dsh-mcp-connector 0.2.35 → 0.2.37

package/CHANGELOG.md

@@ -4,6 +4,38 @@
 
 ## [Unreleased]
 
+## [0.2.37] - 2026-09-06
+
+### Changed
+
+- “企查查·智能文档解析”改为 OAuth 2.0 PKCE 一键授权，一次授权同时启用远程在线 URL 与本地文件解析两个 Server；无需再手工复制 API Key。
+- 更新产品截图和演示 GIF，同步当前 109 张市场卡片、智能文档解析名称及 OAuth 双入口说明。
+
+### Security
+
+- 新增受限制的 OAuth-to-stdio 运行时注入：目录必须将 `oauthResource` 精确绑定到同连接器的 HTTPS MCP resource，Access Token 只注入子进程声明的 `oauthTokenEnv`，不写入连接记录、市场输出或日志。
+
+### Fixed
+
+- 从旧版 API Key 单入口升级时显示“升级一键授权”；只有 OAuth 与远程/本地两个 Server 全部启动成功后才原子替换旧连接，失败时保留旧配置。
+
+## [0.2.36] - 2026-09-06
+
+### Changed
+
+- “企查查·文档报告”更名为“企查查·智能文档解析”，产品说明、搜索标签、官网入口和示例 Prompt 调整为 OCR、文档结构化解析及 Markdown 输出场景。
+- 智能文档解析卡片改为一次录入完整 Authorization，同时配置远程在线链接 `qcc-document` 和本机文件 `qcc-document-mcp` 两个入口。
+
+### Fixed
+
+- 市场目录会比较已安装连接与卡片声明的 Server；旧版本仅安装远程入口时显示“补充本地解析”，凭据失效时显示“重新配置凭据”，不再误报完整连接或提示 OAuth 重新授权。
+- 配置页明确区分智能文档解析 API Key 与旧版企查查 OAuth 登录令牌，避免本地上传网关返回 `200215` 身份认证失败。
+
+### Verification
+
+- 196 项自动测试、lint、版本/营销元数据/商店截图门禁和 npm 发布包白名单/敏感内容扫描全部通过。
+- 远端 `qcc-document` 已用公开 PDF 完成真实解析；本地 `qcc-document-mcp` 已完成 stdio 启动和工具注册验证，并确认旧 OAuth Token 会被上传网关按预期拒绝，必须改用智能文档解析 API Key。
+
 ## [0.2.35] - 2026-09-05
 
 ### Fixed
@@ -548,7 +580,9 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.35...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.37...HEAD
+[0.2.37]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.36...v0.2.37
+[0.2.36]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.35...v0.2.36
 [0.2.35]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.34...v0.2.35
 [0.2.34]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.33...v0.2.34
 [0.2.33]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.32...v0.2.33

package/README.en.md

@@ -66,7 +66,7 @@ If the plugin helps you connect an MCP server faster, consider [starring the rep
 - Explicit, non-destructive migration from the two earlier Qichacha OAuth plugins, plus active-plugin conflict detection that blocks duplicate server management and credential overwrites.
 
 <!-- catalog-stats:start -->
-As of 2026-09-04, the public Registry publishes 100 connector descriptors. After merging and deduplicating them with the 4 bundled Qichacha cards, the Marketplace exposes 104 cards across 9 business categories. Recommendations remain limited to the four Qichacha cards, PKULaw, and Wind, for 6 featured cards in total. The Registry evolves independently; the badge shown after a client refresh and the live badges above are the authoritative current counts.
+As of 2026-09-05, the public Registry publishes 105 connector descriptors. After merging and deduplicating them with the 4 bundled Qichacha cards, the Marketplace exposes 109 cards across 9 business categories. Recommendations remain limited to the four Qichacha cards, PKULaw, and Wind, for 6 featured cards in total. The Registry evolves independently; the badge shown after a client refresh and the live badges above are the authoritative current counts.
 <!-- catalog-stats:end -->
 
 ## Interface and demo
@@ -171,7 +171,7 @@ npm run dev:ui
 
 Every Registry merge regenerates `catalog-stats.json`; an hourly workflow in this repository synchronizes the Chinese and English product copy plus a local stats snapshot. The static npm README updates with package releases, while the live badges above read the Registry directly and therefore stay current without another npm release.
 
-The current public version is [`dsh-mcp-connector@0.2.35`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.35](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.35).
+The current public version is [`dsh-mcp-connector@0.2.37`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.37](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.37).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -68,7 +68,7 @@ dsh plugin --profile web add dsh-mcp-connector
 - 对话工具：`mcp_connector_catalog`、`connect`、`configure`、`import_json`、`export_config`、`snapshot`、`install_from_url`、`status`、`scope`、`health_check`、`policy`、`set_enabled`、`disconnect`、`refresh_catalog`、`publish`、`tools_list`。
 
