dsh-mcp-connector 0.2.23 → 0.2.24

package/CHANGELOG.md

@@ -4,6 +4,20 @@
 
 ## [Unreleased]
 
+## [0.2.24] - 2026-08-27
+
+### Added
+
+- MCP连接器标题显示当前插件版本，并由服务端缓存检查 npm `latest` 与 GitHub Release；发现新版本时引导用户前往 DSH 插件市场安全更新。
+
+### Changed
+
+- 市场页原“刷新”按钮改为“刷新连接器目录”，明确该操作仅更新 Registry 卡片，不会升级插件本身。
+
+### Verification
+
+- 123 项自动测试、lint、npm 发布包白名单/敏感内容扫描和 npm/GitHub 真实版本源验收通过。
+
 ## [0.2.23] - 2026-08-26
 
 ### Fixed
@@ -385,7 +399,8 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.23...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.24...HEAD
+[0.2.24]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.23...v0.2.24
 [0.2.23]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.22...v0.2.23
 [0.2.22]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.21...v0.2.22
 [0.2.21]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.20...v0.2.21

package/README.en.md

@@ -28,6 +28,7 @@ Browse and install MCP connectors from different providers in DeepSeek Harness D
 - Persistent connection lifecycle management: restore on restart, enable/disable, disconnect, retry transient OAuth refresh failures with bounded backoff, and revoke authorization. Cards declaring issuer-level sharing reuse one grant; DCR client secrets remain local to that grant.
 - Built-in, remote, and local catalogs with `published` and `featured` controls.
 - A standalone remote Registry, allowing new marketplace cards to appear after refresh without publishing a new npm version.
+- Plugin version awareness: the MCP Connector title shows the installed version, while a server-side cached check compares npm `latest` with GitHub Releases and routes available updates through the DSH plugin marketplace.
 - Explicit, non-destructive migration from the two earlier Qichacha OAuth plugins, plus active-plugin conflict detection that blocks duplicate server management and credential overwrites.
 
 <!-- catalog-stats:start -->
@@ -111,7 +112,7 @@ npm run dev:ui
 
 Every Registry merge regenerates `catalog-stats.json`; an hourly workflow in this repository synchronizes the Chinese and English product copy plus a local stats snapshot. The static npm README updates with package releases, while the live badges above read the Registry directly and therefore stay current without another npm release.
 
-The current public version is [`dsh-mcp-connector@0.2.22`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.22](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.22).
+The current public version is [`dsh-mcp-connector@0.2.24`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.24](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.24).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -28,6 +28,7 @@
 - 生命周期管理：连接持久化、重启恢复、启停、断开、OAuth 自动刷新/退避恢复与撤销；同 issuer 卡片可共享一次授权，DCR 返回的客户端密钥与 Token 一同只保存在本机。
 - 目录运营：内置目录、远程 registry、本地覆盖，支持 `published` 上下架与 `featured` 精选。
 - 独立远程 Registry：新市场卡片合并后客户端刷新即可见，无需重新发布 npm；远程不可用时自动回退内置目录。
+- 插件版本感知：MCP连接器标题显示当前版本，服务端缓存检查 npm 与 GitHub Release；发现 npm 新版本时引导到 DSH 插件市场更新。
 - Registry 工具链：Schema/唯一性/密钥审计、MCP/OAuth 无凭据探针、每周健康巡检。
 - 平滑迁移：显式扫描并复制两个旧企查查 OAuth 插件授权；检测到旧插件仍启用并管理同名 Server 时阻断重复连接，避免凭据相互覆盖。
 - 对话工具：`mcp_connector_catalog`、`connect`、`configure`、`import_json`、`install_from_url`、`status`、`health_check`、`set_enabled`、`disconnect`、`refresh_catalog`、`publish`、`tools_list`。
@@ -106,7 +107,7 @@ npm run dev:ui
 
 公共 Registry 每次合并后会生成 `catalog-stats.json`；本仓库的定时工作流每小时同步中英文介绍和统计快照。npm 页面中的静态正文随版本发布更新，上方动态统计徽标则直接读取 Registry，可在不发布新 npm 版本时保持实时数量一致。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.22`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.22](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.22)。
+当前公开版本为 [`dsh-mcp-connector@0.2.24`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.24](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.24)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/docs/USER-GUIDE.md

