dsh-armory 1.10.0 → 2.0.0

package/lib/expert-market.js

@@ -790,11 +790,22 @@ export async function listExpertRecent() {
       // expert 记录与召唤预设对账：预设已摘除（送还）的记录不再展示，也顺手清掉。
       let patch = null;
       try {
-        patch = (await import("node:fs/promises")).readFile(join(homedir(), ".dsh", "profiles", "desktop", "cordis.patch.yml"), "utf8");
+        // 注意必须 await：漏 await 会拿到 Promise（truthy 且非字符串），后续
+        // parsePatchDoc 直接抛 TypeError，导致整条 listExpertRecent 恒失败。
+        patch = await readFile(join(homedir(), ".dsh", "profiles", "desktop", "cordis.patch.yml"), "utf8");
       } catch {
         patch = null;
       }
-      const live = patch ? new Set(readExpertPresets(patch).map((row) => row.plugin)) : null;
+      // 对账用的 YAML 解析要单独兜底：patch 文件被用户改坏（yaml 抛 TypeError）只影响
+      // 「预设还活着吗」这一个判断，回落 live=null 即可（= 不清记录、全部展示）；
+      // 若让它抛出去，整个 listExpertRecent → wbExpertRecent RPC 会恒失败，
+      // 客户端拿不到任何 kinds，「最近使用」排序整条链路失效——得不偿失。
+      let live = null;
+      try {
+        live = patch ? new Set(readExpertPresets(patch).map((row) => row.plugin)) : null;
+      } catch {
+        live = null;
+      }
       kinds[key] = live ? list.filter((item) => live.has(String(item?.plugin || ""))) : list;
       if (live && kinds[key].length !== list.length) {
         data.kinds[key] = kinds[key];

package/lib/index.js

@@ -13,7 +13,24 @@ import { collectImportLocations, missingEnvNames, resolveImportLocation } from "
 import { deriveMcpPhase, formatMcpLog, sanitizeMcpLog } from "./mcp-observability.js";
 import { allMcpEntries, entriesForName, projectToolSchema, revisionOf, toolInventory } from "./mcp-registry.js";
 import { WHATS_NEW } from "./whats-new.js";
-import { wbConnectorCatalog, wbConnectorCachedCount, wbConnectorPreview, wbSkillCatalog, wbSkillDetail, wbSkillInstall, wbSkillInstalled, wbSkillUninstall } from "./wb-market.js";
+import { probeMcpServersAuthorization, wbConnectorCatalog, wbConnectorCachedCount, wbConnectorPreview, wbSkillCatalog, wbSkillDetail, wbSkillInstall, wbSkillInstalled, wbSkillUninstall } from "./wb-market.js";
+// T03：多市场注册表（R4）与 codebuddy 插件市场（R5）的宿主侧数据层。
+import { readRegistry, upsertMarketplace } from "./wb-registry.js";
+import { wbPluginCatalog, wbPluginDetail, wbPluginUpdateCheck } from "./wb-plugin-market.js";
+// T06/Awesome：DSH 社区插件市场（awesome-dsh-plugins）的宿主侧数据层。
+import { wbAwesomeCatalog, wbAwesomeDetail, wbAwesomeUpdateCheck } from "./wb-awesome-market.js";
+import { readState as readInstallState, record as recordInstallState, forget as forgetInstallState } from "./wb-install-state.js";
+import { applyTokens } from "./wb-auth-rules.js";
+import {
+	authorizationOverview as oauthOverview,
+	authorizationStatus as oauthStatus,
+	beginAuthorization as oauthBegin,
+	cancelAuthorization as oauthCancel,
+	clearTokenRecord as oauthClearToken,
+	ensureAccessToken as oauthEnsureToken,
+	saveManualToken as oauthSaveManualToken,
+	submitCallback as oauthSubmitCallback,
+} from "./mcp-oauth.js";
 import { hasTeamBridge, installExpertSkills, listExpertRecent, listExpertSkills, prepareExpertPersona, readExpertPresets, recordExpertRecent, removeExpertPreset, uninstallExpertSkills, uninstallTeamMemberPersonas, wbExpertCatalog, wbExpertDetail, writeExpertPreset } from "./expert-market.js";
 import { attachPersona, detachPersona, listPersonas, reconcilePersonas } from "./session-persona.js";
 // OPT-19：clearTextCache 一并引入——toolTailor 的可选动作要回收解压文本缓存。
@@ -64,6 +81,118 @@ const ROOT_INCLUDE_ID = "include";
