dsh-mcp-connector 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,25 @@
+# Changelog
+
+本项目遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)；首个公开版本从 `0.1.0` 开始。
+
+## [0.1.0] - 2026-08-20
+
+### Added
+
+- DeepSeek Harness Desktop 左侧“MCP连接器”入口，位于“新会话”下、“工作区/会话列表”上，并提供 footer 自动降级。
+- 图形化连接器市场与已安装列表，内置 4 个企查查连接器和本地 QCC Logo。
+- OAuth 2.0 PKCE、自定义 MCP 配置、`mcpServers` JSON 导入和描述 URL 安装四条接入路径。
+- 连接持久化、重启恢复、启停、断开、OAuth Token 刷新与撤销。
+- 连接器详情弹框、按 Server 分组的工具描述/搜索/滚动，以及精选 Prompt 换一批。
+- 示例 Prompt 一键带入 DSH 新会话，包含同源校验、超时提示和重复点击保护。
+- 内置目录、远程 registry、本地覆盖、上下架与精选能力。
+- 11 个 `mcp_connector_*` 对话工具。
+- Node.js 20/22/24 CI、Tag 发布工作流和 npm 发布包白名单/敏感内容校验。
+
+### Security
+
+- 凭证仅持久化在 DSH storage domain。
+- 外部 URL 与导入 Header 执行安全校验。
+- iframe 消息校验同源和消息来源。
+
+[0.1.0]: https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-mcp-connector contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,82 @@
+# MCP连接器（DeepSeek Harness 插件）
+
+在 DeepSeek Harness Desktop 中提供类似 WorkBuddy 的 MCP 连接器市场与连接管理：浏览连接器、OAuth 授权、查看工具、快速发起对话，并管理已安装连接。
+
+[![CI](https://github.com/duhu2000/dsh-mcp-connector/actions/workflows/ci.yml/badge.svg)](https://github.com/duhu2000/dsh-mcp-connector/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/dsh-mcp-connector.svg)](https://www.npmjs.com/package/dsh-mcp-connector)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+## 功能
+
+- 左侧主导航入口：目标位置为“新会话”下方、“工作区/会话列表”上方；若 DSH DOM 结构不兼容，自动回退到底部公开插槽。
+- 图形化市场：市场/已安装、搜索、连接状态与刷新。
+- 连接器详情：精选 Prompt 优先展示，点击可带入 DSH 新会话；工具按 Server 分组，支持描述、搜索和独立滚动。
+- 三种接入：OAuth 2.0 PKCE、自定义 URL/鉴权、导入 `mcpServers` JSON；也支持从连接器描述 URL 安装。
+- 生命周期管理：连接持久化、重启恢复、启停、断开、OAuth 刷新与撤销。
+- 目录运营：内置目录、远程 registry、本地覆盖，支持 `published` 上下架与 `featured` 精选。
+- 对话工具：`mcp_connector_catalog`、`connect`、`configure`、`import_json`、`install_from_url`、`status`、`set_enabled`、`disconnect`、`refresh_catalog`、`publish`、`tools_list`。
+
+首版内置 4 个企查查连接器，卡片统一使用包内企查查 Logo；插件架构本身不限定厂商。
+
+## 安装
+
+要求：DeepSeek Harness Desktop/web profile，Node.js 20 或更高版本。
+
+```bash
+dsh plugin --profile web add dsh-mcp-connector
+```
+
+也可使用安装脚本：
+
+```bash
+bash <(curl -fsSL https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/install.sh)
+```
+
+安装或升级后需完全退出并重启 DeepSeek Harness Desktop。
+
+## 使用
+
+1. 点击左侧“🧩 MCP连接器”。
+2. 在市场中选择连接器并完成授权或配置。
+3. 打开卡片详情，可点击示例 Prompt 的发送按钮，在当前工作区创建/复用空白会话并写入草稿。
+4. 在“已安装”或对话工具中查看、停用、恢复或断开连接。
+
+连接成功后，工具按 `mcp__<serverName>__*` 前缀提供给模型。
+
+## 配置
+
+Bundle 默认配置位于 `cordis.patch.yml`：
+
+```yaml
+- id: mcp-connector
+  name: dsh-mcp-connector
+  config:
+    catalogUrl: ''
+    persistSecrets: true
+    entryPrefix: mcp
+    refreshSkewMs: 300000
+    openBrowser: true
+```
+
+## 开发与发布门禁
+
+```bash
+npm run check
+```
+
+该命令依次执行语法检查、29 项测试和 npm 发布包白名单校验。CI 使用 `--legacy-peer-deps` 安装显式测试依赖，DSH 运行期 peer 仍由 Host 提供。`v*` Tag 会触发 GitHub Actions；Tag 必须与 `package.json` 版本一致。仓库配置 `NPM_TOKEN` 后自动发布 npm，否则只创建 GitHub Release。
+
+首个公开版本规划为 `dsh-mcp-connector@0.1.0`。
+
+版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
+
+## 安全与限制
+
+- 凭证只持久化在 DSH storage domain，不进入目录、Git 仓库或对话历史。
+- 外部 URL 仅允许 HTTPS，HTTP 仅允许回环地址；导入配置会校验 URL 与 Header。
+- 当前以 streamable-http 为主并兼容 SSE；stdio 配置会被明确跳过。