 <!-- catalog-stats:start -->
-截至 2026-09-04，公共 Registry 已发布 100 条连接器描述；与随包的 4 张企查查卡片合并去重后，市场页可浏览 104 张卡片，覆盖企业数据、金融投资、法律合规、开发工具、办公协作、调研分析、设计创意、效率工具、其他 9 类。推荐位严格保留 4 张企查查卡片、北大法宝和 Wind，共 6 张；其他连接器按业务分类展示。Registry 可独立持续更新，实际数量以客户端刷新后的市场页签徽标和上方实时统计徽标为准。
+截至 2026-09-05，公共 Registry 已发布 105 条连接器描述；与随包的 4 张企查查卡片合并去重后，市场页可浏览 109 张卡片，覆盖企业数据、金融投资、法律合规、开发工具、办公协作、调研分析、设计创意、效率工具、其他 9 类。推荐位严格保留 4 张企查查卡片、北大法宝和 Wind，共 6 张；其他连接器按业务分类展示。Registry 可独立持续更新，实际数量以客户端刷新后的市场页签徽标和上方实时统计徽标为准。
 <!-- catalog-stats:end -->
 
 ## 界面与演示
@@ -167,7 +167,7 @@ npm run dev:ui
 
 公共 Registry 每次合并后会生成 `catalog-stats.json`；本仓库的定时工作流每小时同步中英文介绍和统计快照。npm 页面中的静态正文随版本发布更新，上方动态统计徽标则直接读取 Registry，可在不发布新 npm 版本时保持实时数量一致。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.35`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.35](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.35)。
+当前公开版本为 [`dsh-mcp-connector@0.2.37`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.37](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.37)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/catalog/catalog.json

@@ -131,19 +131,16 @@
     },
     {
       "id": "qcc-document",
-      "name": "企查查·文档报告",
+      "name": "企查查·智能文档解析",
       "vendor": "企查查 Qichacha",
       "icon": "/mcp-connector/ui/assets/qcc-logo.svg",
       "category": "效率工具",
-      "summary": "企业报告生成 / 文档分析",
-      "description": "基于企业数据自动生成分析报告、尽职调查文档，支持文档结构化解析与内容提取。",
-      "tags": ["文档", "报告", "分析"],
+      "summary": "本机文件 / 在线链接 · OCR 与结构化解析",
+      "description": "一次 OAuth 授权同时连接远程与本地 Agent：远程入口解析公网 PDF/图片 URL，本地入口读取对话中上传、粘贴或指定路径的本机文件，自动上传并输出 Markdown 与结构化内容。本地入口需 Node.js 20+。",
+      "tags": ["智能文档解析", "OCR", "本机文件", "在线文档", "PDF", "图片", "Markdown"],
       "published": true,
       "featured": true,
-      "homepage": "https://open.qcc.com",
-      "promptVariables": [
-        { "name": "company", "label": "企业名称", "default": "小米科技有限责任公司", "placeholder": "例如：小米科技有限责任公司", "required": true }
-      ],
+      "homepage": "https://agent.qcc.com/doc",
       "auth": {
         "mode": "oauth2-pkce",
         "issuer": "https://agent.qcc.com",
@@ -153,12 +150,21 @@
         "grantSharing": "issuer"
       },
       "servers": [
-        { "serverKey": "document", "url": "https://agent.qcc.com/mcp/document/stream", "serverName": "qcc-document", "transport": "streamable-http", "headers": {} }
+        { "serverKey": "document", "url": "https://agent.qcc.com/mcp/document/stream", "serverName": "qcc-document", "transport": "streamable-http", "headers": {} },
+        {
+          "serverKey": "document-local",
+          "serverName": "qcc-document-mcp",
+          "transport": "stdio",
+          "command": "npx",
+          "args": ["-y", "qcc-document-mcp"],
+          "oauthResource": "https://agent.qcc.com/mcp/document/stream",
+          "oauthTokenEnv": "QCC_DOCUMENT_AUTHORIZATION"
+        }
       ],
       "prompts": [
-        { "title": "企业尽调报告", "text": "为 {{company}} 生成一份企业尽职调查报告", "server": "document" },
-        { "title": "企业风险报告", "text": "为 {{company}} 生成一份企业风险分析报告", "server": "document" },
-        { "title": "工商信息摘要", "text": "整理 {{company}} 的工商与股权信息摘要", "server": "document" }
+        { "title": "解析在线文档", "text": "解析这份在线文档：请把公网可访问的 PDF 或图片 URL 粘贴到这里，并输出 Markdown 与关键字段。", "server": "document" },
+        { "title": "解析上传文件", "text": "解析我在对话中上传或粘贴的这份 PDF 或图片，提取正文、表格和关键字段。", "server": "document-local" },
+        { "title": "解析本机文件", "text": "解析本机文件：请把文件路径替换为 ~/Desktop/example.pdf，并输出 Markdown 与结构化摘要。", "server": "document-local" }
       ]
     },
     {

package/docs/STDIO-SUPPORT.md

@@ -152,7 +152,7 @@ const Config = z.union([
 
 - stdio 是本地进程，密钥最终仍通过环境变量传递（如 `GITHUB_TOKEN`、`OPENAI_API_KEY`）。
 - 无凭据的 stdio 连接器使用 `auth.mode: "none"`；需要用户输入的卡片使用 `bearer` 或 `api-key`，并在 `auth.credentialFields` 声明一个或多个输入字段。
-- `servers[].credentialBindings` 只保存“环境变量名 → 凭据字段 key”的映射；`servers[].env` 只能包含非敏感默认值。
+- `servers[].credentialBindings` 只保存“环境变量名 → 凭据字段 key”的映射；OAuth stdio 只能用 `oauthResource` 引用同连接器的 HTTP resource，并通过 `oauthTokenEnv` 声明运行时 Token 环境变量。`servers[].env` 只能包含非敏感默认值。
 - 用户输入存入本机 `ConnectionRecord.env` 并透传给 `dsh-mcp-client`，不回写目录，也不出现在 catalog/status/log 输出。
 - Registry 探针只校验声明与命令形状，绝不执行本地 stdio 命令。
 
