dsh-mcp-connector 0.2.18 → 0.2.19

package/CHANGELOG.md

@@ -4,6 +4,22 @@
 
 ## [Unreleased]
 
+## [0.2.19] - 2026-08-24
+
+### Fixed
+
+- 所有对话工具结果在交给 DSH Host 前统一转换为 lossless JSON，清理 `undefined`、非有限数字、`BigInt`、稀疏数组和循环引用，修复 Windows DSH Desktop 的 `value is not lossless JSON` 错误。
+- UI 静态文件路由不再使用平台相关的 `path.normalize` 处理 URL，Windows 下保持正斜杠语义并继续拒绝路径穿越，修复市场 iframe 返回 404。
+
+### Documentation
+
+- 中英文 README 更新为公共 Registry 61 条、与 4 张随包卡片合并后 65 张市场卡片的当前规模；重新采集市场总览并重建 16 秒演示 GIF。
+
+### Verification
+
+- 插件 94 项自动测试、lint、npm 发布文件白名单/敏感内容扫描和 `git diff --check` 通过。
+- 手动执行最新 Registry `main` 的 61 项健康巡检：60 项通过、1 项部分通过；44 个远程 MCP Server 全部可达并识别成功，28 个 stdio Server 按安全策略未执行本地命令。
+
 ## [0.2.18] - 2026-08-24
 
 ### Added
@@ -315,7 +331,8 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.18...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.19...HEAD
+[0.2.19]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.18...v0.2.19
 [0.2.18]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.17...v0.2.18
 [0.2.17]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.16...v0.2.17
 [0.2.16]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.15...v0.2.16

package/README.en.md

@@ -28,7 +28,7 @@ Browse and install MCP connectors from different providers in DeepSeek Harness D
 - A standalone remote Registry, allowing new marketplace cards to appear after refresh without publishing a new npm version.
 - Explicit, non-destructive migration of authorization from the two earlier Qichacha OAuth plugins.
 
-The first four bundled cards are Qichacha connectors, followed by PKULaw and Wind. After a remote Registry refresh, Yingmi, QVeris, Bazhuayu Cloud Collection, GitHub, Cloudflare, Notion, Tavily, and the Ace Data Cloud-hosted Seedream connector are also available, for 14 published marketplace cards after deduplication. Recommendations are limited to the four Qichacha cards, PKULaw, and Wind; all other connectors remain discoverable in their business categories.
+As of August 24, 2026, the public Registry publishes 61 connector descriptors. After merging and deduplicating them with the four bundled Qichacha cards, the Marketplace exposes 65 cards across nine business categories. Recommendations remain limited to the four Qichacha cards, PKULaw, and Wind, for six featured cards in total. The Registry can evolve independently, so the badge shown after a client refresh is the authoritative current count.
 
 ## Interface and demo
 
@@ -105,7 +105,7 @@ npm run dev:ui
 
 `npm run check` performs syntax checks, automated tests, and an npm package allowlist/sensitive-content audit. `npm run market:check` tracks the external DSH marketplace PR and live directory. Tags matching `v*` trigger GitHub Actions; the tag must match `package.json`. npm releases use Trusted Publishing through GitHub OIDC and do not require a long-lived `NPM_TOKEN`.
 
-The current public version is [`dsh-mcp-connector@0.2.18`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.18](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.18).
+The current public version is [`dsh-mcp-connector@0.2.19`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.19](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.19).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -30,7 +30,7 @@
 - 平滑迁移：显式扫描并复制两个旧企查查 OAuth 插件授权；不删除原插件或原凭据。
 - 对话工具：`mcp_connector_catalog`、`connect`、`configure`、`import_json`、`install_from_url`、`status`、`health_check`、`set_enabled`、`disconnect`、`refresh_catalog`、`publish`、`tools_list`。
 
-随包目录前 4 张为企查查连接器，另含“北大法宝·法律检索”和“Wind·股票数据”。远程 Registry 刷新后还会加入“盈米·基金投顾”、“QVerisMCP”、“八爪鱼·云采集”、GitHub、Cloudflare、Notion、Tavily 和由 Ace Data Cloud 托管的 Seedream，合并去重后当前共 14 张已发布市场卡片。推荐位严格保留 4 张企查查卡片、北大法宝和 Wind；其他连接器按业务分类展示。
+截至 2026-08-24，公共 Registry 已发布 61 条连接器描述；与随包的 4 张企查查卡片合并去重后，市场页可浏览 65 张卡片，覆盖企业数据、金融投资、法律合规、开发工具、办公协作、调研分析、设计创意、效率工具和其他 9 类。推荐位严格保留 4 张企查查卡片、北大法宝和 Wind，共 6 张；其他连接器按业务分类展示。Registry 可独立持续更新，实际数量以客户端刷新后的市场页签徽标为准。
 