+- 顶部入口通过 DSH 稳定 `data-slot` 定位并使用 React Portal；DSH 若移除该标记，入口会回退到底部，不影响连接器功能。
+
+## License
+
+MIT

package/catalog/catalog.json

@@ -0,0 +1,162 @@
+{
+  "schemaVersion": 1,
+  "connectors": [
+    {
+      "id": "qcc-company",
+      "name": "企查查·企业工商",
+      "vendor": "企查查 Qichacha",
+      "icon": "/mcp-connector/ui/assets/qcc-logo.svg",
+      "category": "企业数据",
+      "summary": "一站式企业工商 / 股权 / 经营信息查询",
+      "description": "覆盖工商注册、股东、实际控制人、对外投资、经营异常、行政处罚等企业全景数据，适用于尽调、风控、营销获客场景。",
+      "tags": ["工商", "风控", "尽调", "获客"],
+      "published": true,
+      "featured": true,
+      "homepage": "https://open.qcc.com",
+      "auth": {
+        "mode": "oauth2-pkce",
+        "issuer": "https://agent.qcc.com",
+        "scope": "mcp:tools",
+        "clientName": "DeepSeek Harness - MCP 连接器",
+        "tokenEndpointAuthMethod": "none",
+        "grantSharing": "issuer"
+      },
+      "servers": [
+        { "serverKey": "company", "url": "https://agent.qcc.com/mcp/company/stream", "serverName": "qcc-company", "transport": "streamable-http", "headers": {} },
+        { "serverKey": "risk", "url": "https://agent.qcc.com/mcp/risk/stream", "serverName": "qcc-risk", "transport": "streamable-http", "headers": {} },
+        { "serverKey": "ipr", "url": "https://agent.qcc.com/mcp/ipr/stream", "serverName": "qcc-ipr", "transport": "streamable-http", "headers": {} },
+        { "serverKey": "operation", "url": "https://agent.qcc.com/mcp/operation/stream", "serverName": "qcc-operation", "transport": "streamable-http", "headers": {} },
+        { "serverKey": "history", "url": "https://agent.qcc.com/mcp/history/stream", "serverName": "qcc-history", "transport": "streamable-http", "headers": {} },
+        { "serverKey": "executive", "url": "https://agent.qcc.com/mcp/executive/stream", "serverName": "qcc-executive", "transport": "streamable-http", "headers": {} }
+      ],
+      "prompts": [
+        { "title": "企业最新工商变更", "text": "查询 小米科技有限责任公司 的最新工商变更记录", "server": "company" },
+        { "title": "股东结构", "text": "查询 小米科技有限责任公司 的股东构成与出资信息", "server": "company" },
+        { "title": "实际控制人", "text": "查询 小米科技有限责任公司 的实际控制人信息", "server": "company" },
+        { "title": "主要人员（高管团队）", "text": "查询 小米科技有限责任公司 的主要人员信息", "server": "company" },
+        { "title": "对外投资", "text": "查询 小米科技有限责任公司 的对外投资信息", "server": "company" },
+        { "title": "受益所有人识别", "text": "查询 小米科技有限责任公司 的受益所有人识别信息", "server": "company" },
+        { "title": "企业风险全景扫描", "text": "对 小米科技有限责任公司 做一次企业风险全景扫描", "server": "risk" },
+        { "title": "失信信息", "text": "查询 小米科技有限责任公司 的失信信息", "server": "risk" },
+        { "title": "被执行人信息", "text": "查询 小米科技有限责任公司 的被执行人信息", "server": "risk" },
+        { "title": "经营异常", "text": "查询 小米科技有限责任公司 的经营异常信息", "server": "risk" },
+        { "title": "商标信息", "text": "查询 小米科技有限责任公司 的商标信息", "server": "ipr" },
+        { "title": "专利信息", "text": "查询 小米科技有限责任公司 的专利信息", "server": "ipr" },
+        { "title": "软件著作权", "text": "查询 小米科技有限责任公司 的软件著作权信息", "server": "ipr" },
+        { "title": "作品著作权", "text": "查询 小米科技有限责任公司 的作品著作权信息", "server": "ipr" },
