dsh-mcp-connector 0.2.36 → 0.2.37

package/CHANGELOG.md

@@ -4,6 +4,21 @@
 
 ## [Unreleased]
 
+## [0.2.37] - 2026-09-06
+
+### Changed
+
+- “企查查·智能文档解析”改为 OAuth 2.0 PKCE 一键授权，一次授权同时启用远程在线 URL 与本地文件解析两个 Server；无需再手工复制 API Key。
+- 更新产品截图和演示 GIF，同步当前 109 张市场卡片、智能文档解析名称及 OAuth 双入口说明。
+
+### Security
+
+- 新增受限制的 OAuth-to-stdio 运行时注入：目录必须将 `oauthResource` 精确绑定到同连接器的 HTTPS MCP resource，Access Token 只注入子进程声明的 `oauthTokenEnv`，不写入连接记录、市场输出或日志。
+
+### Fixed
+
+- 从旧版 API Key 单入口升级时显示“升级一键授权”；只有 OAuth 与远程/本地两个 Server 全部启动成功后才原子替换旧连接，失败时保留旧配置。
+
 ## [0.2.36] - 2026-09-06
 
 ### Changed
@@ -565,7 +580,8 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.36...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.37...HEAD
+[0.2.37]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.36...v0.2.37
 [0.2.36]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.35...v0.2.36
 [0.2.35]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.34...v0.2.35
 [0.2.34]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.33...v0.2.34

package/README.en.md

@@ -171,7 +171,7 @@ npm run dev:ui
 
 Every Registry merge regenerates `catalog-stats.json`; an hourly workflow in this repository synchronizes the Chinese and English product copy plus a local stats snapshot. The static npm README updates with package releases, while the live badges above read the Registry directly and therefore stay current without another npm release.
 
-The current public version is [`dsh-mcp-connector@0.2.36`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.36](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.36).
+The current public version is [`dsh-mcp-connector@0.2.37`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.37](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.37).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -167,7 +167,7 @@ npm run dev:ui
 
 公共 Registry 每次合并后会生成 `catalog-stats.json`；本仓库的定时工作流每小时同步中英文介绍和统计快照。npm 页面中的静态正文随版本发布更新，上方动态统计徽标则直接读取 Registry，可在不发布新 npm 版本时保持实时数量一致。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.36`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.36](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.36)。
+当前公开版本为 [`dsh-mcp-connector@0.2.37`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.37](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.37)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/catalog/catalog.json

@@ -136,29 +136,18 @@
       "icon": "/mcp-connector/ui/assets/qcc-logo.svg",
       "category": "效率工具",
       "summary": "本机文件 / 在线链接 · OCR 与结构化解析",
-      "description": "智能解析 PDF、图片等文档：远程入口处理公网可访问的在线链接，本地入口读取对话中上传、粘贴或指定路径的本机文件并自动提交解析，输出 Markdown 与结构化内容。本地入口需 Node.js 20+。",
+      "description": "一次 OAuth 授权同时连接远程与本地 Agent：远程入口解析公网 PDF/图片 URL，本地入口读取对话中上传、粘贴或指定路径的本机文件，自动上传并输出 Markdown 与结构化内容。本地入口需 Node.js 20+。",
       "tags": ["智能文档解析", "OCR", "本机文件", "在线文档", "PDF", "图片", "Markdown"],
       "published": true,
       "featured": true,
       "homepage": "https://agent.qcc.com/doc",
       "auth": {
-        "mode": "api-key",
-        "apiKeyHeader": "Authorization",
-        "credentialName": "智能文档解析 API Key Authorization",
-        "credentialPlaceholder": "Bearer YOUR_API_KEY",
-        "credentialDescription": "请输入智能文档解析产品签发的完整 Authorization 值（Bearer + 空格 + API Key），不是企查查 OAuth 登录令牌。一次配置后，远程在线链接与本地文件解析共用此凭据。",
-        "credentialHelpLabel": "前往企查查智能文档解析获取 API Key",
-        "credentialFields": [
-          {
-            "key": "authorization",
-            "label": "Authorization",
-            "placeholder": "Bearer YOUR_API_KEY",
-            "description": "格式为 Bearer + 空格 + 智能文档解析 API Key；OAuth 登录令牌不能用于本地文件上传。凭据仅保存在 DSH 本机。",
-            "helpLabel": "前往企查查智能文档解析获取 API Key",
-            "required": true,
-            "secret": true
-          }
-        ]
+        "mode": "oauth2-pkce",
+        "issuer": "https://agent.qcc.com",
+        "scope": "mcp:tools",
+        "clientName": "DeepSeek Harness - MCP 连接器",
+        "tokenEndpointAuthMethod": "none",
+        "grantSharing": "issuer"
       },
       "servers": [
         { "serverKey": "document", "url": "https://agent.qcc.com/mcp/document/stream", "serverName": "qcc-document", "transport": "streamable-http", "headers": {} },
@@ -168,7 +157,8 @@
           "transport": "stdio",
           "command": "npx",
           "args": ["-y", "qcc-document-mcp"],
-          "credentialBindings": { "QCC_DOCUMENT_AUTHORIZATION": "authorization" }
+          "oauthResource": "https://agent.qcc.com/mcp/document/stream",
+          "oauthTokenEnv": "QCC_DOCUMENT_AUTHORIZATION"
         }
       ],
       "prompts": [