@@ -42,7 +42,8 @@ dsh web
 - **已安装**：查看已经保存到本机的连接，页签徽标显示连接数。
 - **搜索**：按名称、服务商、简介和标签查找。
 - **添加连接**：导入 JSON、手动配置 HTTP/stdio，或从市场描述 URL 安装。
-- **刷新**：重新拉取目录，并更新连接健康状态。
+- **版本与更新提示**：标题旁显示当前插件版本。检测到 npm 有新版本时，点击更新提示前往 DSH 插件市场执行安全升级；升级后按页面提示完全重启 DSH。
+- **刷新连接器目录**：重新拉取 Registry 卡片，并更新连接健康状态；该操作不会升级 MCP连接器插件本身。
 
 ## 3. 浏览市场与分类
 
@@ -64,7 +65,7 @@ dsh web
 | `配置` | 需要 Bearer Token 或 API Key | 录入服务商签发的凭据并验证 |
 | `需重新授权` | OAuth 授权过期、被撤销或不可用 | 点击后重新完成 OAuth 授权 |
 | `自动重试中` | OAuth Token 刷新遇到网络或服务端暂时故障 | 无需重新授权；保持 DSH 运行，插件会按退避策略自动恢复 |
-| `已配置` | 本机已有配置，尚未完成本轮健康确认 | 点击“刷新”或进入详情检查 |
+| `已配置` | 本机已有配置，尚未完成本轮健康确认 | 点击“刷新连接器目录”或进入详情检查 |
 | `已连接` | 最近一次健康检查通过 | 可直接在会话中使用对应 MCP 工具 |
 | `部分异常` / `连接异常` | 一个或多个 Server 未通过检查 | 打开详情查看提示，核对网络、权限和服务状态 |
 
@@ -140,7 +141,7 @@ stdio 进程由 `@deepseek-ai/dsh-mcp-client` 管理，插件透传 `command`、
 - 执行健康检查；
 - 断开连接并删除该连接的本机配置。
 
-OAuth 断开时，插件会尽力调用服务商的撤销端点；无撤销端点时仍会删除 DSH 本机授权记录。连接状态发生变化后，可点击“刷新”重新检查。
+OAuth 断开时，插件会尽力调用服务商的撤销端点；无撤销端点时仍会删除 DSH 本机授权记录。连接状态发生变化后，可点击“刷新连接器目录”重新检查。
 
 ## 8. 安全边界
 
@@ -160,7 +161,7 @@ OAuth 断开时，插件会尽力调用服务商的撤销端点；无撤销端
 
 ### 市场里没有最新卡片
 
-点击“刷新”。如果远程 Registry 暂时不可用，页面会继续显示缓存或内置目录；稍后恢复网络再刷新即可。
+点击“刷新连接器目录”。如果远程 Registry 暂时不可用，页面会继续显示缓存或内置目录；稍后恢复网络再刷新即可。
 
 ### Token/API Key 一直验证失败
 

package/lib/client.js

@@ -19,6 +19,9 @@ window.__ModuleLoader__.load({
 		];
 		const PROMPT_REQUEST_TYPE = "mcp-connector:start-session";
 		const PROMPT_RESULT_TYPE = "mcp-connector:start-session-result";
+		const VERSION_CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
+		const VERSION_CHECK_RETRY_MS = 5 * 60 * 1e3;
+		const NPM_PACKAGE_URL = "https://www.npmjs.com/package/dsh-mcp-connector";
 