+        { "title": "招投标信息", "text": "查询 小米科技有限责任公司 的招投标信息", "server": "operation" },
+        { "title": "资质证书", "text": "查询 小米科技有限责任公司 的资质证书信息", "server": "operation" },
+        { "title": "行政许可", "text": "查询 小米科技有限责任公司 的行政许可信息", "server": "operation" },
+        { "title": "新闻舆情", "text": "查询 小米科技有限责任公司 的新闻舆情信息", "server": "operation" },
+        { "title": "历史股东", "text": "查询 小米科技有限责任公司 的历史股东变动记录", "server": "history" },
+        { "title": "历史法定代表人", "text": "查询 小米科技有限责任公司 的历史法定代表人记录", "server": "history" },
+        { "title": "历史失信", "text": "查询 小米科技有限责任公司 的历史失信记录（已移出名单）", "server": "history" },
+        { "title": "历史行政处罚", "text": "查询 小米科技有限责任公司 的历史行政处罚记录", "server": "history" },
+        { "title": "董监高个人风险扫描", "text": "对 小米科技有限责任公司 的董监高 雷军 做一次个人风险全景扫描", "server": "executive" },
+        { "title": "担任法定代表人", "text": "查询 小米科技有限责任公司 的董监高 雷军 担任法定代表人的情况", "server": "executive" },
+        { "title": "在外任职", "text": "查询 小米科技有限责任公司 的董监高 雷军 的在外任职信息", "server": "executive" },
+        { "title": "全部关联企业", "text": "查询 小米科技有限责任公司 的董监高 雷军 的全部关联企业", "server": "executive" }
+      ]
+    },
+    {
+      "id": "qcc-legal",
+      "name": "企查查·法律数据",
+      "vendor": "企查查 Qichacha",
+      "icon": "/mcp-connector/ui/assets/qcc-logo.svg",
+      "category": "企业数据",
+      "summary": "法规条文 / 司法案例检索与核验",
+      "description": "法律法规逐字条文、指导性/公报/典型案例检索、案号引用核验，面向法律意见书与类案检索场景。",
+      "tags": ["法律", "法规", "案例", "核验"],
+      "published": true,
+      "featured": false,
+      "homepage": "https://open.qcc.com",
+      "auth": {
+        "mode": "oauth2-pkce",
+        "issuer": "https://agent.qcc.com",
+        "scope": "mcp:tools",
+        "clientName": "DeepSeek Harness - MCP 连接器",
+        "tokenEndpointAuthMethod": "none",
+        "grantSharing": "issuer"
+      },
+      "servers": [
+        { "serverKey": "regulation", "url": "https://agent.qcc.com/mcp/regulation/stream", "serverName": "qcc-regulation", "transport": "streamable-http", "headers": {} },
+        { "serverKey": "case", "url": "https://agent.qcc.com/mcp/case/stream", "serverName": "qcc-case", "transport": "streamable-http", "headers": {} }
+      ],
+      "prompts": [
+        { "title": "法规检索", "text": "检索与「劳动合同解除」相关的法律法规", "server": "regulation" },
+        { "title": "法条检索", "text": "检索与「劳动合同解除」相关的法条原文", "server": "regulation" },
+        { "title": "司法案例检索", "text": "检索与「劳动合同违法解除」相关的司法案例", "server": "case" },
+        { "title": "权威案例检索", "text": "检索与「劳动合同违法解除」相关的权威司法案例", "server": "case" }
+      ]
+    },
+    {
+      "id": "qcc-tender",
+      "name": "企查查·招投标",
+      "vendor": "企查查 Qichacha",
+      "icon": "/mcp-connector/ui/assets/qcc-logo.svg",
+      "category": "企业数据",
+      "summary": "招投标公告 / 中标结果 / 采购信息",
+      "description": "覆盖全国招投标公告、中标结果、采购信息，适用于竞对分析、市场研究、销售线索挖掘场景。",
+      "tags": ["招投标", "采购", "中标", "竞对"],
+      "published": true,
+      "featured": false,
+      "homepage": "https://open.qcc.com",
+      "auth": {
+        "mode": "oauth2-pkce",
+        "issuer": "https://agent.qcc.com",
+        "scope": "mcp:tools",
+        "clientName": "DeepSeek Harness - MCP 连接器",
+        "tokenEndpointAuthMethod": "none",