package/docs/STDIO-SUPPORT.md

@@ -152,7 +152,7 @@ const Config = z.union([
 
 - stdio 是本地进程，密钥最终仍通过环境变量传递（如 `GITHUB_TOKEN`、`OPENAI_API_KEY`）。
 - 无凭据的 stdio 连接器使用 `auth.mode: "none"`；需要用户输入的卡片使用 `bearer` 或 `api-key`，并在 `auth.credentialFields` 声明一个或多个输入字段。
-- `servers[].credentialBindings` 只保存“环境变量名 → 凭据字段 key”的映射；`servers[].env` 只能包含非敏感默认值。
+- `servers[].credentialBindings` 只保存“环境变量名 → 凭据字段 key”的映射；OAuth stdio 只能用 `oauthResource` 引用同连接器的 HTTP resource，并通过 `oauthTokenEnv` 声明运行时 Token 环境变量。`servers[].env` 只能包含非敏感默认值。
 - 用户输入存入本机 `ConnectionRecord.env` 并透传给 `dsh-mcp-client`，不回写目录，也不出现在 catalog/status/log 输出。
 - Registry 探针只校验声明与命令形状，绝不执行本地 stdio 命令。
 
@@ -614,7 +614,7 @@ cwd: { type: 'string', description: 'transport=stdio 时的工作目录，默认
 | stdio `command` 可执行任意本地命令 | command 来自（a）维护者审核的 catalog，或（b）用户主动 configure，风险可控；DSH 运行时沙箱机制兜底 |
 | `env` 里的密钥泄露到日志 | dsh-mcp-client 的 `buildChildEnv` 已用 `scrubbedParentEnv()` 清理敏感父环境变量；我们持久化 env 到 storage domain 与现有 headers 鉴权一致，无新增泄露面 |
 | `cwd` 空字符串导致 spawn 异常 | provisioning 层显式 `record.cwd \|\| process.cwd()` |
-| 目录夹带密钥 | `auditRawDescriptor` 拒绝真实凭据字段，`auditDescriptor` 拒绝 `env` 中的 token/secret/API Key/password 类变量；只允许 `credentialBindings` 引用已声明字段 |
+| 目录夹带密钥 | `auditRawDescriptor` 拒绝真实凭据字段，`auditDescriptor` 拒绝 `env` 中的 token/secret/API Key/password 类变量；手工凭据只允许 `credentialBindings` 引用已声明字段，OAuth Token 只允许按同连接器 `oauthResource` 在运行时注入 `oauthTokenEnv` |
 | 凭据映射错误或未使用 | Schema 与目录审计检查字段 key、env 名、重复映射、未知引用及未被任何 HTTP/stdio Server 使用的必填字段 |
 
 ---

package/docs/USER-GUIDE.md

@@ -75,14 +75,14 @@ Bearer/API Key 连接器会先执行 MCP `initialize` 验证。所有 Server 通
 
 stdio 市场卡片也可能显示一个或多个凭据字段，例如 API Token、区域或租户标识。卡片目录只声明字段名称及其环境变量映射；提交后，真实值仅保存到 DSH 本机连接记录，并由插件注入该 stdio 进程的 `env`。市场、状态页和日志不会返回这些值。插件会等待 Host 完成首次 MCP 初始化与工具同步后再保存连接；失败或超时不会增加已安装数量，卡片也不会提前显示“已连接”。
 