 const REDACTED_VALUE = "__DSH_MCP_REDACTED__";
 const REVEAL_REVISION_KEY = randomBytes(32);
 const patchWriteQueues = new WeakMap();
+// ── R8：连接器 MCP 的 OAuth 授权接线 ─────────────────────────────────────
+// 所有网络与落盘动作都在 lib/mcp-oauth.js；本文件只做三件事：
+// ① 从 mcpServers 里取出某个 server 的 url / headers（授权的靶点）；
+// ② 安装前把已授权 server 的 Bearer token 注进 headers（否则探测永远 401）；
+// ③ 把授权会话包装成 RPC 结果给面板轮询。
+const OAUTH_HTTP_TRANSPORT = new Set(["streamable-http", "streamablehttp", "http"]);
+
+/** 归一化一个 mcp.json server 条目：transport 可能是对象（nested）也可能是裸字段。 */
+function nestedServerSpec(rawServer) {
+	const nested = rawServer && typeof rawServer.transport === "object" ? rawServer.transport : rawServer || {};
+	const transport = String(nested?.type ?? rawServer?.type ?? "").toLowerCase();
+	const url = String(nested?.url ?? rawServer?.url ?? "").trim();
+	const headers = {};
+	for (const [key, value] of Object.entries(nested?.headers || {})) headers[String(key).toLowerCase()] = String(value);
+	return { nested, transport, url, headers };
+}
+
+/** 只有带 url 的 HTTP 族 server 才可能要走 OAuth；stdio 型永远不需要。 */
+function isOAuthCandidate(spec) {
+	return Boolean(spec.url) && OAUTH_HTTP_TRANSPORT.has(spec.transport || "streamable-http");
+}
+
+/** 保留原 headers，覆盖 authorization —— 这是 mcp-client 唯一能带出去的凭据通道。 */
+function withBearerHeader(rawServer, token) {
+	const spec = nestedServerSpec(rawServer);
+	const headers = { ...spec.headers, authorization: `Bearer ${token}` };
+	if (rawServer && typeof rawServer.transport === "object") return { ...rawServer, transport: { ...rawServer.transport, headers } };
+	return { ...rawServer, headers };
+}
+
+/**
+ * 安装前把已落盘的 access_token 注进对应 server 的 headers。
+ * 读不到 / 过期且刷不动就原样返回，交给 probe 去判定「需要授权」——
+ * 绝不因为令牌库有问题而阻断一次本来能成功的安装。
+ */
+async function injectStoredOAuthTokens(mcpServers) {
+	if (!mcpServers || typeof mcpServers !== "object") return mcpServers;
+	const out = {};
+	for (const [serverName, rawServer] of Object.entries(mcpServers)) {
+		const spec = nestedServerSpec(rawServer);
+		if (!isOAuthCandidate(spec) || spec.headers.authorization) {
+			out[serverName] = rawServer;
+			continue;
+		}
+		let token = "";
+		try {
+			token = String((await oauthEnsureToken(spec.url)) || "");
+		} catch {
+			token = "";
+		}
+		out[serverName] = token ? withBearerHeader(rawServer, token) : rawServer;
+	}
+	return out;
+}
+
+/** 解析某连接器里某 server 的授权靶点（url + 现有 headers）。 */
+async function resolveOAuthTarget(connectorId, serverName) {
+	const preview = await wbConnectorPreview(connectorId);
+	const servers = preview?.mcpServers && typeof preview.mcpServers === "object" ? preview.mcpServers : {};
+	const name = String(serverName || "").trim() || Object.keys(servers)[0] || "";
+	const rawServer = servers[name];
+	if (!rawServer) throw new Error(`连接器 ${connectorId} 里没有 server「${name || "（空）"}」`);
+	const spec = nestedServerSpec(rawServer);
+	if (!spec.url) throw new Error(`server「${name}」没有可授权的 URL（stdio 型不需要 OAuth 授权）`);
+	return { serverName: name, url: spec.url, headers: spec.headers, transport: spec.transport };
+}
+
+/** 宿主 shell 服务的几种可能落点，逐个试；拿不到就返回 undefined 走系统兜底。 */
+function resolveShellService(ctx) {
+	if (typeof ctx?.get !== "function") return undefined;
+	for (const id of ["shell", "electron", "appShell", "desktop"]) {
+		try {
+			const value = ctx.get(id);
+			if (!value) continue;
+			if (typeof value.openExternal === "function") return value;
+			if (typeof value?.shell?.openExternal === "function") return value.shell;