+        "grantSharing": "issuer"
+      },
+      "servers": [
+        { "serverKey": "tender", "url": "https://agent.qcc.com/mcp/tender/stream", "serverName": "qcc-tender", "transport": "streamable-http", "headers": {} }
+      ],
+      "prompts": [
+        { "title": "招投标检索", "text": "检索与「智慧城市」相关的招投标、采购和中标标讯", "server": "tender" },
+        { "title": "拟建项目检索", "text": "检索与「新能源汽车」相关的拟建项目", "server": "tender" },
+        { "title": "企业招投标检索", "text": "查询 华为技术有限公司 相关的招标、投标、中标和采购标讯", "server": "tender" }
+      ]
+    },
+    {
+      "id": "qcc-document",
+      "name": "企查查·文档报告",
+      "vendor": "企查查 Qichacha",
+      "icon": "/mcp-connector/ui/assets/qcc-logo.svg",
+      "category": "企业数据",
+      "summary": "企业报告生成 / 文档分析",
+      "description": "基于企业数据自动生成分析报告、尽职调查文档，支持文档结构化解析与内容提取。",
+      "tags": ["文档", "报告", "分析"],
+      "published": true,
+      "featured": false,
+      "homepage": "https://open.qcc.com",
+      "auth": {
+        "mode": "oauth2-pkce",
+        "issuer": "https://agent.qcc.com",
+        "scope": "mcp:tools",
+        "clientName": "DeepSeek Harness - MCP 连接器",
+        "tokenEndpointAuthMethod": "none",
+        "grantSharing": "issuer"
+      },
+      "servers": [
+        { "serverKey": "document", "url": "https://agent.qcc.com/mcp/document/stream", "serverName": "qcc-document", "transport": "streamable-http", "headers": {} }
+      ],
+      "prompts": []
+    },
+    {
+      "id": "legacy-internal",
+      "name": "内测·待上架连接器",
+      "vendor": "内部团队",
+      "category": "其他",
+      "summary": "下架示例：published=false 不出现在用户货架",
+      "description": "该条目用于演示「下架」语义——已装用户保留连接，但新用户刷新目录不可见。",
+      "tags": ["内测"],
+      "published": false,
+      "featured": false,
+      "auth": { "mode": "none" },
+      "servers": [
+        { "serverKey": "internal", "url": "https://mcp.internal.example.com/stream", "serverName": "internal-demo", "transport": "streamable-http", "headers": {} }
+      ]
+    }
+  ]
+}

package/catalog/catalog.sample.json

@@ -0,0 +1,166 @@
+{
+  "$comment": "MCP连接器内置目录示例。published=true 才出现在用户货架；registry 中禁止携带任何密钥（加载时校验剥离）。",
+  "meta": {
+    "schemaVersion": 1,
+    "categories": ["企业数据", "办公协作", "地图出行", "金融行情", "开发工具", "数据库", "AI 模型", "其他"]
+  },
+  "connectors": [
+    {
+      "id": "qcc-company",
+      "name": "企查查·企业工商",
+      "vendor": "企查查 Qichacha",
+      "icon": "https://qcc-static.oss-cn-hangzhou.aliyuncs.com/mcp/qcc.svg",
+      "category": "企业数据",
+      "summary": "一站式企业工商 / 股权 / 经营信息查询",
+      "description": "覆盖工商注册、股东、实际控制人、对外投资、经营异常、行政处罚等企业全景数据，适用于尽调、风控、营销获客场景。",
+      "tags": ["工商", "风控", "尽调", "获客"],
+      "published": true,
+      "featured": true,
+      "homepage": "https://open.qcc.com",
+      "auth": {
+        "mode": "oauth2-pkce",
+        "issuer": "https://agent.qcc.com",
+        "scope": "mcp:tools",
+        "clientName": "DeepSeek Harness - MCP 连接器",
+        "tokenEndpointAuthMethod": "none",
+        "grantSharing": "issuer"
+      },
+      "servers": [
+        {
+          "serverKey": "company",
+          "url": "https://agent.qcc.com/mcp/company/stream",
+          "serverName": "qcc-company",