 		/**
 		 * Desktop 内置的社区插件市场也注册在 sidebar.footer.action。
@@ -86,6 +89,31 @@ window.__ModuleLoader__.load({
 .mcpConnectorMarketPanel { background: #ffffff; color: #111827; }
 .mcpConnectorMarketHeader { border-color: #e5e7eb; }
 .mcpConnectorMarketTitle { color: #111827; }
+.mcpConnectorVersion {
+	color: #6b7280;
+	background: #f3f4f6;
+	border-radius: 999px;
+	padding: 2px 8px;
+	font-size: 12px;
+	font-weight: 600;
+}
+.mcpConnectorUpdateButton {
+	color: #4338ca;
+	background: #eef2ff;
+	border: 1px solid #c7d2fe;
+	border-radius: 8px;
+	padding: 5px 9px;
+	font: inherit;
+	font-size: 12px;
+	font-weight: 600;
+	cursor: pointer;
+}
+.mcpConnectorUpdateButton:hover,
+.mcpConnectorUpdateButton:focus-visible {
+	background: #e0e7ff;
+	outline: 2px solid #6366f1;
+	outline-offset: 1px;
+}
 .mcpConnectorMarketClose { color: #6b7280; }
 .mcpConnectorMarketClose:hover,
 .mcpConnectorMarketClose:focus-visible {
@@ -99,6 +127,10 @@ window.__ModuleLoader__.load({
 	.mcpConnectorMarketPanel { background: #1b1e25; color: #f3f4f6; }
 	.mcpConnectorMarketHeader { border-color: #30343d; }
 	.mcpConnectorMarketTitle { color: #f3f4f6; }
+	.mcpConnectorVersion { color: #d1d5db; background: #30343d; }
+	.mcpConnectorUpdateButton { color: #c7d2fe; background: #312e81; border-color: #4f46e5; }
+	.mcpConnectorUpdateButton:hover,
+	.mcpConnectorUpdateButton:focus-visible { background: #3730a3; }
 	.mcpConnectorMarketClose { color: #c4c8d0; }
 	.mcpConnectorMarketClose:hover,
 	.mcpConnectorMarketClose:focus-visible { background: #30343d !important; color: #ffffff; }
@@ -135,6 +167,50 @@ window.__ModuleLoader__.load({
 			return mount;
 		}
 
+		async function fetchVersionStatus() {
+			const response = await window.fetch("/mcp-connector/api", {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({ method: "versionStatus", params: {} })
+			});
+			const result = await response.json();
+			if (!response.ok || result.ok !== true || result.detail === void 0) {
+				throw new Error(result.message ?? `HTTP ${response.status}`);
+			}
+			return result.detail;
+		}
+
+		/**
+		 * DSH 暂未公开“打开指定设置分区”服务：只依赖稳定的 sidebar.settings
+		 * slot 和可访问文本打开插件市场，不依赖构建生成的 CSS 类名。
+		 */
+		function openDshPluginMarket(actions) {
+			const settingsHost = document.querySelector('[data-slot="sidebar.settings"]');
+			const settingsTrigger = settingsHost?.querySelector?.('button[aria-haspopup="dialog"]');
+			if (settingsTrigger === null || settingsTrigger === void 0) {
+				window.open(NPM_PACKAGE_URL, "_blank", "noopener,noreferrer");
+				return;
+			}
+			actions.close();
+			window.setTimeout(() => {
+				settingsTrigger.click();
+				let attempts = 0;
+				const selectMarket = () => {
+					const marketButton = [...document.querySelectorAll('[role="dialog"] nav button')].find((button) => {
+						const label = button.textContent?.trim() ?? "";
+						return /^(\u63d2\u4ef6\u5e02\u573a|Plugin Market|Plugin Marketplace)$/i.test(label);
+					});
+					if (marketButton !== void 0) {
+						marketButton.click();
+						return;
+					}
+					attempts += 1;
+					if (attempts < 20) window.setTimeout(selectMarket, 50);
+				};
+				window.requestAnimationFrame(selectMarket);
+			}, 0);
+		}
+
 		/** 创建弹框 store（使用 DSH defineStore，与社区插件市场一致）。 */
 		function createMarketViewStore() {
 			return (0, _deepseek_ai_dsh_client_runtime_client.defineStore)({
@@ -181,6 +257,7 @@ window.__ModuleLoader__.load({
 			const { wide, useStore, actions, startPromptSession: launchPromptSession } = props;
 			const open = useStore((state) => state.open);
 			const detailOpen = useStore((state) => state.detailOpen);
+			const [versionStatus, setVersionStatus] = (0, react.useState)(null);
 			const frameRef = (0, react.useRef)(null);
 			const closeRef = (0, react.useRef)(null);
 			(0, react.useEffect)(() => {
@@ -219,6 +296,38 @@ window.__ModuleLoader__.load({
 				window.addEventListener("message", onMessage);
 				return () => { window.removeEventListener("message", onMessage); };
 			}, [actions, launchPromptSession]);
+			(0, react.useEffect)(() => {
+				if (!open) return void 0;
+				let disposed = false;
+				let pollTimer;
+				const schedule = (delayMs) => {
+					window.clearTimeout(pollTimer);
+					pollTimer = window.setTimeout(check, Math.max(1e3, delayMs));
+				};
+				const check = () => {
+					fetchVersionStatus().then((status) => {
+						if (disposed) return;
+						setVersionStatus(status);
+						if (status.checking) {
+							schedule(1e3);
+							return;
+						}
+						const nextCheckAt = Date.parse(status.nextCheckAt ?? "");
+						const delay = Number.isFinite(nextCheckAt)
+							? Math.min(VERSION_CHECK_INTERVAL_MS, nextCheckAt - Date.now())
+							: VERSION_CHECK_INTERVAL_MS;
+						schedule(delay);
+					}, (error) => {
+						console.warn("[mcp-connector] plugin update check failed:", error);
+						if (!disposed) schedule(VERSION_CHECK_RETRY_MS);
+					});
+				};
+				check();
+				return () => {
+					disposed = true;
+					window.clearTimeout(pollTimer);
+				};
+			}, [open]);
 			(0, react.useEffect)(() => {
 				if (!open) return void 0;
 				closeRef.current?.focus?.();
@@ -273,7 +382,24 @@ window.__ModuleLoader__.load({
 										style: { display: "flex", alignItems: "center", gap: 10 },
 										children: [
 											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { style: { fontSize: 22 }, children: "\u{1F9E9}" }),
-										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { id: "mcp-connector-market-title", className: "mcpConnectorMarketTitle", style: { fontSize: 18, fontWeight: 600 }, children: "MCP连接器" })
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { id: "mcp-connector-market-title", className: "mcpConnectorMarketTitle", style: { fontSize: 18, fontWeight: 600 }, children: "MCP连接器" }),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "mcpConnectorVersion",
+												title: versionStatus === null ? "正在检查插件版本" : `当前版本 v${versionStatus.installedVersion}`,
+												children: versionStatus === null ? "v…" : `v${versionStatus.installedVersion}`
+											}),
+											versionStatus?.updateAvailable && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+												type: "button",
+												className: "mcpConnectorUpdateButton",
+												title: `npm 已发布 v${versionStatus.latestVersion}`,
+												onClick: () => openDshPluginMarket(actions),
+												children: `前往插件市场更新到 v${versionStatus.latestVersion}`
+											}),
+											versionStatus?.releasePending && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "mcpConnectorVersion",
+												title: "GitHub Release 已发布，等待 npm 同步后即可更新",
+												children: `v${versionStatus.release.version} 正在同步`
+											})
 										]
 									}),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {

package/lib/index.js

@@ -33,6 +33,7 @@ import { classifyConnectionError, validateConnectionRecords } from './mcp-valida
 import { listMcpTools, McpHttpError } from './mcp-http.js';
 import { registerTools } from './tools.js';
 import { mountWebRoutes } from './web.js';
+import { createVersionStatusService } from './version-status.js';
 import { assertSafeUrl } from './util.js';
 import { readLegacyGrantCandidates, planLegacyMigration, toConnectorGrant, toConnectionRecords } from './migration.js';
 import { classifyRefreshFailure, refreshRetryDelay } from './grant-lifecycle.js';
@@ -83,6 +84,10 @@ export const Config = z.object({
 
 export async function apply(ctx, config) {
   const logger = ctx.logger('mcp-connector');
+  const versionStatusService = createVersionStatusService({
+    timeoutMs: config.requestTimeoutMs,
+    logger,
+  });
 
   const domain = await ctx.storageDomain.open(defineConnectorDomain());
   ctx.effect(() => () => {
@@ -856,6 +861,17 @@ export async function apply(ctx, config) {
   /* ───────────────────────── api 门面 ───────────────────────── */
 
   const api = {
+    async versionStatus(force = false) {
+      const detail = versionStatusService.status({ force });
+      let message = `当前版本 v${detail.installedVersion}`;
+      if (detail.checking) message += '，正在检查更新';
+      else if (detail.updateAvailable) message += `，可更新到 v${detail.latestVersion}`;
+      else if (detail.releasePending) message += '，新版本正在同步到 npm';
+      else if (detail.status === 'unavailable') message += '，暂时无法检查更新';
+      else message += '，已是 npm 最新版';
+      return { ok: true, message, detail };
+    },
+
     async catalog({ category, keyword } = {}) {
       const items = listCatalog(state.merged, { category, keyword, publishedOnly: true }).map((d) => {
         const health = connectorHealth(d.id);
@@ -1640,6 +1656,7 @@ export async function apply(ctx, config) {
   ctx.effect(() => () => {
     disposeTools();
     disposeWeb?.();
+    versionStatusService.dispose();
     for (const g of state.grants.values()) if (g.timer) clearTimeout(g.timer);
   });
 

