dsh-mcp-connector 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -4,6 +4,29 @@
 
 ## [Unreleased]
 
+## [0.2.2] - 2026-08-21
+
+### Added
+
+- 新增英文版 README，便于国际用户了解安装、连接方式、市场目录和发布流程。
+
+### Changed
+
+- 产品名称和介绍统一为通用 MCP Connector Marketplace；企查查作为项目发起方、维护方和首批连接器提供方，不限定可接入厂商。
+- 重构 npm 关键词，保留 DSH、Cordis、MCP、OAuth/PKCE 和企查查检索入口，并补充 `dsh-plugin`、`mcp-client`、`oauth2`、`enterprise-data`。
+- 更新市场注册移交文档、测试数量和 awesome-dsh-plugin 注册描述，移除易过期的工具与 Prompt 数量。
+
+## [0.2.1] - 2026-08-21
+
+### Added
+
+- 上线独立公共 `dsh-mcp-connector-registry`，新市场卡片合并后无需重发 npm 即可被客户端刷新获取。
+- npm 发布流程切换为 GitHub Actions OIDC Trusted Publishing。
+
+### Changed
+
+- `catalogUrl` 默认指向公共 Registry，显式空字符串仍可关闭远程目录；拉取失败时保留缓存/内置目录回退。
+
 ## [0.2.0] - 2026-08-21
 
 ### Added
@@ -69,6 +92,8 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.2...HEAD
+[0.2.2]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.1...v0.2.2
+[0.2.1]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.1.0

package/README.en.md

@@ -0,0 +1,103 @@
+# MCP Connector Marketplace for DeepSeek Harness
+
+> A general-purpose MCP connector marketplace initiated and maintained by the Qichacha team
+
+Browse and install MCP connectors from different providers in DeepSeek Harness Desktop. Connect through OAuth, API key/URL configuration, JSON import, or a connector descriptor URL; discover tools, start a new conversation from an example prompt, and manage installed connections.
+
+[简体中文](README.md)
+
+[![CI](https://github.com/duhu2000/dsh-mcp-connector/actions/workflows/ci.yml/badge.svg)](https://github.com/duhu2000/dsh-mcp-connector/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/dsh-mcp-connector.svg)](https://www.npmjs.com/package/dsh-mcp-connector)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+## Features
+
+- A primary sidebar entry below New Conversation and above workspaces/conversations, with a public footer-slot fallback for incompatible DSH DOM versions.
+- Searchable Marketplace and Installed views with connection status and catalog refresh.
+- OAuth 2.0 Authorization Code with PKCE, API key/Bearer/unauthenticated URL configuration, and `mcpServers` JSON import.
+- Installation from a credential-free connector descriptor URL.
+- Credential and MCP initialize validation before API-key connectors are saved as installed.
+- Dynamic tool discovery grouped by MCP server, including descriptions, search, batched rendering, and an independent scroll region.
+- Curated prompt templates that can open a DSH conversation and prefill its draft; missing variables are requested before the prompt is sent.
+- Persistent connection lifecycle management: restore on restart, enable/disable, disconnect, refresh OAuth tokens, and revoke authorization.
+- Built-in, remote, and local catalogs with `published` and `featured` controls.
+- A standalone remote Registry, allowing new marketplace cards to appear after refresh without publishing a new npm version.
+- Explicit, non-destructive migration of authorization from the two earlier Qichacha OAuth plugins.
+
+The first four bundled cards are Qichacha connectors. The public catalog also includes PKULaw and Wind connectors; the architecture is provider-neutral.
+
+## Installation
+
+Requirements: DeepSeek Harness Desktop or web profile, and Node.js 20 or later.
+
+```bash
+dsh plugin --profile web add dsh-mcp-connector
+```
+
+Or use the installer:
+
+```bash
+bash <(curl -fsSL https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/install.sh)
+```
+
+Fully quit and restart DeepSeek Harness Desktop after installation or upgrade.
+
+## Usage
+
+1. Select **MCP Connector** in the primary sidebar.
+2. Choose a connector in Marketplace and complete authorization or configuration.
+3. Open its details to inspect tools or send an example prompt to a new conversation draft.
+4. Use Installed or the conversation tools to enable, disable, inspect, or disconnect a connection.
+
+Connected tools are exposed to the model with the `mcp__<serverName>__*` prefix.
+
+## Connector catalog
+
+The package contains a bundled fallback catalog. By default, it refreshes from the public [dsh-mcp-connector-registry](https://github.com/duhu2000/dsh-mcp-connector-registry); cached or bundled data remains available if the remote registry cannot be reached.
+
+The public connector registration process and descriptor requirements are documented in [docs/MARKET-REGISTRATION.md](docs/MARKET-REGISTRATION.md).
+
+## Configuration
+
+The default bundle configuration is in `cordis.patch.yml`:
+
+```yaml
+- id: mcp-connector
+  name: dsh-mcp-connector
+  config:
+    catalogUrl: 'https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector-registry/main/catalog.json'
+    persistSecrets: true
+    entryPrefix: mcp
+    refreshSkewMs: 300000
+    openBrowser: true
+```
+
+Set `catalogUrl` to an empty string for an explicitly offline/private setup.
+
+## Development and release checks
+
+```bash
+npm run check
+npm run registry:build
+npm run registry:validate
+npm run dev:ui
+```
+
+`npm run check` performs syntax checks, automated tests, and an npm package allowlist/sensitive-content audit. Tags matching `v*` trigger GitHub Actions; the tag must match `package.json`. npm releases use Trusted Publishing through GitHub OIDC and do not require a long-lived `NPM_TOKEN`.
+
+The current public version is [`dsh-mcp-connector@0.2.2`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.2](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.2).
+
+See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
+
+## Security and limitations
+
+- Credentials are stored only in the DSH storage domain and are not written to the catalog, Git repository, or conversation history.
+- Failed API key/token validation is not persisted; authentication, timeout, DNS, and TLS/network errors are reported separately.
+- External URLs must use HTTPS; HTTP is allowed only for loopback development.
+- Remote descriptors and catalogs are limited to 2 MiB, Web API requests to 1 MiB, and imported JSON is scanned for credential fields before normalization.
+- Streamable HTTP is the primary transport with SSE compatibility. stdio entries are explicitly skipped.
+- The primary sidebar placement uses the stable DSH `data-slot` marker and falls back to the footer if that marker is removed.
+
+## License
+
+MIT