+          "transport": "streamable-http",
+          "headers": {}
+        },
+        {
+          "serverKey": "risk",
+          "url": "https://agent.qcc.com/mcp/risk/stream",
+          "serverName": "qcc-risk",
+          "transport": "streamable-http",
+          "headers": {}
+        },
+        {
+          "serverKey": "ipr",
+          "url": "https://agent.qcc.com/mcp/ipr/stream",
+          "serverName": "qcc-ipr",
+          "transport": "streamable-http",
+          "headers": {}
+        }
+      ]
+    },
+    {
+      "id": "qcc-legal",
+      "name": "企查查·法律数据",
+      "vendor": "企查查 Qichacha",
+      "icon": "https://qcc-static.oss-cn-hangzhou.aliyuncs.com/mcp/qcc-legal.svg",
+      "category": "企业数据",
+      "summary": "法规条文 / 司法案例检索与核验",
+      "description": "法律法规逐字条文、指导性/公报/典型案例检索、案号引用核验，面向法律意见书与类案检索场景。",
+      "tags": ["法律", "法规", "案例", "核验"],
+      "published": true,
+      "featured": false,
+      "homepage": "https://open.qcc.com",
+      "auth": {
+        "mode": "oauth2-pkce",
+        "issuer": "https://agent.qcc.com",
+        "scope": "mcp:tools",
+        "clientName": "DeepSeek Harness - MCP 连接器",
+        "tokenEndpointAuthMethod": "none",
+        "grantSharing": "issuer"
+      },
+      "servers": [
+        {
+          "serverKey": "regulation",
+          "url": "https://agent.qcc.com/mcp/regulation/stream",
+          "serverName": "qcc-regulation",
+          "transport": "streamable-http",
+          "headers": {}
+        },
+        {
+          "serverKey": "case",
+          "url": "https://agent.qcc.com/mcp/case/stream",
+          "serverName": "qcc-case",
+          "transport": "streamable-http",
+          "headers": {}
+        }
+      ]
+    },
+    {
+      "id": "amap-geo",
+      "name": "高德·地图出行",
+      "vendor": "高德开放平台",
+      "icon": "https://webapi.amap.com/theme/v1.3/open_mac_color.png",
+      "category": "地图出行",
+      "summary": "地理编码 / 逆地理编码 / 路径规划 / POI 检索",
+      "description": "示例：api-key 型连接器。用户在自定义配置里填入厂商下发的 API Key，即可获得地图与位置类 MCP 工具。",
+      "tags": ["地图", "定位", "POI", "路线"],
+      "published": true,
+      "featured": false,
+      "homepage": "https://lbs.amap.com",
+      "auth": {
+        "mode": "api-key",
+        "apiKeyHeader": "X-Api-Key",
+        "clientName": "DeepSeek Harness - MCP 连接器"
+      },
+      "servers": [
+        {
+          "serverKey": "geo",
+          "url": "https://mcp.amap.com/stream",
+          "serverName": "amap-geo",
+          "transport": "streamable-http",
+          "headers": {}
+        }
+      ]
+    },
+    {
+      "id": "vendor-stock",
+      "name": "行情·示例厂商",
+      "vendor": "某金融数据厂商",
+      "icon": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iLi4uIi8+",
+      "category": "金融行情",
+      "summary": "A 股 / 港股 / 美股行情与基本面（示例）",
+      "description": "示例：bearer 型连接器。用户在自定义配置里粘贴 Bearer Token 即可连接；目录仅含模板，不含密钥。",
+      "tags": ["行情", "选股", "基本面"],
+      "published": true,
+      "featured": false,
+      "homepage": "https://example.com/mcp",
+      "auth": {
+        "mode": "bearer",
+        "clientName": "DeepSeek Harness - MCP 连接器"