 ## 界面与演示
 
@@ -100,7 +100,7 @@ npm run dev:ui
 
 `check` 执行语法检查、自动测试和 npm 发布包白名单校验；`market:check` 检查外部 DSH 市场 PR 与线上目录；`dev:ui` 启动不含真实凭据的本地 mock 市场。CI 使用 `--legacy-peer-deps` 安装显式测试依赖，DSH 运行期 peer 仍由 Host 提供。`v*` Tag 会触发 GitHub Actions；Tag 必须与 `package.json` 版本一致。Release 通过 npm Trusted Publishing (GitHub OIDC) 发布，不依赖长期 `NPM_TOKEN`。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.18`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.18](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.18)。
+当前公开版本为 [`dsh-mcp-connector@0.2.19`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.19](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.19)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/lib/tools.js

@@ -61,9 +61,46 @@ const statusOutput = {
 
 const noArgs = { type: 'object', properties: {}, additionalProperties: false };
 
+/**
+ * DSH tools require a lossless JSON value at the execute boundary. Normalize
+ * values that JSON.stringify would otherwise drop or rewrite, and always emit
+ * plain objects so transport-specific undefined fields cannot reject a tool
+ * result on stricter Desktop hosts.
+ */
+export function toLossless(value, seen = new Set()) {
+  if (value === null) return null;
+  const type = typeof value;
+  if (type === 'string' || type === 'boolean') return value;
+  if (type === 'number') {
+    if (!Number.isFinite(value)) return null;
+    return Object.is(value, -0) ? 0 : value;
+  }
+  if (type === 'undefined' || type === 'function' || type === 'symbol' || type === 'bigint') return null;
+  if (type !== 'object' || seen.has(value)) return null;
+
+  seen.add(value);
+  let output;
+  if (Array.isArray(value)) {
+    output = [];
+    for (let index = 0; index < value.length; index += 1) {
+      output[index] = Object.hasOwn(value, index) ? toLossless(value[index], seen) : null;
+    }
+  } else {
+    output = {};
+    for (const key of Object.keys(value)) output[key] = toLossless(value[key], seen);
+  }
+  seen.delete(value);
+  return output;
+}
+
 export function registerTools(ctx, api) {
   const disposers = [];
-  const reg = (def) => disposers.push(ctx.tools.register(def));
+  const reg = (def) => disposers.push(ctx.tools.register({
+    ...def,
+    async execute(args, exec) {
+      return toLossless(await def.execute(args, exec));
+    },
+  }));
 
   reg({
     name: 'mcp_connector_catalog',

package/lib/web.js

@@ -9,7 +9,7 @@
  * 本模块只依赖 ctx.webServer / ctx.webRuntime；在非 web 部署（无这两个服务）时
  * 调用方应跳过挂载，保证插件仍可用于纯对话工具场景。
  */
-import { dirname, join, normalize, relative, resolve } from 'node:path';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { readFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 
@@ -131,20 +131,26 @@ function extOf(pathname) {
 }
 
 /** 把 URL pathname 安全地映射到 ui 目录内的文件（防目录穿越）。 */
-function resolveUiFile(pathname) {
-  let rel;
+export function splitUiPath(pathname) {
+  let decoded;
   try {
-    rel = decodeURIComponent(pathname);
+    decoded = decodeURIComponent(pathname);
   } catch {
-    return { ok: false };
+    return undefined;
   }
-  rel = normalize(rel.replace(/\\/g, '/')).replace(/^\/+/, '');
-  if (rel === '.' || rel === '') return { ok: true, path: join(UI_DIR, 'index.html'), rel: 'index.html' };
-  if (rel.startsWith('..')) return { ok: false };
-  const abs = resolve(UI_DIR, rel);
+  const segments = decoded.replace(/\\/g, '/').split('/').filter((segment) => segment !== '' && segment !== '.');
+  if (segments.includes('..')) return undefined;
+  return segments;
+}
+
+export function resolveUiFile(pathname) {
+  const segments = splitUiPath(pathname);
+  if (segments === undefined) return { ok: false };
+  if (segments.length === 0) return { ok: true, path: join(UI_DIR, 'index.html'), rel: 'index.html' };
+  const abs = resolve(UI_DIR, ...segments);
   const relAbs = relative(UI_DIR, abs);
-  if (relAbs.startsWith('..') || relAbs === '') return { ok: false };
-  return { ok: true, path: abs, rel: relAbs };
+  if (relAbs === '..' || relAbs.startsWith(`..${sep}`) || isAbsolute(relAbs) || relAbs === '') return { ok: false };
+  return { ok: true, path: abs, rel: segments.join('/') };
 }
 
 /* ───────────────────────── 路由挂载 ───────────────────────── */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "description": "General-purpose MCP connector, connection manager, plugin extension, and integration marketplace for DeepSeek Harness, initiated and maintained by Qichacha/QCC.",
   "type": "module",
   "main": "lib/index.js",