-“企查查·智能文档解析”会一次配置两个互不冲突的入口，并共用同一份完整 `Authorization` 值（格式为 `Bearer YOUR_API_KEY`）：
+“企查查·智能文档解析”会通过一次 OAuth 一键授权配置两个互不冲突的入口：
 
 - `qcc-document`：远程 Agent，解析公网可访问的在线文档或图片 URL。
 - `qcc-document-mcp`：本地 Agent，通过 `npx -y qcc-document-mcp` 读取对话中上传、粘贴或指定路径的本机文件，自动上传并提交解析；要求 Node.js 20+。
 
-这里必须使用智能文档解析产品签发的 API Key，不是企查查 OAuth 登录令牌。旧版远程 `qcc-document` 的 OAuth 授权可以继续访问远程 MCP，但不能直接充当 `QCC_DOCUMENT_AUTHORIZATION`；本地上传网关会拒绝这种令牌。请从卡片的“前往企查查智能文档解析获取 API Key”入口取得凭据，且不要把真实值粘贴到对话、日志或截图中。
+点击“连接”后只需完成一次企查查 OAuth 授权，插件会同时注册上述两个 Server。OAuth Access Token 仅在运行时注入本地子进程的 `QCC_DOCUMENT_AUTHORIZATION`，不会写入市场目录、连接记录、页面状态或日志；Token 刷新后本地 Agent 会自动更新。从旧版手工 API Key 配置升级时，点击“升级一键授权”，只有在新授权与两个 Server 都启动成功后才会原子替换旧连接；失败会保留原配置。
 
-旧版本只配置过远程入口时，卡片会显示“补充本地解析”，不会把单入口误报为完整连接。重新录入一次 Authorization 后，插件先验证两个 Server，再原子保存；任一入口失败都不会留下半套配置。
+旧版本只配置过远程入口时，卡片会显示“升级一键授权”，不会把单入口误报为完整连接。完成 OAuth 后，插件先验证两个 Server，再原子保存；任一入口失败都不会留下半套配置。
 
 OAuth 一键连接要求服务商支持标准 OAuth 2.1/PKCE 和公开元数据发现。动态客户端注册既支持无需客户端密钥的 `none`，也支持服务商签发密钥的 `client_secret_post` 与 `client_secret_basic`。客户端密钥仅与 OAuth Grant 一同保存在 DSH 本机，用于换取、刷新和撤销 Token；插件不会要求用户把 OAuth Token 或客户端密钥复制到聊天中。如服务商在动态客户端注册阶段返回 HTTP 403，页面会明确提示“客户端注册被拒绝、尚未进入浏览器授权”；这通常需要服务商审核或登记客户端，重试用户授权无法绕过。
 

package/docs/screenshots/README.md

@@ -1,9 +1,9 @@
 # UI 素材说明
 
-本目录用于保存 `dsh-mcp-connector` 的公开界面截图。素材于 2026-08-30 从当前源码的
+本目录用于保存 `dsh-mcp-connector` 的公开界面截图。素材于 2026-09-06 从 `v0.2.37` 源码的
 无凭据 UI harness 采集：外层浏览器视口为 1280×720，harness 复刻产品宿主在
 `lib/client.js` 中定义的 800px 市场面板，因此桌面端稳定为一行 2 张卡片。公开 Registry
-快照含 79 条描述，与 4 张随包唯一卡片合并后市场显示 83 张。画面只展示公开市场元数据、
+快照含 105 条描述，与 4 张随包唯一卡片合并后市场显示 109 张。画面只展示公开市场元数据、
 示例 Prompt 和明确标识为 Mock 的工具数据，不包含 OAuth Token、API Key、本机路径、
 用户会话或查询结果。
 