+      },
+      "servers": [
+        {
+          "serverKey": "market",
+          "url": "https://mcp.example.com/market/stream",
+          "serverName": "example-market",
+          "transport": "streamable-http",
+          "headers": {}
+        }
+      ]
+    },
+    {
+      "id": "legacy-internal",
+      "name": "内测·待上架连接器",
+      "vendor": "内部团队",
+      "icon": "data:image/svg+xml;base64,PHN2Zy8+",
+      "category": "其他",
+      "summary": "下架示例：published=false 不出现在用户货架",
+      "description": "该条目用于演示「下架」语义——已装用户保留连接，但新用户刷新目录不可见。",
+      "tags": ["内测"],
+      "published": false,
+      "featured": false,
+      "homepage": "https://example.com",
+      "auth": { "mode": "none" },
+      "servers": [
+        {
+          "serverKey": "internal",
+          "url": "https://mcp.internal.example.com/stream",
+          "serverName": "internal-demo",
+          "transport": "streamable-http",
+          "headers": {}
+        }
+      ]
+    }
+  ]
+}

package/cordis.patch.yml

@@ -0,0 +1,12 @@
+# MCP连接器 插件（DSH Bundle patch）
+# 作为 bundle 被合入 profile 时，自动插入本插件行。
+# 插件负责连接器目录、三通道连接、凭证存储与 mcp-client 条目动态配置。
+- insert:
+    - id: mcp-connector
+      name: 'dsh-mcp-connector'
+      config:
+        catalogUrl: ''
+        persistSecrets: true
+        entryPrefix: 'mcp'
+        refreshSkewMs: 300000
+        openBrowser: true

package/install.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# dsh-mcp-connector 一键安装脚本（DeepSeek Harness）
+# 用法：
+#   本地：  bash install.sh
+#   远端：  bash <(curl -fsSL https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/install.sh)
+# 支持：优先 dsh CLI（自动注册 bundle）；无 dsh 时回退 pnpm 并兜底注册 bundles。
+# 幂等：重复执行不会重复注册或破坏已有配置。
+set -euo pipefail
+
+PKG="dsh-mcp-connector"
+DSH_HOME="${DSH_HOME:-$HOME/.dsh}"
+PROFILE="${DSH_PROFILE:-web}"
+PROFILE_DIR="$DSH_HOME/profiles/$PROFILE"
+PJ="$PROFILE_DIR/package.json"
+
+echo "==> 目标 profile: $PROFILE_DIR"
+
+if [ ! -d "$PROFILE_DIR" ]; then
+  echo "错误：profile 不存在：$PROFILE_DIR"
+  echo "请确认 DSH_HOME 与 DSH_PROFILE（默认 ~/.dsh 与 web）。"
+  exit 1
+fi
+
+if command -v dsh >/dev/null 2>&1; then
+  echo "==> dsh plugin --profile $PROFILE add $PKG"
+  dsh plugin --profile "$PROFILE" add "$PKG"
+else
+  if command -v pnpm >/dev/null 2>&1; then
+    echo "==> 未找到 dsh CLI，回退 pnpm 安装（需自行确保 bundle 注册，见下）"
+    (cd "$PROFILE_DIR" && pnpm add "$PKG")
+  else
+    echo "错误：未找到 dsh 或 pnpm，无法安装。请先安装 DeepSeek Harness。"
+    exit 1
+  fi
+fi
+
+if [ -f "$PJ" ]; then
+  NEED=$(python3 - "$PJ" "$PKG" <<'PY' 2>/dev/null || echo "1"
+import json, sys
+d = json.load(open(sys.argv[1]))
+print("0" if sys.argv[2] in d.get("dsh", {}).get("profile", {}).get("bundles", []) else "1")
+PY
+)
+  if [ "$NEED" = "1" ]; then
+    echo "==> 注册 bundle：$PKG"
+    python3 - "$PJ" "$PKG" <<'PY'
+import json, sys
+p, pkg = sys.argv[1], sys.argv[2]
+d = json.load(open(p))
+d.setdefault("dsh", {}).setdefault("profile", {}).setdefault("bundles", []).append(pkg)
+json.dump(d, open(p, "w"), indent=2)
+print("已添加", pkg)
+PY
+  else
+    echo "==> bundle 已注册"
+  fi
+else
+  echo "警告：未找到 $PJ，请确认 profile 完整。"
+fi
+
+echo
+echo "✅ 安装完成！最后一步：重启 DeepSeek Harness（停止后重新运行 dsh web）。"