@@ -614,7 +614,7 @@ cwd: { type: 'string', description: 'transport=stdio 时的工作目录，默认
 | stdio `command` 可执行任意本地命令 | command 来自（a）维护者审核的 catalog，或（b）用户主动 configure，风险可控；DSH 运行时沙箱机制兜底 |
 | `env` 里的密钥泄露到日志 | dsh-mcp-client 的 `buildChildEnv` 已用 `scrubbedParentEnv()` 清理敏感父环境变量；我们持久化 env 到 storage domain 与现有 headers 鉴权一致，无新增泄露面 |
 | `cwd` 空字符串导致 spawn 异常 | provisioning 层显式 `record.cwd \|\| process.cwd()` |
-| 目录夹带密钥 | `auditRawDescriptor` 拒绝真实凭据字段，`auditDescriptor` 拒绝 `env` 中的 token/secret/API Key/password 类变量；只允许 `credentialBindings` 引用已声明字段 |
+| 目录夹带密钥 | `auditRawDescriptor` 拒绝真实凭据字段，`auditDescriptor` 拒绝 `env` 中的 token/secret/API Key/password 类变量；手工凭据只允许 `credentialBindings` 引用已声明字段，OAuth Token 只允许按同连接器 `oauthResource` 在运行时注入 `oauthTokenEnv` |
 | 凭据映射错误或未使用 | Schema 与目录审计检查字段 key、env 名、重复映射、未知引用及未被任何 HTTP/stdio Server 使用的必填字段 |
 
 ---

package/docs/USER-GUIDE.md

@@ -75,6 +75,15 @@ Bearer/API Key 连接器会先执行 MCP `initialize` 验证。所有 Server 通
 
 stdio 市场卡片也可能显示一个或多个凭据字段，例如 API Token、区域或租户标识。卡片目录只声明字段名称及其环境变量映射；提交后，真实值仅保存到 DSH 本机连接记录，并由插件注入该 stdio 进程的 `env`。市场、状态页和日志不会返回这些值。插件会等待 Host 完成首次 MCP 初始化与工具同步后再保存连接；失败或超时不会增加已安装数量，卡片也不会提前显示“已连接”。
 
+“企查查·智能文档解析”会通过一次 OAuth 一键授权配置两个互不冲突的入口：
+
+- `qcc-document`：远程 Agent，解析公网可访问的在线文档或图片 URL。
+- `qcc-document-mcp`：本地 Agent，通过 `npx -y qcc-document-mcp` 读取对话中上传、粘贴或指定路径的本机文件，自动上传并提交解析；要求 Node.js 20+。
+
+点击“连接”后只需完成一次企查查 OAuth 授权，插件会同时注册上述两个 Server。OAuth Access Token 仅在运行时注入本地子进程的 `QCC_DOCUMENT_AUTHORIZATION`，不会写入市场目录、连接记录、页面状态或日志；Token 刷新后本地 Agent 会自动更新。从旧版手工 API Key 配置升级时，点击“升级一键授权”，只有在新授权与两个 Server 都启动成功后才会原子替换旧连接；失败会保留原配置。
+
+旧版本只配置过远程入口时，卡片会显示“升级一键授权”，不会把单入口误报为完整连接。完成 OAuth 后，插件先验证两个 Server，再原子保存；任一入口失败都不会留下半套配置。
+
 OAuth 一键连接要求服务商支持标准 OAuth 2.1/PKCE 和公开元数据发现。动态客户端注册既支持无需客户端密钥的 `none`，也支持服务商签发密钥的 `client_secret_post` 与 `client_secret_basic`。客户端密钥仅与 OAuth Grant 一同保存在 DSH 本机，用于换取、刷新和撤销 Token；插件不会要求用户把 OAuth Token 或客户端密钥复制到聊天中。如服务商在动态客户端注册阶段返回 HTTP 403，页面会明确提示“客户端注册被拒绝、尚未进入浏览器授权”；这通常需要服务商审核或登记客户端，重试用户授权无法绕过。
 
 当市场描述声明 `grantSharing: "issuer"` 时，同一账号下相同 issuer、scope 和客户端鉴权方式的卡片共享一组 Grant。首次授权仍只启用用户点击的卡片；之后连接同组卡片会直接复用现有授权，不再重复打开 OAuth 页面。升级时会验证并自动归并旧版本留下的同 issuer 多份 Grant；Desktop 与 `dsh web` 并发时，插件使用跨进程锁串行轮换，并从每 Grant 独立原子日志读取最新 Token，避免 DSH 整文件 storage 的旧进程快照覆盖新凭据。网络、OAuth 元数据发现或服务端 5xx 等暂时故障只进入“自动重试中”；确认 journal 中也没有更新 Token，且明确收到 Refresh Token/客户端失效错误时，才进入“需重新授权”。

package/docs/screenshots/README.md

@@ -1,9 +1,9 @@
 # UI 素材说明
 
-本目录用于保存 `dsh-mcp-connector` 的公开界面截图。素材于 2026-08-30 从当前源码的
+本目录用于保存 `dsh-mcp-connector` 的公开界面截图。素材于 2026-09-06 从 `v0.2.37` 源码的
 无凭据 UI harness 采集：外层浏览器视口为 1280×720，harness 复刻产品宿主在
 `lib/client.js` 中定义的 800px 市场面板，因此桌面端稳定为一行 2 张卡片。公开 Registry
-快照含 79 条描述，与 4 张随包唯一卡片合并后市场显示 83 张。画面只展示公开市场元数据、
+快照含 105 条描述，与 4 张随包唯一卡片合并后市场显示 109 张。画面只展示公开市场元数据、
 示例 Prompt 和明确标识为 Mock 的工具数据，不包含 OAuth Token、API Key、本机路径、
 用户会话或查询结果。
 