package/README.md

@@ -1,6 +1,10 @@
-# MCP连接器（DeepSeek Harness 插件）
+# MCP 连接器市场（DeepSeek Harness 插件）
 
-在 DeepSeek Harness Desktop 中提供类似 WorkBuddy 的 MCP 连接器市场与连接管理：浏览连接器、OAuth 授权、查看工具、快速发起对话，并管理已安装连接。
+> 通用 MCP Connector Marketplace，由企查查团队发起并维护
+
+在 DeepSeek Harness Desktop 中浏览和安装不同厂商的 MCP 连接器，通过 OAuth、API Key/URL 或 JSON 接入服务，发现工具、使用示例 Prompt 发起新会话，并管理已安装连接。
+
+[English](README.en.md)
 
 [![CI](https://github.com/duhu2000/dsh-mcp-connector/actions/workflows/ci.yml/badge.svg)](https://github.com/duhu2000/dsh-mcp-connector/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/dsh-mcp-connector.svg)](https://www.npmjs.com/package/dsh-mcp-connector)
@@ -17,6 +21,7 @@
 - 市场 Bearer/API Key 连接器先执行 MCP initialize 连通性与凭据校验，全部 Server 通过后才持久化凭据并进入“已安装”。
 - 生命周期管理：连接持久化、重启恢复、启停、断开、OAuth 刷新与撤销。
 - 目录运营：内置目录、远程 registry、本地覆盖，支持 `published` 上下架与 `featured` 精选。
+- 独立远程 Registry：新市场卡片合并后客户端刷新即可见，无需重新发布 npm；远程不可用时自动回退内置目录。
 - Registry 工具链：Schema/唯一性/密钥审计、MCP/OAuth 无凭据探针、每周健康巡检。
 - 平滑迁移：显式扫描并复制两个旧企查查 OAuth 插件授权；不删除原插件或原凭据。
 - 对话工具：`mcp_connector_catalog`、`connect`、`configure`、`import_json`、`install_from_url`、`status`、`set_enabled`、`disconnect`、`refresh_catalog`、`publish`、`tools_list`。
@@ -56,13 +61,15 @@ Bundle 默认配置位于 `cordis.patch.yml`：
 - id: mcp-connector
   name: dsh-mcp-connector
   config:
-    catalogUrl: ''
+    catalogUrl: 'https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector-registry/main/catalog.json'
     persistSecrets: true
     entryPrefix: mcp
     refreshSkewMs: 300000
     openBrowser: true
 ```
 
+`catalogUrl` 默认指向公共 [dsh-mcp-connector-registry](https://github.com/duhu2000/dsh-mcp-connector-registry)，支持 ETag/TTL 缓存；拉取失败时继续使用上次缓存或随包内置目录。需要离线/私有模式时可将其显式设为空字符串。
+
 ## 开发与发布门禁
 