+echo "   重启后点击左侧「MCP连接器」，或在对话中输入「列出连接器」浏览货架。"
+echo "   详见：https://github.com/duhu2000/dsh-mcp-connector"

package/lib/callback-server.js

@@ -0,0 +1,92 @@
+/**
+ * Loopback 回调服务器（OAuth Native/Desktop 场景）
+ * 监听 127.0.0.1:{随机端口}/callback，接收授权页回跳的 code + state。
+ * 约束：先启动监听再打开授权页；收到回调后先校验 state；code 只使用一次。
+ */
+import { createServer } from 'node:http';
+
+export class CallbackTimeoutError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'CallbackTimeoutError';
+  }
+}
+
+/**
+ * 启动 loopback 回调监听。
+ * @returns {Promise<{port:number, url:string, waitForCallback:()=>Promise<{code:string,state:string}>, close:()=>Promise<void>}>}
+ */
+export async function startCallbackServer({ path = '/callback', port = 0, host = '127.0.0.1', timeoutMs = 300_000, signal } = {}) {
+  if (!path.startsWith('/')) path = `/${path}`;
+
+  let resolveCallback;
+  let rejectCallback;
+  const callbackPromise = new Promise((resolve, reject) => {
+    resolveCallback = resolve;
+    rejectCallback = reject;
+  });
+  callbackPromise.catch(() => {});
+
+  const onAbort = () => rejectCallback(new CallbackTimeoutError('callback wait aborted'));
+  if (signal) {
+    if (signal.aborted) onAbort();
+    else signal.addEventListener('abort', onAbort, { once: true });
+  }
+
+  const timer = setTimeout(() => {
+    rejectCallback(new CallbackTimeoutError(`no callback received within ${timeoutMs}ms`));
+  }, timeoutMs);
+
+  const server = createServer((req, res) => {
+    const requestUrl = new URL(req.url, `http://${host}:${port}`);
+    if (requestUrl.pathname === path) {
+      const code = requestUrl.searchParams.get('code');
+      const state = requestUrl.searchParams.get('state');
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end(
+        '<!doctype html><html><head><meta charset="utf-8"><title>MCP 连接器授权</title></head>' +
+        '<body style="font-family:system-ui;text-align:center;padding-top:80px">' +
+        '<h2>✅ 授权成功</h2><p>外部 MCP 已连接，可以关闭此页面并返回 DeepSeek Harness。</p>' +
+        '</body></html>',
+      );
+      if (code !== null && state !== null) {
+        resolveCallback({ code, state });
+      } else {
+        rejectCallback(new Error('callback missing code or state'));
+      }
+      return;
+    }
+    if (requestUrl.pathname === '/' || requestUrl.pathname === '/health') {
+      res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end('mcp-connector callback server is running');
+      return;
+    }
+    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('not found');
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(port, host, () => resolve());
+  });
+
+  const actualPort = server.address().port;
+  const url = `http://${host}:${actualPort}${path}`;
+
+  const close = () =>
+    new Promise((resolve) => {
+      clearTimeout(timer);
+      if (signal) signal.removeEventListener('abort', onAbort);
+      server.close(() => resolve());
+    });
+
+  const waitForCallback = async () => {
+    try {
+      return await callbackPromise;
+    } finally {
+      await close();
+    }
+  };
+
+  return { port: actualPort, url, waitForCallback, close };
+}