords": [
     "dsh",