 ```bash
@@ -72,9 +79,9 @@ npm run registry:validate
 npm run dev:ui
 ```
 
-`check` 执行语法检查、自动测试和 npm 发布包白名单校验；`dev:ui` 启动不含真实凭据的本地 mock 市场。CI 使用 `--legacy-peer-deps` 安装显式测试依赖，DSH 运行期 peer 仍由 Host 提供。`v*` Tag 会触发 GitHub Actions；Tag 必须与 `package.json` 版本一致。仓库配置 `NPM_TOKEN` 后自动发布 npm，否则只创建 GitHub Release。
+`check` 执行语法检查、自动测试和 npm 发布包白名单校验；`dev:ui` 启动不含真实凭据的本地 mock 市场。CI 使用 `--legacy-peer-deps` 安装显式测试依赖，DSH 运行期 peer 仍由 Host 提供。`v*` Tag 会触发 GitHub Actions；Tag 必须与 `package.json` 版本一致。Release 通过 npm Trusted Publishing (GitHub OIDC) 发布，不依赖长期 `NPM_TOKEN`。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.0`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.0](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.0)。
+当前公开版本为 [`dsh-mcp-connector@0.2.2`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.2](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.2)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/cordis.patch.yml

@@ -5,7 +5,7 @@
     - id: mcp-connector
       name: 'dsh-mcp-connector'
       config:
-        catalogUrl: ''
+        catalogUrl: 'https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector-registry/main/catalog.json'
         persistSecrets: true
         entryPrefix: 'mcp'
         refreshSkewMs: 300000

package/docs/MARKET-REGISTRATION.md

@@ -20,12 +20,12 @@ Bearer/API Key 型连接器可在卡片上点「配置」，一次填写凭据
 
 ## 3. 提交公共市场
 
-1. 在 `registry/connectors/<id>.json` 新增一个描述文件，一个连接器一个文件。
-2. 运行 `npm run registry:build` 和 `npm run registry:validate`。
+1. Fork 公开仓库 [`duhu2000/dsh-mcp-connector-registry`](https://github.com/duhu2000/dsh-mcp-connector-registry)，在 `connectors/<id>.json` 新增一个描述文件，一个连接器一个文件。
+2. 运行 `npm install --legacy-peer-deps` 和 `npm run check`。
 3. 提交 PR。CI 会检查 Schema、重复 id/serverName、密钥、URL、MCP initialize、OAuth 元数据和图标。
-4. 合并后生成远程 `catalog.json`；客户端刷新目录后可见。
+4. 合并后 CI 重建根目录 `catalog.json`；客户端点击“刷新”后可见，无需重新发布 `dsh-mcp-connector` npm 包。
 
-公开 registry 独立仓库未拆分前，先向 `duhu2000/dsh-mcp-connector` 开发分支提交描述；拆分后流程不变。
+插件默认读取 `https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector-registry/main/catalog.json`；远程不可用时自动回退上次缓存或随包内置目录。
 
 ## 4. OAuth 一键授权要求
 

package/lib/constants.js

@@ -17,6 +17,8 @@ export const JSON_CONNECTOR_ID = '__json__';
 export const RESERVED_ID_PREFIXES = ['qcc-', 'dsh-', 'mcp-connector-'];
 
 /** 请求 / 刷新默认值 */
+export const DEFAULT_CATALOG_URL =
+  'https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector-registry/main/catalog.json';
 export const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
 export const DEFAULT_REFRESH_SKEW_MS = 300_000;
 export const DEFAULT_CATALOG_TTL_MS = 3_600_000;

package/lib/index.js

@@ -12,6 +12,7 @@
 import z from '@deepseek-ai/schemastery';
 import {
   DEFAULT_ACCOUNT,
+  DEFAULT_CATALOG_URL,
   DEFAULT_REQUEST_TIMEOUT_MS,
   DEFAULT_REFRESH_SKEW_MS,
   DEFAULT_CATALOG_TTL_MS,
@@ -35,8 +36,8 @@ export const name = 'mcp-connector';
 export const inject = ['tools', 'storageDomain', 'loader'];
 
 export const Config = z.object({
-  /** 远程目录 URL（空 = 仅内置目录） */
-  catalogUrl: z.string().default(''),
+  /** 远程目录 URL（默认公共 registry；显式空字符串 = 仅内置目录） */
+  catalogUrl: z.string().default(DEFAULT_CATALOG_URL),
   /** 远程目录缓存 TTL（ms） */
   catalogTtlMs: z.number().default(DEFAULT_CATALOG_TTL_MS),
   /** 额外注入的连接器描述（ops/测试用，优先级高于远程 registry） */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.0",
-  "description": "DeepSeek Harness 插件：MCP连接器 —— 连接器目录与上架、通用 OAuth / 自定义 / JSON 三通道连接外部 MCP Server / MCP Connector marketplace & connection manager",
+  "version": "0.2.2",
+  "description": "General-purpose MCP Connector Marketplace for DeepSeek Harness with OAuth 2.0 PKCE, API key/URL, JSON import, tool discovery, prompt templates, and connection management.",
   "type": "module",
   "main": "lib/index.js",
   "exports": {
@@ -21,6 +21,7 @@
     "docs/MARKET-REGISTRATION.md",
     "cordis.patch.yml",
     "README.md",
+    "README.en.md",
     "CHANGELOG.md",
     "LICENSE",
     "install.sh",
@@ -41,12 +42,22 @@
   "keywords": [
     "deepseek-harness",
     "dsh",
+    "dsh-plugin",
     "cordis",
     "mcp",
+    "mcp-client",
+    "mcp-connector",
     "connector",
+    "marketplace",
     "oauth",
+    "oauth2",
     "pkce",
-    "marketplace"
+    "json-import",
+    "enterprise-data",
+    "qichacha",
+    "qcc",
+    "tools",
+    "prompts"
   ],
   "license": "MIT",
   "publishConfig": {