+		} catch {
+			/* 该服务不存在，继续试下一个 */
+		}
+	}
+	return undefined;
+}
+
+/** 用宿主能力打开授权页；没有 shell 就退回系统默认浏览器。 */
+async function openExternalUrl(ctx, url) {
+	const target = String(url || "").trim();
+	if (!target) return { opened: false, reason: "empty-url" };
+	const shell = resolveShellService(ctx);
+	if (shell && typeof shell.openExternal === "function") {
+		try {
+			await shell.openExternal(target);
+			return { opened: true, via: "shell" };
+		} catch {
+			/* 落到系统兜底 */
+		}
+	}
+	try {
+		const { spawn } = await import("node:child_process");
+		if (process.platform === "win32") {
+			// 绝不能用 `cmd /c start "$url"`：Node 只在参数含空格时才给参数加引号，而 URL 不含空格，
+			// cmd 于是把 URL 里的 & 当成命令分隔符，授权地址被截断成 `?response_type=code`，
+			// 服务器随后回 `invalid_request: client_id is required`。
+			// rundll32 走 ShellExecute 且参数直传，不经 cmd 解析。
+			spawn("rundll32", ["url.dll,FileProtocolHandler", target], { detached: true, stdio: "ignore" }).unref();
+		} else {
+			spawn(process.platform === "darwin" ? "open" : "xdg-open", [target], { detached: true, stdio: "ignore" }).unref();
+		}
+		return { opened: true, via: "spawn" };
+	} catch (error) {
+		return { opened: false, reason: String(error?.message || error) };
+	}
+}
 const PHASE_TEXT = { 0: "waiting", 1: "loading", 2: "connected", 3: "failed", 4: "stopped", 5: "unloading" };
 
 // mcp-client 至今不暴露任何可订阅的状态面（只导出 name/inject/Config/apply，无事件、无服务），
@@ -860,7 +989,7 @@ async function listMcpServers(ctx) {
 let McpManagerGateway = (() => {
 	let _classSuper = TypertRemoteService;
 	let _instanceExtraInitializers = [];
-	let _list_decorators, _status_decorators, _enable_decorators, _disable_decorators, _reconnect_decorators, _tools_decorators, _builtins_decorators, _installBuiltins_decorators, _add_decorators, _update_decorators, _remove_decorators, _reveal_decorators, _previewImport_decorators, _importJson_decorators, _listWorkspaces_decorators, _getWorkspaceView_decorators, _addWorkspaceServer_decorators, _updateWorkspaceServer_decorators, _removeWorkspaceServer_decorators, _setWorkspaceExclude_decorators, _installWorkspaceBuiltins_decorators, _previewWorkspaceImport_decorators, _importWorkspaceJson_decorators, _revealWorkspaceServer_decorators, _projectConnections_decorators, _reconnectWorkspaceServer_decorators, _updateHint_decorators, _whatsNew_decorators, _scanImportSources_decorators, _previewImportSource_decorators, _importSource_decorators, _toolTailor_decorators, _wbConnectorCatalog_decorators, _wbConnectorCachedCount_decorators, _wbConnectorPreview_decorators, _wbConnectorInstall_decorators, _wbSkillCatalog_decorators, _wbSkillDetail_decorators, _wbSkillInstall_decorators, _wbSkillUninstall_decorators, _wbSkillInstalled_decorators;
+	let _list_decorators, _status_decorators, _enable_decorators, _disable_decorators, _reconnect_decorators, _tools_decorators, _builtins_decorators, _installBuiltins_decorators, _add_decorators, _update_decorators, _remove_decorators, _reveal_decorators, _previewImport_decorators, _importJson_decorators, _listWorkspaces_decorators, _getWorkspaceView_decorators, _addWorkspaceServer_decorators, _updateWorkspaceServer_decorators, _removeWorkspaceServer_decorators, _setWorkspaceExclude_decorators, _installWorkspaceBuiltins_decorators, _previewWorkspaceImport_decorators, _importWorkspaceJson_decorators, _revealWorkspaceServer_decorators, _projectConnections_decorators, _reconnectWorkspaceServer_decorators, _updateHint_decorators, _whatsNew_decorators, _scanImportSources_decorators, _previewImportSource_decorators, _importSource_decorators, _toolTailor_decorators, _wbConnectorCatalog_decorators, _wbConnectorCachedCount_decorators, _wbConnectorPreview_decorators, _wbConnectorInstall_decorators, _wbOAuthBegin_decorators, _wbOAuthPoll_decorators, _wbOAuthCancel_decorators, _wbOAuthToken_decorators, _wbOAuthOverview_decorators, _wbOAuthOpen_decorators, _wbSkillCatalog_decorators, _wbSkillDetail_decorators, _wbSkillInstall_decorators, _wbSkillUninstall_decorators, _wbSkillInstalled_decorators, _wbMarketRegistry_decorators, _wbMarketRegistryUpsert_decorators, _wbPluginCatalog_decorators, _wbPluginDetail_decorators, _wbInstallState_decorators, _wbInstallStateRecord_decorators, _wbInstallStateForget_decorators, _wbPluginUpdateCheck_decorators, _wbAwesomeCatalog_decorators, _wbAwesomeDetail_decorators, _wbAwesomeUpdateCheck_decorators;
 	return class McpManagerGateway extends _classSuper {
 		static {
 			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
@@ -936,6 +1065,18 @@ let McpManagerGateway = (() => {
 			__esDecorate(this, null, _wbConnectorPreview_decorators, { kind: "method", name: "wbConnectorPreview", static: false, private: false, access: { has: (obj) => "wbConnectorPreview" in obj, get: (obj) => obj.wbConnectorPreview }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_wbConnectorInstall_decorators = [Remote("wbConnectorInstall")];
 			__esDecorate(this, null, _wbConnectorInstall_decorators, { kind: "method", name: "wbConnectorInstall", static: false, private: false, access: { has: (obj) => "wbConnectorInstall" in obj, get: (obj) => obj.wbConnectorInstall }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbOAuthBegin_decorators = [Remote("wbOAuthBegin")];
+			__esDecorate(this, null, _wbOAuthBegin_decorators, { kind: "method", name: "wbOAuthBegin", static: false, private: false, access: { has: (obj) => "wbOAuthBegin" in obj, get: (obj) => obj.wbOAuthBegin }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbOAuthPoll_decorators = [Remote("wbOAuthPoll")];
+			__esDecorate(this, null, _wbOAuthPoll_decorators, { kind: "method", name: "wbOAuthPoll", static: false, private: false, access: { has: (obj) => "wbOAuthPoll" in obj, get: (obj) => obj.wbOAuthPoll }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbOAuthCancel_decorators = [Remote("wbOAuthCancel")];
+			__esDecorate(this, null, _wbOAuthCancel_decorators, { kind: "method", name: "wbOAuthCancel", static: false, private: false, access: { has: (obj) => "wbOAuthCancel" in obj, get: (obj) => obj.wbOAuthCancel }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbOAuthToken_decorators = [Remote("wbOAuthToken")];
+			__esDecorate(this, null, _wbOAuthToken_decorators, { kind: "method", name: "wbOAuthToken", static: false, private: false, access: { has: (obj) => "wbOAuthToken" in obj, get: (obj) => obj.wbOAuthToken }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbOAuthOverview_decorators = [Remote("wbOAuthOverview")];
+			__esDecorate(this, null, _wbOAuthOverview_decorators, { kind: "method", name: "wbOAuthOverview", static: false, private: false, access: { has: (obj) => "wbOAuthOverview" in obj, get: (obj) => obj.wbOAuthOverview }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbOAuthOpen_decorators = [Remote("wbOAuthOpen")];
+			__esDecorate(this, null, _wbOAuthOpen_decorators, { kind: "method", name: "wbOAuthOpen", static: false, private: false, access: { has: (obj) => "wbOAuthOpen" in obj, get: (obj) => obj.wbOAuthOpen }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_wbSkillCatalog_decorators = [Remote("wbSkillCatalog")];