@@ -21,8 +21,8 @@ SHA-256、尺寸与 GIF 时长。
 
 | 文件 | 展示内容 |
 |---|---|
-| `01-market-overview.jpg` | 83 张合并市场卡片、桌面两列、推荐章节、9 分类和固定分类栏；企查查卡片均为未连接的“连接”状态 |
-| `02-connector-detail.jpg` | Seedream 第三方服务说明、精选 Prompt 和未连接状态 |
+| `01-market-overview.jpg` | 109 张合并市场卡片、桌面两列、推荐章节、9 分类和固定分类栏；展示“企查查·智能文档解析”新名称与未配置状态 |
+| `02-connector-detail.jpg` | 智能文档解析一次 OAuth 授权同时连接 2 个 Server：远程 Agent 解析在线 URL，本地 Agent 通过 `npx -y qcc-document-mcp` 解析本机文件 |
 | `03-tool-discovery.jpg` | Context7 无凭据 Mock 健康状态、Mock 工具数量/描述、搜索和独立滚动区 |
 | `04-json-import.jpg` | Streamable HTTP / stdio JSON 导入与本机凭据提示 |
 

package/docs/screenshots/assets.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "capture": {
-    "capturedOn": "2026-08-30",
+    "capturedOn": "2026-09-06",
     "browserViewport": {
       "width": 1280,
       "height": 720
@@ -13,32 +13,32 @@
   "screenshots": [
     {
       "path": "docs/screenshots/01-market-overview.jpg",
-      "sha256": "856dc020a285752f4cd4a1c1025df9ce68ace2cd90ee1aa06c6b0699c78763f6",
+      "sha256": "9c9bc1c6f9e5b247c71ce283b86895b9e971f6283dc6eabaa9dbb1c42ae408c3",
       "width": 1280,
       "height": 720
     },
     {
       "path": "docs/screenshots/02-connector-detail.jpg",
-      "sha256": "0e15a26bbd21f8587b6354174d6d3411a6487e7a2df45d20c89f396b26f2ef65",
+      "sha256": "dbb7a1493378c30e743dd77c8a35c1779f443a2f8b720871de1efc61ee54eb27",
       "width": 1280,
       "height": 720
     },
     {
       "path": "docs/screenshots/03-tool-discovery.jpg",
-      "sha256": "ca1eccf06506c829fc23212eee39306e64c5781da9c1eff959d4b597d5df2f97",
+      "sha256": "5eeb896db75a5f141a8463f128f7733ffe89af6a447cecb2d1b19f8287a3e1ec",
       "width": 1280,
       "height": 720
     },
     {
       "path": "docs/screenshots/04-json-import.jpg",
-      "sha256": "2619ae8ba8f5d40131c6dfa2a367ee5ee64b8fee7782e5f4eddebd2a1cc79934",
+      "sha256": "de0a87cc7f247fad40ac37188f5a1d026f4087571e98d64595e80f8bcd9410be",
       "width": 1280,
       "height": 720
     }
   ],
   "demo": {
     "path": "docs/demo.gif",
-    "sha256": "4fa49853df79faa1c53d28938d79dd43bde3603712ecdc2e3b62d93a4c219d9a",
+    "sha256": "c9a84ce9c164c1b9f846f8b5a65afd8dd5c49741c9dfc530f1ad766e47b3d2b6",
     "width": 960,
     "height": 540,
     "durationSeconds": 16