@@ -21,8 +21,8 @@ SHA-256、尺寸与 GIF 时长。
 
 | 文件 | 展示内容 |
 |---|---|
-| `01-market-overview.jpg` | 83 张合并市场卡片、桌面两列、推荐章节、9 分类和固定分类栏；企查查卡片均为未连接的“连接”状态 |
-| `02-connector-detail.jpg` | Seedream 第三方服务说明、精选 Prompt 和未连接状态 |
+| `01-market-overview.jpg` | 109 张合并市场卡片、桌面两列、推荐章节、9 分类和固定分类栏；展示“企查查·智能文档解析”新名称与未配置状态 |
+| `02-connector-detail.jpg` | 智能文档解析一次 OAuth 授权同时连接 2 个 Server：远程 Agent 解析在线 URL，本地 Agent 通过 `npx -y qcc-document-mcp` 解析本机文件 |
 | `03-tool-discovery.jpg` | Context7 无凭据 Mock 健康状态、Mock 工具数量/描述、搜索和独立滚动区 |
 | `04-json-import.jpg` | Streamable HTTP / stdio JSON 导入与本机凭据提示 |
 

package/docs/screenshots/assets.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "capture": {
-    "capturedOn": "2026-08-30",
+    "capturedOn": "2026-09-06",
     "browserViewport": {
       "width": 1280,
       "height": 720
@@ -13,32 +13,32 @@
   "screenshots": [
     {
       "path": "docs/screenshots/01-market-overview.jpg",
-      "sha256": "856dc020a285752f4cd4a1c1025df9ce68ace2cd90ee1aa06c6b0699c78763f6",
+      "sha256": "9c9bc1c6f9e5b247c71ce283b86895b9e971f6283dc6eabaa9dbb1c42ae408c3",
       "width": 1280,
       "height": 720
     },
     {
       "path": "docs/screenshots/02-connector-detail.jpg",
-      "sha256": "0e15a26bbd21f8587b6354174d6d3411a6487e7a2df45d20c89f396b26f2ef65",
+      "sha256": "dbb7a1493378c30e743dd77c8a35c1779f443a2f8b720871de1efc61ee54eb27",
       "width": 1280,
       "height": 720
     },
     {
       "path": "docs/screenshots/03-tool-discovery.jpg",
-      "sha256": "ca1eccf06506c829fc23212eee39306e64c5781da9c1eff959d4b597d5df2f97",
+      "sha256": "5eeb896db75a5f141a8463f128f7733ffe89af6a447cecb2d1b19f8287a3e1ec",
       "width": 1280,
       "height": 720
     },
     {
       "path": "docs/screenshots/04-json-import.jpg",
-      "sha256": "2619ae8ba8f5d40131c6dfa2a367ee5ee64b8fee7782e5f4eddebd2a1cc79934",
+      "sha256": "de0a87cc7f247fad40ac37188f5a1d026f4087571e98d64595e80f8bcd9410be",
       "width": 1280,
       "height": 720
     }
   ],
   "demo": {
     "path": "docs/demo.gif",
-    "sha256": "4fa49853df79faa1c53d28938d79dd43bde3603712ecdc2e3b62d93a4c219d9a",
+    "sha256": "c9a84ce9c164c1b9f846f8b5a65afd8dd5c49741c9dfc530f1ad766e47b3d2b6",
     "width": 960,
     "height": 540,
     "durationSeconds": 16