 			__esDecorate(this, null, _wbSkillCatalog_decorators, { kind: "method", name: "wbSkillCatalog", static: false, private: false, access: { has: (obj) => "wbSkillCatalog" in obj, get: (obj) => obj.wbSkillCatalog }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_wbSkillDetail_decorators = [Remote("wbSkillDetail")];
@@ -946,6 +1087,32 @@ let McpManagerGateway = (() => {
 			__esDecorate(this, null, _wbSkillUninstall_decorators, { kind: "method", name: "wbSkillUninstall", static: false, private: false, access: { has: (obj) => "wbSkillUninstall" in obj, get: (obj) => obj.wbSkillUninstall }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_wbSkillInstalled_decorators = [Remote("wbSkillInstalled")];
 			__esDecorate(this, null, _wbSkillInstalled_decorators, { kind: "method", name: "wbSkillInstalled", static: false, private: false, access: { has: (obj) => "wbSkillInstalled" in obj, get: (obj) => obj.wbSkillInstalled }, metadata: _metadata }, null, _instanceExtraInitializers);
+			// T03/R4：多市场注册表（读 / 增改）。
+			_wbMarketRegistry_decorators = [Remote("wbMarketRegistry")];
+			__esDecorate(this, null, _wbMarketRegistry_decorators, { kind: "method", name: "wbMarketRegistry", static: false, private: false, access: { has: (obj) => "wbMarketRegistry" in obj, get: (obj) => obj.wbMarketRegistry }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbMarketRegistryUpsert_decorators = [Remote("wbMarketRegistryUpsert")];
+			__esDecorate(this, null, _wbMarketRegistryUpsert_decorators, { kind: "method", name: "wbMarketRegistryUpsert", static: false, private: false, access: { has: (obj) => "wbMarketRegistryUpsert" in obj, get: (obj) => obj.wbMarketRegistryUpsert }, metadata: _metadata }, null, _instanceExtraInitializers);
+			// T03/R5：codebuddy 插件市场（列表 / 详情）。
+			_wbPluginCatalog_decorators = [Remote("wbPluginCatalog")];
+			__esDecorate(this, null, _wbPluginCatalog_decorators, { kind: "method", name: "wbPluginCatalog", static: false, private: false, access: { has: (obj) => "wbPluginCatalog" in obj, get: (obj) => obj.wbPluginCatalog }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbPluginDetail_decorators = [Remote("wbPluginDetail")];
+			__esDecorate(this, null, _wbPluginDetail_decorators, { kind: "method", name: "wbPluginDetail", static: false, private: false, access: { has: (obj) => "wbPluginDetail" in obj, get: (obj) => obj.wbPluginDetail }, metadata: _metadata }, null, _instanceExtraInitializers);
+			// T04/R8：安装状态登记（connector/skill/plugin 三类安装的统一账本）。
+			_wbInstallState_decorators = [Remote("wbInstallState")];
+			__esDecorate(this, null, _wbInstallState_decorators, { kind: "method", name: "wbInstallState", static: false, private: false, access: { has: (obj) => "wbInstallState" in obj, get: (obj) => obj.wbInstallState }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbInstallStateRecord_decorators = [Remote("wbInstallStateRecord")];
+			__esDecorate(this, null, _wbInstallStateRecord_decorators, { kind: "method", name: "wbInstallStateRecord", static: false, private: false, access: { has: (obj) => "wbInstallStateRecord" in obj, get: (obj) => obj.wbInstallStateRecord }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbInstallStateForget_decorators = [Remote("wbInstallStateForget")];