package/lib/catalog.js

@@ -43,6 +43,11 @@ export function loadBundledCatalog() {
 
 /** 安全审计：目录禁止携带密钥、URL 协议白名单、header 名白名单。 */
 export function auditDescriptor(descriptor) {
+  const oauthHttpResources = new Set(
+    descriptor.servers
+      .filter((server) => server.transport === 'streamable-http')
+      .map((server) => server.url),
+  );
   const credentialFields = descriptor.auth.credentialFields ?? [];
   const credentialKeys = new Set();
   for (const field of credentialFields) {
@@ -59,7 +64,26 @@ export function auditDescriptor(descriptor) {
       }
       const bindings = server.credentialBindings ?? {};
       if (descriptor.auth.mode === 'oauth2-pkce') {
-        throw new Error(`connector "${descriptor.id}" 的 stdio server 不支持 auth.mode=oauth2-pkce`);
+        if (Object.keys(bindings).length > 0) {
+          throw new Error(`connector "${descriptor.id}" 的 OAuth stdio server 不能同时声明 credentialBindings`);
+        }
+        if (!server.oauthResource || !server.oauthTokenEnv) {
+          throw new Error(`connector "${descriptor.id}" 的 OAuth stdio server 必须声明 oauthResource 和 oauthTokenEnv`);
+        }
+        assertSafeUrl(server.oauthResource);
+        if (!oauthHttpResources.has(server.oauthResource)) {
+          throw new Error(`connector "${descriptor.id}" 的 OAuth stdio oauthResource 必须引用同一连接器的 HTTP resource`);
+        }
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(server.oauthTokenEnv)) {
+          throw new Error(`connector "${descriptor.id}" oauthTokenEnv 环境变量名非法: ${server.oauthTokenEnv}`);
+        }
+        if (Object.hasOwn(server.env ?? {}, server.oauthTokenEnv)) {
+          throw new Error(`connector "${descriptor.id}" oauthTokenEnv 与 servers[].env 重复声明: ${server.oauthTokenEnv}`);
+        }
+        continue;
+      }
+      if (server.oauthResource || server.oauthTokenEnv) {
+        throw new Error(`connector "${descriptor.id}" 只有 OAuth stdio server 可声明 oauthResource/oauthTokenEnv`);
       }
       if (descriptor.auth.mode === 'none' && Object.keys(bindings).length > 0) {
         throw new Error(`connector "${descriptor.id}" 的 stdio credentialBindings 需要 bearer/api-key 凭据定义`);
@@ -89,6 +113,9 @@ export function auditDescriptor(descriptor) {
       }
     }
   }
+  if (descriptor.auth.mode === 'oauth2-pkce' && oauthHttpResources.size === 0) {
+    throw new Error(`connector "${descriptor.id}" 的 OAuth 授权至少需要一个 HTTP resource`);
+  }
   if (['bearer', 'api-key'].includes(descriptor.auth.mode)) {
     const httpServers = descriptor.servers.filter((server) => server.transport === 'streamable-http');
     if (httpServers.length > 0 && credentialFields[0]) referencedCredentials.add(credentialFields[0].key);

package/lib/connectors/oauth-connector.js

@@ -88,8 +88,8 @@ export function describeOAuthAuthorizationError(error) {
  * @param {AbortSignal} [args.signal]
  */
 export async function oauthAuthorize({ connector, config, logger, signal }) {
-  const entryServer = connector.servers[0];
-  if (!entryServer) throw stagedError('resource-discovery', `connector "${connector.id}" has no servers`);
+  const entryServer = connector.servers.find((server) => server.url);
+  if (!entryServer) throw stagedError('resource-discovery', `connector "${connector.id}" has no HTTP OAuth resource`);
 
   const protectedResource = await atOAuthStage(
     'resource-discovery',
@@ -166,16 +166,16 @@ export async function oauthAuthorize({ connector, config, logger, signal }) {
     let grantedResources;
     if (grantedUrls) {
       const granted = new Set(grantedUrls);
-      const grantedServers = connector.servers.filter((s) => granted.has(s.url));
+      const grantedServers = connector.servers.filter((s) => granted.has(s.oauthResource ?? s.url));
       grantedKeys = grantedServers.map((s) => s.serverKey);
-      grantedResources = grantedServers.map((s) => s.url);
+      grantedResources = [...new Set(grantedServers.map((s) => s.oauthResource ?? s.url).filter(Boolean))];
       if (grantedKeys.length === 0) {
         grantedKeys = [entryServer.serverKey];
         grantedResources = [entryServer.url];
       }
     } else {
       grantedKeys = connector.servers.map((s) => s.serverKey);
-      grantedResources = connector.servers.map((s) => s.url);
+      grantedResources = [...new Set(connector.servers.map((s) => s.oauthResource ?? s.url).filter(Boolean))];
     }
 
     return {

package/lib/index.js

@@ -1051,7 +1051,7 @@ export async function apply(ctx, config) {
 
   function oauthResourceOrigins(connector) {
     return [...new Set((connector.servers ?? []).map((server) => {
-      try { return new URL(server.url).origin; } catch { return ''; }
+      try { return new URL(server.oauthResource ?? server.url).origin; } catch { return ''; }
     }).filter(Boolean))].sort();
   }
 