package/lib/catalog.js

@@ -43,6 +43,11 @@ export function loadBundledCatalog() {
 
 /** 安全审计：目录禁止携带密钥、URL 协议白名单、header 名白名单。 */
 export function auditDescriptor(descriptor) {
+  const oauthHttpResources = new Set(
+    descriptor.servers
+      .filter((server) => server.transport === 'streamable-http')
+      .map((server) => server.url),
+  );
   const credentialFields = descriptor.auth.credentialFields ?? [];
   const credentialKeys = new Set();
   for (const field of credentialFields) {
@@ -59,7 +64,26 @@ export function auditDescriptor(descriptor) {
       }
       const bindings = server.credentialBindings ?? {};
       if (descriptor.auth.mode === 'oauth2-pkce') {
-        throw new Error(`connector "${descriptor.id}" 的 stdio server 不支持 auth.mode=oauth2-pkce`);
+        if (Object.keys(bindings).length > 0) {
+          throw new Error(`connector "${descriptor.id}" 的 OAuth stdio server 不能同时声明 credentialBindings`);
+        }
+        if (!server.oauthResource || !server.oauthTokenEnv) {
+          throw new Error(`connector "${descriptor.id}" 的 OAuth stdio server 必须声明 oauthResource 和 oauthTokenEnv`);
+        }
+        assertSafeUrl(server.oauthResource);
+        if (!oauthHttpResources.has(server.oauthResource)) {
+          throw new Error(`connector "${descriptor.id}" 的 OAuth stdio oauthResource 必须引用同一连接器的 HTTP resource`);
+        }
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(server.oauthTokenEnv)) {
+          throw new Error(`connector "${descriptor.id}" oauthTokenEnv 环境变量名非法: ${server.oauthTokenEnv}`);
+        }
+        if (Object.hasOwn(server.env ?? {}, server.oauthTokenEnv)) {
+          throw new Error(`connector "${descriptor.id}" oauthTokenEnv 与 servers[].env 重复声明: ${server.oauthTokenEnv}`);
+        }
+        continue;
+      }
+      if (server.oauthResource || server.oauthTokenEnv) {
+        throw new Error(`connector "${descriptor.id}" 只有 OAuth stdio server 可声明 oauthResource/oauthTokenEnv`);
       }
       if (descriptor.auth.mode === 'none' && Object.keys(bindings).length > 0) {
         throw new Error(`connector "${descriptor.id}" 的 stdio credentialBindings 需要 bearer/api-key 凭据定义`);
@@ -89,6 +113,9 @@ export function auditDescriptor(descriptor) {
       }
     }
   }
+  if (descriptor.auth.mode === 'oauth2-pkce' && oauthHttpResources.size === 0) {
+    throw new Error(`connector "${descriptor.id}" 的 OAuth 授权至少需要一个 HTTP resource`);
+  }
   if (['bearer', 'api-key'].includes(descriptor.auth.mode)) {
     const httpServers = descriptor.servers.filter((server) => server.transport === 'streamable-http');
     if (httpServers.length > 0 && credentialFields[0]) referencedCredentials.add(credentialFields[0].key);

package/lib/connectors/oauth-connector.js

@@ -88,8 +88,8 @@ export function describeOAuthAuthorizationError(error) {
  * @param {AbortSignal} [args.signal]
  */
 export async function oauthAuthorize({ connector, config, logger, signal }) {
-  const entryServer = connector.servers[0];
-  if (!entryServer) throw stagedError('resource-discovery', `connector "${connector.id}" has no servers`);
+  const entryServer = connector.servers.find((server) => server.url);
+  if (!entryServer) throw stagedError('resource-discovery', `connector "${connector.id}" has no HTTP OAuth resource`);
 
   const protectedResource = await atOAuthStage(
     'resource-discovery',
@@ -166,16 +166,16 @@ export async function oauthAuthorize({ connector, config, logger, signal }) {
     let grantedResources;
     if (grantedUrls) {
       const granted = new Set(grantedUrls);
-      const grantedServers = connector.servers.filter((s) => granted.has(s.url));
+      const grantedServers = connector.servers.filter((s) => granted.has(s.oauthResource ?? s.url));
       grantedKeys = grantedServers.map((s) => s.serverKey);
-      grantedResources = grantedServers.map((s) => s.url);
+      grantedResources = [...new Set(grantedServers.map((s) => s.oauthResource ?? s.url).filter(Boolean))];
       if (grantedKeys.length === 0) {
         grantedKeys = [entryServer.serverKey];
         grantedResources = [entryServer.url];
       }
     } else {
       grantedKeys = connector.servers.map((s) => s.serverKey);
-      grantedResources = connector.servers.map((s) => s.url);
+      grantedResources = [...new Set(connector.servers.map((s) => s.oauthResource ?? s.url).filter(Boolean))];
     }
 
     return {

package/lib/index.js

@@ -1051,7 +1051,7 @@ export async function apply(ctx, config) {
 
   function oauthResourceOrigins(connector) {
     return [...new Set((connector.servers ?? []).map((server) => {
-      try { return new URL(server.url).origin; } catch { return ''; }
+      try { return new URL(server.oauthResource ?? server.url).origin; } catch { return ''; }
     }).filter(Boolean))].sort();
   }
 