+			__esDecorate(this, null, _wbInstallStateForget_decorators, { kind: "method", name: "wbInstallStateForget", static: false, private: false, access: { has: (obj) => "wbInstallStateForget" in obj, get: (obj) => obj.wbInstallStateForget }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbPluginUpdateCheck_decorators = [Remote("wbPluginUpdateCheck")];
+			__esDecorate(this, null, _wbPluginUpdateCheck_decorators, { kind: "method", name: "wbPluginUpdateCheck", static: false, private: false, access: { has: (obj) => "wbPluginUpdateCheck" in obj, get: (obj) => obj.wbPluginUpdateCheck }, metadata: _metadata }, null, _instanceExtraInitializers);
+			// T06/Awesome：DSH 社区插件市场（awesome-dsh-plugins）。
+			_wbAwesomeCatalog_decorators = [Remote("wbAwesomeCatalog")];
+			__esDecorate(this, null, _wbAwesomeCatalog_decorators, { kind: "method", name: "wbAwesomeCatalog", static: false, private: false, access: { has: (obj) => "wbAwesomeCatalog" in obj, get: (obj) => obj.wbAwesomeCatalog }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbAwesomeDetail_decorators = [Remote("wbAwesomeDetail")];
+			__esDecorate(this, null, _wbAwesomeDetail_decorators, { kind: "method", name: "wbAwesomeDetail", static: false, private: false, access: { has: (obj) => "wbAwesomeDetail" in obj, get: (obj) => obj.wbAwesomeDetail }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbAwesomeUpdateCheck_decorators = [Remote("wbAwesomeUpdateCheck")];
+			__esDecorate(this, null, _wbAwesomeUpdateCheck_decorators, { kind: "method", name: "wbAwesomeUpdateCheck", static: false, private: false, access: { has: (obj) => "wbAwesomeUpdateCheck" in obj, get: (obj) => obj.wbAwesomeUpdateCheck }, metadata: _metadata }, null, _instanceExtraInitializers);
 			if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
 		}
 		static inject = ["loader", "tools"];
@@ -1468,11 +1635,126 @@ let McpManagerGateway = (() => {
 		if (!connectorId) throw new Error("缺少 connectorId");
 		const mode = payload?.mode === "replace" ? "replace" : "merge";
 		const wsPath = payload?.wsPath ? canonicalWorkspacePath(String(payload.wsPath)) : "";
+		const tokens = payload?.tokens && typeof payload.tokens === "object" ? payload.tokens : {};
 		const preview = await wbConnectorPreview(connectorId);
-		const json = { mcpServers: preview.mcpServers };
-		return wsPath
-			? applyWorkspaceImport(this.ctx, wsPath, admittedImport(json), mode)
-			: applyManagedImport(this.ctx, admittedImport(json), mode);
+		// T04/R7：把面板收集到的 token 填进 ${...} 占位符。只填用户明确提供的槽位，
+		// 未填的保持原样并把槽位名回传面板（missingSlots）——绝不代填、绝不猜值。
+		const { mcpServers, missingSlots } = applyTokens(preview.mcpServers, tokens);
+		// R8：先把已授权的 OAuth token 注进 headers 再探测——否则授权过的连接器每次重装
+		// 都会被判成「需要授权」，用户得反复点授权。
+		const authorized = await injectStoredOAuthTokens(mcpServers);
+		// 装前 401 探测：索引 auth_mode 会漏标鉴权（tec-do 裸 URL 装完必 401）。断言从
+		// 「任一不就整体中止」改为「回传需授权清单」：面板据此弹浏览器授权页，授权完成
+		// 后重装即可，绝不再抛「DSH 无法自动注入」把用户挡在门外。
+		const probe = await probeMcpServersAuthorization(authorized);
+		if (probe?.needsAuth?.length) {
+			return {
+				ok: false,
+				connectorId,
+				missingSlots,
+				needsAuth: probe.needsAuth,
+				error: `连接器需要授权：${probe.needsAuth.map((item) => item.serverName).join("、")}`,
+			};
+		}
+		const json = { mcpServers: authorized };
+		const result = wsPath
+			? await applyWorkspaceImport(this.ctx, wsPath, admittedImport(json), mode)
+			: await applyManagedImport(this.ctx, admittedImport(json), mode);
+		// T04/R8：装成功后登记本地状态（供「已安装」全量筛选与来源锁）。登记失败只记
+		// 日志、绝不影响安装结果——状态文件坏了不该让用户白装一次。
+		try {
+			await recordInstallState({
+				kind: "connector",