package/lib/version-status.js

@@ -0,0 +1,216 @@
+import { readFileSync } from 'node:fs';
+
+const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+
+export const INSTALLED_PLUGIN_VERSION = packageJson.version;
+export const NPM_LATEST_URL = 'https://registry.npmjs.org/dsh-mcp-connector/latest';
+export const NPM_PACKAGE_URL = 'https://www.npmjs.com/package/dsh-mcp-connector';
+export const GITHUB_LATEST_RELEASE_URL = 'https://api.github.com/repos/duhu2000/dsh-mcp-connector/releases/latest';
+export const GITHUB_RELEASES_URL = 'https://github.com/duhu2000/dsh-mcp-connector/releases';
+export const VERSION_CHECK_TTL_MS = 6 * 60 * 60 * 1000;
+export const VERSION_CHECK_FAILURE_TTL_MS = 5 * 60 * 1000;
+
+function normalizeVersion(value) {
+  if (typeof value !== 'string') return undefined;
+  const normalized = value.trim().replace(/^v/i, '');
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(normalized)
+    ? normalized
+    : undefined;
+}
+
+function parseVersion(value) {
+  const normalized = normalizeVersion(value);
+  if (!normalized) return undefined;
+  const [withoutBuild] = normalized.split('+');
+  const [core, prerelease] = withoutBuild.split('-', 2);
+  return {
+    normalized,
+    core: core.split('.').map(Number),
+    prerelease: prerelease?.split('.') ?? [],
+  };
+}
+
+/** Compare two semantic versions. Returns a positive number when `left` is newer. */
+export function compareVersions(left, right) {
+  const a = parseVersion(left);
+  const b = parseVersion(right);
+  if (!a || !b) return 0;
+  for (let index = 0; index < 3; index += 1) {
+    if (a.core[index] !== b.core[index]) return a.core[index] - b.core[index];
+  }
+  if (a.prerelease.length === 0 && b.prerelease.length > 0) return 1;
+  if (a.prerelease.length > 0 && b.prerelease.length === 0) return -1;
+  const length = Math.max(a.prerelease.length, b.prerelease.length);
+  for (let index = 0; index < length; index += 1) {
+    const aPart = a.prerelease[index];
+    const bPart = b.prerelease[index];
+    if (aPart === undefined) return -1;
+    if (bPart === undefined) return 1;
+    if (aPart === bPart) continue;
+    const aNumeric = /^\d+$/.test(aPart);
+    const bNumeric = /^\d+$/.test(bPart);
+    if (aNumeric && bNumeric) return Number(aPart) - Number(bPart);
+    if (aNumeric) return -1;
+    if (bNumeric) return 1;
+    return aPart.localeCompare(bPart);
+  }
+  return 0;
+}
+
+export function isVersionNewer(candidate, installed) {
+  return compareVersions(candidate, installed) > 0;
+}
+
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+async function fetchJson(fetchImpl, url, { timeoutMs, headers, activeControllers }) {
+  const controller = new AbortController();
+  activeControllers.add(controller);
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(url, {
+      method: 'GET',
+      headers: {
+        accept: 'application/json',
+        'user-agent': `dsh-mcp-connector/${INSTALLED_PLUGIN_VERSION}`,
+        ...headers,
+      },
+      signal: controller.signal,
+    });
+    if (!response?.ok) throw new Error(`HTTP ${response?.status ?? 'unknown'}`);
+    return await response.json();
+  } finally {
+    clearTimeout(timer);
+    activeControllers.delete(controller);
+  }
+}
+
+/**
+ * Check npm and GitHub without exposing those origins to the iframe CSP.
+ * npm `latest` is the update authority; GitHub is supplemental release metadata.
+ */
+export function createVersionStatusService({
+  installedVersion = INSTALLED_PLUGIN_VERSION,
+  fetchImpl = globalThis.fetch,
+  timeoutMs = 15_000,
+  cacheTtlMs = VERSION_CHECK_TTL_MS,
+  failureTtlMs = VERSION_CHECK_FAILURE_TTL_MS,
+  now = () => Date.now(),
+  logger,
+} = {}) {
+  let cached;
+  let expiresAt = 0;
+  let inFlight;
+  const activeControllers = new Set();
+
+  async function query() {
+    const checkedAtMs = now();
+    const [npmResult, githubResult] = await Promise.allSettled([
+      fetchJson(fetchImpl, NPM_LATEST_URL, { timeoutMs, activeControllers }),
+      fetchJson(fetchImpl, GITHUB_LATEST_RELEASE_URL, {
+        timeoutMs,
+        activeControllers,