@@ -1084,6 +1084,7 @@ export async function apply(ctx, config) {
     const servers = [];
     for (const candidate of sharingConnectors) {
       for (const server of candidate.servers) {
+        if (!server.url) continue;
         if (seen.has(server.url)) continue;
         seen.add(server.url);
         servers.push({ ...server, serverKey: `${candidate.id}:${server.serverKey}` });
@@ -1097,7 +1098,7 @@ export async function apply(ctx, config) {
     const now = Date.now();
     const records = [];
     for (const connector of connectors) {
-      for (const server of connector.servers.filter((candidate) => granted.has(candidate.url))) {
+      for (const server of connector.servers.filter((candidate) => granted.has(candidate.oauthResource ?? candidate.url))) {
         records.push({
           key: `${connector.id}-${server.serverKey}`,
           connectorId: connector.id,
@@ -1106,6 +1107,11 @@ export async function apply(ctx, config) {
           serverKey: server.serverKey,
           transport: server.transport,
           url: server.url,
+          command: server.command,
+          args: server.args,
+          env: server.env,
+          oauthTokenEnv: server.oauthTokenEnv,
+          cwd: server.cwd,
           serverName: server.serverName,
           headers: server.headers,
           auth: { mode: 'oauth', grantKey },
@@ -1146,7 +1152,7 @@ export async function apply(ctx, config) {
           continue;
         }
       }
-      if (connector.servers.some((server) => entry.grant.authorizedResources.includes(server.url))) {
+      if (connector.servers.some((server) => entry.grant.authorizedResources.includes(server.oauthResource ?? server.url))) {
         return { grantKey, entry };
       }
     }
@@ -1709,6 +1715,13 @@ export async function apply(ctx, config) {
         const visibleRecords = workspaceId
           ? connectorRecords.filter((record) => connectionVisibleInWorkspace(connectionScopes.binding(record.key), workspaceId))
           : connectorRecords;
+        const missingServers = (d.servers ?? []).filter((server) => !visibleRecords.some((record) => (
+          record.serverKey === server.serverKey || record.serverName === server.serverName
+        ))).map((server) => ({
+          serverKey: server.serverKey,
+          serverName: server.serverName,
+          transport: server.transport,
+        }));
         return ({
         id: d.id,
         name: d.name,
@@ -1734,6 +1747,8 @@ export async function apply(ctx, config) {
         probeReportUrl: d.probeReportUrl,
         toolsSnapshot: d.toolsSnapshot ?? [],
         connected: visibleRecords.map((record) => record.key),
+        connectionComplete: missingServers.length === 0,
+        missingServers,
         connectedScopes: connectorRecords.map((record) => ({ key: record.key, ...scopeDetail(record, workspaceId) })),
         connectionState: health.connectionState,
         connectionLabel: health.label,
@@ -1748,6 +1763,8 @@ export async function apply(ctx, config) {
           command: s.command,
           args: s.args,
           credentialBindings: s.credentialBindings,
+          oauthResource: s.oauthResource,
+          oauthTokenEnv: s.oauthTokenEnv,
           transport: s.transport,
           serverName: s.serverName,
         })),

package/lib/mcp-provision.js

@@ -26,12 +26,17 @@ export function authHeaders(record, grants) {
 
 export function buildEntryConfig(record, grants, { failOnStartupError = false } = {}) {
   if (record.transport === 'stdio') {
+    const env = { ...(record.env ?? {}) };
+    if (record.auth?.mode === 'oauth' && record.oauthTokenEnv) {
+      const grant = record.auth.grantKey ? grants.get(record.auth.grantKey) : null;
+      if (grant?.accessToken) env[record.oauthTokenEnv] = `Bearer ${grant.accessToken}`;
+    }
     return {
       transport: 'stdio',
       serverName: record.serverName,
       command: record.command,
       args: record.args ?? [],
-      env: record.env ?? {},
+      env,
       cwd: record.cwd || process.cwd(),
       failOnStartupError,
     };

package/lib/schema.js

@@ -13,6 +13,8 @@ export const serverRefSchema = z.object({
   args: z.array(z.string()).optional(),
   env: z.record(z.string()).optional(),
   credentialBindings: z.record(z.string()).optional(),
+  oauthResource: z.string().min(1).optional(),
+  oauthTokenEnv: z.string().min(1).optional(),
   cwd: z.string().optional(),
   serverName: z.string().min(1),
   transport: z.enum(['streamable-http', 'sse', 'stdio']).optional(),
@@ -110,6 +112,7 @@ export const connectionRecordSchema = z.object({
   command: z.string().min(1).optional(),
   args: z.array(z.string()).optional(),
   env: z.record(z.string()).optional(),
+  oauthTokenEnv: z.string().min(1).optional(),
   cwd: z.string().optional(),
   serverName: z.string().min(1),
   headers: z.record(z.string()).optional(),
@@ -238,6 +241,8 @@ export function normalizeConnectorDescriptor(raw) {
       args: transport === 'stdio' ? (s.args ?? []) : undefined,
       env: transport === 'stdio' ? (s.env ?? {}) : undefined,
       credentialBindings: transport === 'stdio' ? (s.credentialBindings ?? {}) : undefined,
+      oauthResource: transport === 'stdio' ? s.oauthResource : undefined,
+      oauthTokenEnv: transport === 'stdio' ? s.oauthTokenEnv : undefined,
       cwd: transport === 'stdio' ? (s.cwd ?? '') : undefined,
       serverName: s.serverName,
       transport,
@@ -334,8 +339,9 @@ export function normalizeConnectionRecord(raw) {
     command: transport === 'stdio' ? data.command : undefined,
     args: transport === 'stdio' ? (data.args ?? []) : undefined,
     env: transport === 'stdio' ? (data.env ?? {}) : undefined,
+    oauthTokenEnv: transport === 'stdio' && data.auth?.mode === 'oauth' ? data.oauthTokenEnv : undefined,
     cwd: transport === 'stdio' ? (data.cwd ?? '') : undefined,
     headers: transport === 'streamable-http' ? (data.headers ?? {}) : {},
-    auth: transport === 'stdio' ? undefined : data.auth,
+    auth: transport === 'stdio' && data.auth?.mode !== 'oauth' ? undefined : data.auth,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.35",
+  "version": "0.2.37",
   "description": "DeepSeek Harness MCP Connector and MCP Server marketplace with over one hundred MCP connectors, continuously updated. Discover, authorize, and manage connections in one place; supports OAuth 2.0 PKCE, API keys, stdio/HTTP, mcpServers JSON import, and tool and prompt discovery. Maintained by Qichacha/QCC.",
   "type": "module",
   "main": "lib/index.js",