+				key: connectorId,
+				name: connectorId,
+				scope: wsPath ? "workspace" : "managed",
+				installPath: wsPath || "",
+				source: { kind: "marketplace", marketplace: "workbuddy-connectors" },
+			});
+		} catch (error) {
+			this.ctx.logger?.warn?.(`wb-market: 连接器 ${connectorId} 安装状态登记失败（不影响安装结果）：${error?.message || error}`);
+		}
+		return { ...result, missingSlots };
+	}
+	// ── R8：连接器 MCP 的浏览器授权（RFC 9728 / 8414 / 7591 / 7636）──────────
+	// 面板只负责展示与点击：安装前探测到 401 → 这里拿到 authorizeUrl 交给系统浏览器，
+	// 浏览器回来后面板轮询 wbOAuthPoll，token 落在 ~/.dsh/armory-oauth/。
+	async wbOAuthBegin(payload) {
+		const connectorId = String(payload?.connectorId || "").trim();
+		if (!connectorId) throw new Error("缺少 connectorId");
+		const target = await resolveOAuthTarget(connectorId, payload?.serverName);
+		const started = await oauthBegin({
+			serverName: target.serverName,
+			serverUrl: target.url,
+			headers: target.headers,
+			clientName: "DSH Armory",
+		});
+		if (!started?.ok) {
+			return {
+				ok: false,
+				connectorId,
+				serverName: target.serverName,
+				error: started?.error || "授权流程启动失败",
+				mode: started?.mode || "",
+				redirectUri: started?.redirectUri || "",
+			};
+		}
+		// 默认由宿主直接把授权页推给系统浏览器；open:false 留给面板自己渲染链接。
+		const opened = payload?.open === false ? { opened: false } : await openExternalUrl(this.ctx, started.authorizeUrl);
+		return {
+			ok: true,
+			connectorId,
+			serverName: target.serverName,
+			sessionId: started.sessionId,
+			authorizeUrl: started.authorizeUrl,
+			mode: started.mode,
+			redirectUri: started.redirectUri,
+			hint: started.hint || "",
+			opened: opened.opened === true,
+			openVia: opened.via || (opened.opened ? "" : String(opened.reason || "")),
+		};
+	}
+	async wbOAuthPoll(payload) {
+		const sessionId = String(payload?.sessionId || "").trim();
+		if (!sessionId) throw new Error("缺少 sessionId");
+		const callbackUrl = String(payload?.callbackUrl || "").trim();
+		// 自定义 scheme 回调（如 workbuddy://…）浏览器打不开，面板让用户把整条回调
+		// URL 粘回来，这里顺手换成 code 再去换 token。
+		if (callbackUrl) {
+			const submitted = await oauthSubmitCallback(sessionId, callbackUrl);
+			if (submitted && submitted.ok === false && submitted.status !== "authorized") return submitted;
+		}
+		return oauthStatus(sessionId);
+	}
+	async wbOAuthCancel(payload) {
+		const sessionId = String(payload?.sessionId || "").trim();
+		if (sessionId) oauthCancel(sessionId);
+		return { ok: true };
+	}
+	async wbOAuthToken(payload) {
+		const connectorId = String(payload?.connectorId || "").trim();
+		if (!connectorId) throw new Error("缺少 connectorId");
+		const target = await resolveOAuthTarget(connectorId, payload?.serverName);
+		const token = String(payload?.token || "").trim();
+		if (!token) {
+			// 空 token = 撤销授权（清掉本地记录），面板的「撤销授权」按钮走这条路。
+			await oauthClearToken(target.url);
+			return { ok: true, cleared: true, connectorId, serverName: target.serverName };
+		}
+		const saved = await oauthSaveManualToken({ serverUrl: target.url, serverName: target.serverName, token });
+		return { ok: saved?.ok !== false, connectorId, serverName: target.serverName, ...(saved || {}) };
+	}
+	async wbOAuthOverview(payload) {
+		const connectorId = String(payload?.connectorId || "").trim();
+		if (!connectorId) throw new Error("缺少 connectorId");
+		const target = await resolveOAuthTarget(connectorId, payload?.serverName).catch(() => null);
+		if (!target) return { ok: true, authorized: false, connectorId, serverName: "" };