+        headers: { accept: 'application/vnd.github+json' },
+      }),
+    ]);
+
+    const npmVersion = npmResult.status === 'fulfilled' ? normalizeVersion(npmResult.value?.version) : undefined;
+    const githubVersion = githubResult.status === 'fulfilled' ? normalizeVersion(githubResult.value?.tag_name) : undefined;
+    const npmOk = npmVersion !== undefined;
+    const githubOk = githubVersion !== undefined;
+    const errors = [];
+    if (!npmOk) errors.push(`npm: ${npmResult.status === 'rejected' ? errorMessage(npmResult.reason) : '返回了无效版本'}`);
+    if (!githubOk) errors.push(`GitHub: ${githubResult.status === 'rejected' ? errorMessage(githubResult.reason) : '返回了无效版本'}`);
+    if (errors.length > 0) logger?.warn?.(`plugin update check partial failure: ${errors.join('; ')}`);
+
+    const updateAvailable = npmOk && isVersionNewer(npmVersion, installedVersion);
+    const releasePending = githubOk && isVersionNewer(githubVersion, installedVersion)
+      && (!npmOk || isVersionNewer(githubVersion, npmVersion));
+    const status = npmOk && githubOk ? 'ok' : (npmOk || githubOk ? 'partial' : 'unavailable');
+    // npm is authoritative for an actionable update. A GitHub-only failure must not
+    // turn into a five-minute retry loop against the unauthenticated GitHub API.
+    const resultTtlMs = npmOk ? cacheTtlMs : failureTtlMs;
+    const result = {
+      installedVersion,
+      latestVersion: npmVersion ?? null,
+      updateAvailable,
+      releasePending,
+      checking: false,
+      status,
+      checkedAt: new Date(checkedAtMs).toISOString(),
+      nextCheckAt: new Date(checkedAtMs + resultTtlMs).toISOString(),
+      npmPackageUrl: NPM_PACKAGE_URL,
+      releasesUrl: GITHUB_RELEASES_URL,
+      release: githubOk ? {
+        version: githubVersion,
+        tagName: githubResult.value.tag_name,
+        url: typeof githubResult.value.html_url === 'string' ? githubResult.value.html_url : GITHUB_RELEASES_URL,
+        publishedAt: githubResult.value.published_at ?? null,
+      } : null,
+      sources: {
+        npm: npmOk ? { ok: true, version: npmVersion } : { ok: false },
+        github: githubOk ? { ok: true, version: githubVersion } : { ok: false },
+      },
+    };
+    expiresAt = checkedAtMs + resultTtlMs;
+    cached = result;
+    return result;
+  }
+
+  async function check({ force = false } = {}) {
+    if (!force && cached && now() < expiresAt) return cached;
+    if (inFlight) return inFlight;
+    if (typeof fetchImpl !== 'function') {
+      cached = {
+        installedVersion,
+        latestVersion: null,
+        updateAvailable: false,
+        releasePending: false,
+        checking: false,
+        status: 'unavailable',
+        checkedAt: new Date(now()).toISOString(),
+        nextCheckAt: new Date(now() + failureTtlMs).toISOString(),
+        npmPackageUrl: NPM_PACKAGE_URL,
+        releasesUrl: GITHUB_RELEASES_URL,
+        release: null,
+        sources: { npm: { ok: false }, github: { ok: false } },
+      };
+      expiresAt = now() + failureTtlMs;
+      return cached;
+    }
+    inFlight = query().finally(() => { inFlight = undefined; });
+    return inFlight;
+  }
+
+  function status({ force = false } = {}) {
+    const stale = !cached || now() >= expiresAt;
+    if ((force || stale) && !inFlight) {
+      void check({ force: true }).catch((error) => {
+        logger?.warn?.(`plugin update check failed: ${errorMessage(error)}`);
+      });
+    }
+    const current = cached ?? {
+      installedVersion,
+      latestVersion: null,
+      updateAvailable: false,
+      releasePending: false,
+      status: 'checking',
+      checkedAt: null,
+      nextCheckAt: null,
+      npmPackageUrl: NPM_PACKAGE_URL,
+      releasesUrl: GITHUB_RELEASES_URL,
+      release: null,
+      sources: { npm: { ok: false }, github: { ok: false } },
+    };
+    return { ...current, checking: inFlight !== undefined };
+  }
+
+  function dispose() {
+    for (const controller of activeControllers) controller.abort();
+    activeControllers.clear();
+  }
+
+  return { status, check, dispose };
+}