package/registry/schema/connector.schema.json

@@ -57,6 +57,8 @@
           "args": { "type": "array", "items": { "type": "string" } },
           "env": { "type": "object", "additionalProperties": { "type": "string" } },
           "credentialBindings": { "type": "object", "additionalProperties": { "type": "string" } },
+          "oauthResource": { "type": "string", "minLength": 1 },
+          "oauthTokenEnv": { "type": "string", "minLength": 1, "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" },
           "cwd": { "type": "string" },
           "serverName": { "type": "string", "minLength": 1 },
           "transport": { "enum": ["streamable-http", "stdio"] },

package/ui/index.html

@@ -521,7 +521,7 @@
     reauthorize: '需重新授权', recovering: '自动重试中', connectionError: '连接异常', partialError: '部分异常', disabled: '已停用',
     send: '发送', fillSend: '填写并发送', connectToUse: '连接后使用', try: '💬 去试试',
     connectTry: '🔗 连接后试用', configureConnect: '🔑 录入凭据并连接',
-    reconfigureCredential: '🔑 重新配置凭据', loading: '加载中…',
+    reconfigureCredential: '🔑 重新配置凭据', completeSetup: '补充本地解析', upgradeOauth: '升级一键授权', loading: '加载中…',
   };
   const t = (key) => LABELS[key] || key;
   const MCP_JSON_EXAMPLE = JSON.stringify({
@@ -1059,13 +1059,24 @@
   function actionHtml(d) {
     const id = esc(d.id);
     const configured = d.connected?.length > 0;
+    const incomplete = configured && d.connectionComplete === false;
     const state = d.connectionState || (configured ? 'configured' : 'disconnected');
+    if (incomplete && ['bearer', 'api-key'].includes(d.authMode)) {
+      return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.openConfig('${id}')">${t('completeSetup')}</button>`;
+    }
+    if (incomplete && d.authMode === 'oauth2-pkce') {
+      return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.connect('${id}')">${t('upgradeOauth')}</button>`;
+    }
     if (configured) {
       if (state === 'healthy') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn ghost" disabled>${t('connected')}</button>`;
       if (state === 'unknown') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('unknown')}</button>`;
       if (state === 'configured') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn ghost" disabled>${t('configured')}</button>`;
       if (state === 'disabled') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn ghost" disabled>${t('disabled')}</button>`;
-      if (state === 'reauth') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('reauthorize')}</button>`;
+      if (state === 'reauth') {
+        const credentialAuth = ['bearer', 'api-key'].includes(d.authMode);
+        const action = credentialAuth ? `window.__mcp.openConfig('${id}')` : `window.__mcp.showDetail('${id}')`;
+        return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();${action}">${credentialAuth ? t('reconfigureCredential') : t('reauthorize')}</button>`;
+      }
       if (state === 'recovering') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('recovering')}</button>`;
       if (state === 'degraded') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('partialError')}</button>`;
       if (state === 'unavailable') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-bad" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('connectionError')}</button>`;
@@ -1190,15 +1201,18 @@
         ? `<label for="cfg-token">${esc(credentialName)}（必填）</label><input id="cfg-token" type="password" autocomplete="off" placeholder="${esc(credentialPlaceholder)}" /><div class="field-help">${esc(credentialDescription)}</div>`
         : `<div class="form-row"><div><label for="cfg-key-header">API Key Header</label><input id="cfg-key-header" value="${esc(preset.apiKeyHeader || 'X-Api-Key')}" /></div><div><label for="cfg-key-value">${esc(credentialName)}（必填）</label><input id="cfg-key-value" type="password" autocomplete="off" placeholder="${esc(credentialPlaceholder)}" /></div></div><div class="field-help">${esc(credentialDescription)}</div>`;
     const serverPreview = servers.map((server) => {
+      const modeLabel = server.transport === 'stdio' ? '本地 Agent · 本机文件' : '远程 Agent · 在线链接文档';
       const endpoint = server.transport === 'stdio'
         ? `stdio · ${server.command || ''} ${(server.args || []).join(' ')}`.trim()
         : server.url;
-      return `<div>${esc(server.serverName)} · ${esc(endpoint)}</div>`;
+      return `<div><strong>${esc(modeLabel)}</strong><br>${esc(server.serverName)} · ${esc(endpoint)}</div>`;
     }).join('');
+    const mixedDocumentModes = usesStdio && servers.some((server) => server.transport !== 'stdio');
     openModal(`配置 ${preset.name}`, `
       <input id="cfg-connector-id" type="hidden" value="${esc(preset.id)}" />
       <input id="cfg-auth" type="hidden" value="${esc(authMode)}" />
       <div class="form-note"><strong>一次配置 ${servers.length} 个 MCP Server</strong>以下 Server 共用同一份 ${esc(credentialName)}；凭据仅保存在本机，不会写入市场目录。</div>