+		const overview = await oauthOverview(target.url).catch(() => null);
+		return { ok: true, connectorId, serverName: target.serverName, ...(overview || {}) };
+	}
+	async wbOAuthOpen(payload) {
+		const opened = await openExternalUrl(this.ctx, payload?.url);
+		return { ok: opened.opened === true, ...opened };
 	}
 	async wbSkillCatalog(payload) {
 		return wbSkillCatalog(payload || {});
@@ -1486,6 +1768,22 @@ let McpManagerGateway = (() => {
 		const result = await wbSkillInstall(payload || {}, {
 			onProgress: (progress) => this.ctx.logger?.debug?.(`wb-market: ${progress.phase} ${progress.index}/${progress.total}`),
 		});
+		// T04/R8：装成功后登记本地状态。key 取不到就跳过（record 对空 key 会抛错）。
+		const key = result?.name || payload?.slug || payload?.name || "";
+		if (key) {
+			try {
+				await recordInstallState({
+					kind: "skill",
+					key,
+					name: result?.name || payload?.name || key,
+					version: result?.version || "",
+					installPath: result?.dir || "",
+					source: { kind: "marketplace", marketplace: "workbuddy-skills" },
+				});
+			} catch (error) {
+				this.ctx.logger?.warn?.(`wb-market: 技能 ${key} 安装状态登记失败（不影响安装结果）：${error?.message || error}`);
+			}
+		}
 		return result;
 	}
 	async wbSkillUninstall(payload) {
@@ -1494,6 +1792,57 @@ let McpManagerGateway = (() => {
 	async wbSkillInstalled() {
 		return wbSkillInstalled();
 	}
+	// ── T03/R4：多市场注册表 ────────────────────────────────────────────
+	// 数据层在 lib/wb-registry.js（T01）；这里只做 RPC 转发。读 = 合并投影（内置默认
+	// 永远在场）；增改 = upsert 一条后返回新的合并投影。缺 id 时 wb-registry 抛错。
+	async wbMarketRegistry() {
+		return readRegistry();
+	}
+	async wbMarketRegistryUpsert(payload) {
+		return upsertMarketplace(payload || {});
+	}
+	// ── T03/R5：codebuddy 插件市场 ──────────────────────────────────────
+	// 数据层在 lib/wb-plugin-market.js；这里只做 RPC 转发（下载/缓存/解析都在那边）。
+	async wbPluginCatalog() {
+		return wbPluginCatalog();
+	}
+	async wbPluginDetail(payload) {
+		return wbPluginDetail(payload?.name);
+	}
+
+	// ── T04/R8：安装状态账本（connector / skill / plugin 三类安装的统一登记） ──
+	async wbInstallState() {
+		return readInstallState();
+	}
+
+	async wbInstallStateRecord(payload) {
+		if (!payload || typeof payload !== "object") throw new Error("缺少安装状态条目");
+		await recordInstallState(payload);
+		return { note: `已登记安装状态：${payload.kind || "connector"}/${payload.key}` };
+	}
+
+	async wbInstallStateForget(payload) {
+		const kind = String(payload?.kind || "").trim();
+		const key = String(payload?.key || "").trim();
+		if (!kind || !key) throw new Error("缺少 kind 或 key");
+		await forgetInstallState(kind, key);
+		return { note: `已移除安装状态：${kind}/${key}` };
+	}
+
+	async wbPluginUpdateCheck() {
+		return wbPluginUpdateCheck();
+	}
+	// ── T06/Awesome：DSH 社区插件市场（awesome-dsh-plugins）──────────────
+	// 数据层在 lib/wb-awesome-market.js；这里只做 RPC 转发。
+	async wbAwesomeCatalog(payload) {
+		return wbAwesomeCatalog(payload || {});
+	}
+	async wbAwesomeDetail(payload) {
+		return wbAwesomeDetail(payload?.name);
+	}
+	async wbAwesomeUpdateCheck() {
+		return wbAwesomeUpdateCheck();
+	}
 	// ── WorkBuddy 专家直连（召唤预设 + 捆绑技能）────────────────────────
 	// 数据与安装逻辑都在 lib/expert-market.js；这里只做 RPC 转发与 patch 写盘收尾。
 	// 召唤 = 往 profile patch 插入一条独立 @deepseek-ai/dsh-agent-preset 行（persona.prefix
@@ -1650,4 +1999,4 @@ let McpManagerGateway = (() => {
 	};
 })();
 
-export { checkForUpdate, McpManagerGateway, McpManagerGateway as default, summarizeWorkspaceRow };
+export { checkForUpdate, McpManagerGateway, McpManagerGateway as default, summarizeWorkspaceRow };