package/lib/web.js

@@ -17,6 +17,7 @@ const UI_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'ui');
 
 /** GET /mcp-connector/api 允许调度的方法 → api 门面（白名单，杜绝任意反射调用）。 */
 const API_WHITELIST = new Map([
+  ['versionStatus', (api, p) => api.versionStatus(p?.force === true)],
   ['catalog', (api, p) => api.catalog(p ?? {})],
   ['status', (api) => api.status()],
   ['healthCheck', (api, p) => api.healthCheck(p?.connectorId)],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.23",
+  "version": "0.2.24",
   "description": "General-purpose MCP connector, connection manager, plugin extension, and integration marketplace for DeepSeek Harness, initiated and maintained by Qichacha/QCC.",
   "type": "module",
   "main": "lib/index.js",
@@ -33,7 +33,7 @@
   ],
   "scripts": {
     "test": "node --test",
-    "lint": "node --check lib/index.js && node --check lib/web.js && node --check lib/client.js && node --check lib/schema.js && node --check lib/catalog.js && node --check lib/prompts.js && node --check lib/probe.js && node --check lib/mcp-validation.js && node --check lib/mcp-http.js && node --check lib/migration.js && node --check lib/stores.js && node --check lib/oauth.js && node --check lib/grant-lifecycle.js && node --check lib/callback-server.js && node --check lib/mcp-provision.js && node --check lib/util.js && node --check lib/constants.js && node --check lib/tools.js && node --check lib/connectors/oauth-connector.js && node --check lib/connectors/manual-connector.js && node --check lib/connectors/json-connector.js && node --check scripts/probe-connector.mjs && node --check scripts/build-registry.mjs && node --check scripts/ui-harness.mjs && node --check scripts/check-market-registration.mjs && node --check scripts/sync-registry-stats.mjs",
+    "lint": "node --check lib/index.js && node --check lib/web.js && node --check lib/client.js && node --check lib/version-status.js && node --check lib/schema.js && node --check lib/catalog.js && node --check lib/prompts.js && node --check lib/probe.js && node --check lib/mcp-validation.js && node --check lib/mcp-http.js && node --check lib/migration.js && node --check lib/stores.js && node --check lib/oauth.js && node --check lib/grant-lifecycle.js && node --check lib/callback-server.js && node --check lib/mcp-provision.js && node --check lib/util.js && node --check lib/constants.js && node --check lib/tools.js && node --check lib/connectors/oauth-connector.js && node --check lib/connectors/manual-connector.js && node --check lib/connectors/json-connector.js && node --check scripts/probe-connector.mjs && node --check scripts/build-registry.mjs && node --check scripts/ui-harness.mjs && node --check scripts/check-market-registration.mjs && node --check scripts/sync-registry-stats.mjs",
     "registry:build": "node scripts/build-registry.mjs",
     "registry:validate": "node scripts/probe-connector.mjs catalog/catalog.json --validate-only",
     "dev:ui": "node scripts/ui-harness.mjs",

package/ui/index.html

@@ -400,7 +400,7 @@
       <input id="search" type="text" placeholder="搜索连接器…" />
     </div>
     <button class="icon-btn primary" id="add-connection" type="button">＋ 添加连接</button>
-    <button class="icon-btn" id="refresh">刷新</button>
+    <button class="icon-btn" id="refresh" title="刷新连接器目录">刷新连接器目录</button>
     <div class="market-nav" id="market-nav" aria-label="市场分类导航"></div>
   </header>
   <main id="main"></main>