+      ${mixedDocumentModes ? '<div class="form-note"><strong>在线链接 + 本机文件同时启用</strong>远程入口解析公网可访问的 URL；本地入口读取对话中上传、粘贴或指定路径的文件并自动提交解析，需 Node.js 20+。</div>' : ''}
       <div class="server-preview">${serverPreview}</div>
       ${scopeFieldHtml()}
       ${credentialFields}
@@ -1591,14 +1605,17 @@
       const d = marketItems[connectorId];
       if (!d) return;
       detailConnector = d;
-      detailFailureState = d.connectionState || '';
-      detailNeedsReconfigure = ['reauth', 'recovering', 'unavailable'].includes(detailFailureState);
+      const incomplete = d.connected?.length > 0 && d.connectionComplete === false;
+      detailFailureState = incomplete ? 'incomplete' : (d.connectionState || '');
+      detailNeedsReconfigure = incomplete || ['reauth', 'recovering', 'unavailable'].includes(detailFailureState);
       const loadId = ++detailLoadId;
       $('#detail-icon').innerHTML = isImageIcon(d.icon)
         ? `<img src="${esc(d.icon)}" alt="" onerror="this.parentElement.innerHTML='🔌';" />`
         : `<span style="font-size:24px;">${esc(d.icon || '')}</span>`;
       $('#detail-name').textContent = d.name || '';
-      const initialStateLabel = d.connectionLabel || (d.connected?.length ? '已配置' : '未连接');
+      const initialStateLabel = incomplete
+        ? `待补充 ${d.missingServers?.length || 1} 个服务`
+        : (d.connectionLabel || (d.connected?.length ? '已配置' : '未连接'));
       $('#detail-vendor').textContent = d.vendor ? `${d.vendor} · ${initialStateLabel} ${d.connected?.length || 0} 个服务` : `${initialStateLabel} ${d.connected?.length || 0} 个服务`;
       $('#detail-desc').textContent = d.description || d.summary || '';
       detailPrompts = (d.prompts || []).filter((prompt) => prompt?.text || prompt?.title);
@@ -1616,7 +1633,7 @@
       $('#detail-disconnect-btn').style.display = d.connected?.length > 0 ? 'block' : 'none';
       const needsCredential = ['bearer', 'api-key'].includes(d.authMode);
       $('#detail-try-btn').textContent = detailNeedsReconfigure
-        ? d.authMode === 'oauth2-pkce' && detailFailureState === 'reauth' ? '🔐 重新授权' : needsCredential && detailFailureState === 'reauth' ? t('reconfigureCredential') : '🔄 重新检查'
+        ? detailFailureState === 'incomplete' ? (d.authMode === 'oauth2-pkce' ? t('upgradeOauth') : t('completeSetup')) : d.authMode === 'oauth2-pkce' && detailFailureState === 'reauth' ? '🔐 重新授权' : needsCredential && detailFailureState === 'reauth' ? t('reconfigureCredential') : '🔄 重新检查'
         : d.connected?.length > 0 ? t('try') : needsCredential ? t('configureConnect') : t('connectTry');
       if (!d.connected?.length && !d.toolsSnapshot?.length) {
         $('#tools-summary').textContent = '连接后查看工具';
@@ -1657,10 +1674,13 @@
         renderPromptPage();
         return;
       }
-      detailFailureState = toolsResult.detail?.connectionState || 'healthy';
-      detailNeedsReconfigure = false;
-      $('#detail-vendor').textContent = d.vendor ? `${d.vendor} · ${detailFailureState === 'degraded' ? '部分服务可用' : '已连接'} ${d.connected?.length || 0} 个服务` : `${detailFailureState === 'degraded' ? '部分服务可用' : '已连接'} ${d.connected?.length || 0} 个服务`;
-      $('#detail-try-btn').textContent = t('try');
+      detailFailureState = incomplete ? 'incomplete' : (toolsResult.detail?.connectionState || 'healthy');
+      detailNeedsReconfigure = incomplete;
+      const connectedLabel = incomplete
+        ? `待补充 ${d.missingServers?.length || 1} 个服务`
+        : `${detailFailureState === 'degraded' ? '部分服务可用' : '已连接'} ${d.connected?.length || 0} 个服务`;
+      $('#detail-vendor').textContent = d.vendor ? `${d.vendor} · ${connectedLabel}` : connectedLabel;
+      $('#detail-try-btn').textContent = incomplete ? (d.authMode === 'oauth2-pkce' ? t('upgradeOauth') : t('completeSetup')) : t('try');
       renderPromptPage();
       detailToolServers = toolsResult.detail?.servers || [];
       updateToolsSummary();
@@ -1748,10 +1768,25 @@
   });
   $('#detail-try-btn').addEventListener('click', async () => {
     if (detailNeedsReconfigure) {
+      if (detailFailureState === 'incomplete' && ['bearer', 'api-key'].includes(detailConnector?.authMode)) {
+        openAddConnection('manual', detailConnector);
+        return;
+      }
       if (detailFailureState === 'reauth' && ['bearer', 'api-key'].includes(detailConnector?.authMode)) {
         openAddConnection('manual', detailConnector);
         return;
       }
+      if (detailFailureState === 'incomplete' && detailConnector?.authMode === 'oauth2-pkce') {
+        const id = detailConnector.id;
+        const r = await call('connect', { connectorId: id }, { timeoutMs: 310_000 });
+        showToast(r.message, r.ok);
+        if (r.ok) {
+          markCommunityCtaEligible();
+          await call('healthCheck', { connectorId: id });
+          await refreshConnectionUi(id);
+        }
+        return;
+      }
       if (detailFailureState === 'reauth' && detailConnector?.authMode === 'oauth2-pkce') {
         const id = detailConnector.id;
         const r = await call('connect', { connectorId: id }, { timeoutMs: 310_000 });