@@ -1084,6 +1084,7 @@ export async function apply(ctx, config) {
     const servers = [];
     for (const candidate of sharingConnectors) {
       for (const server of candidate.servers) {
+        if (!server.url) continue;
         if (seen.has(server.url)) continue;
         seen.add(server.url);
         servers.push({ ...server, serverKey: `${candidate.id}:${server.serverKey}` });
@@ -1097,7 +1098,7 @@ export async function apply(ctx, config) {
     const now = Date.now();
     const records = [];
     for (const connector of connectors) {
-      for (const server of connector.servers.filter((candidate) => granted.has(candidate.url))) {
+      for (const server of connector.servers.filter((candidate) => granted.has(candidate.oauthResource ?? candidate.url))) {
         records.push({
           key: `${connector.id}-${server.serverKey}`,
           connectorId: connector.id,
@@ -1106,6 +1107,11 @@ export async function apply(ctx, config) {
           serverKey: server.serverKey,
           transport: server.transport,
           url: server.url,
+          command: server.command,
+          args: server.args,
+          env: server.env,
+          oauthTokenEnv: server.oauthTokenEnv,
+          cwd: server.cwd,
           serverName: server.serverName,
           headers: server.headers,
           auth: { mode: 'oauth', grantKey },
@@ -1146,7 +1152,7 @@ export async function apply(ctx, config) {
           continue;
         }
       }
-      if (connector.servers.some((server) => entry.grant.authorizedResources.includes(server.url))) {
+      if (connector.servers.some((server) => entry.grant.authorizedResources.includes(server.oauthResource ?? server.url))) {
         return { grantKey, entry };
       }
     }
@@ -1757,6 +1763,8 @@ export async function apply(ctx, config) {
           command: s.command,
           args: s.args,
           credentialBindings: s.credentialBindings,
+          oauthResource: s.oauthResource,
+          oauthTokenEnv: s.oauthTokenEnv,
           transport: s.transport,
           serverName: s.serverName,
         })),

package/lib/mcp-provision.js

@@ -26,12 +26,17 @@ export function authHeaders(record, grants) {
 
 export function buildEntryConfig(record, grants, { failOnStartupError = false } = {}) {
   if (record.transport === 'stdio') {
+    const env = { ...(record.env ?? {}) };
+    if (record.auth?.mode === 'oauth' && record.oauthTokenEnv) {
+      const grant = record.auth.grantKey ? grants.get(record.auth.grantKey) : null;
+      if (grant?.accessToken) env[record.oauthTokenEnv] = `Bearer ${grant.accessToken}`;
+    }
     return {
       transport: 'stdio',
       serverName: record.serverName,
       command: record.command,
       args: record.args ?? [],
-      env: record.env ?? {},
+      env,
       cwd: record.cwd || process.cwd(),
       failOnStartupError,
     };

package/lib/schema.js

@@ -13,6 +13,8 @@ export const serverRefSchema = z.object({
   args: z.array(z.string()).optional(),
   env: z.record(z.string()).optional(),
   credentialBindings: z.record(z.string()).optional(),
+  oauthResource: z.string().min(1).optional(),
+  oauthTokenEnv: z.string().min(1).optional(),
   cwd: z.string().optional(),
   serverName: z.string().min(1),
   transport: z.enum(['streamable-http', 'sse', 'stdio']).optional(),
@@ -110,6 +112,7 @@ export const connectionRecordSchema = z.object({
   command: z.string().min(1).optional(),
   args: z.array(z.string()).optional(),
   env: z.record(z.string()).optional(),
+  oauthTokenEnv: z.string().min(1).optional(),
   cwd: z.string().optional(),
   serverName: z.string().min(1),
   headers: z.record(z.string()).optional(),
@@ -238,6 +241,8 @@ export function normalizeConnectorDescriptor(raw) {
       args: transport === 'stdio' ? (s.args ?? []) : undefined,
       env: transport === 'stdio' ? (s.env ?? {}) : undefined,
       credentialBindings: transport === 'stdio' ? (s.credentialBindings ?? {}) : undefined,
+      oauthResource: transport === 'stdio' ? s.oauthResource : undefined,
+      oauthTokenEnv: transport === 'stdio' ? s.oauthTokenEnv : undefined,
       cwd: transport === 'stdio' ? (s.cwd ?? '') : undefined,
       serverName: s.serverName,
       transport,
@@ -334,8 +339,9 @@ export function normalizeConnectionRecord(raw) {
     command: transport === 'stdio' ? data.command : undefined,
     args: transport === 'stdio' ? (data.args ?? []) : undefined,
     env: transport === 'stdio' ? (data.env ?? {}) : undefined,
+    oauthTokenEnv: transport === 'stdio' && data.auth?.mode === 'oauth' ? data.oauthTokenEnv : undefined,
     cwd: transport === 'stdio' ? (data.cwd ?? '') : undefined,
     headers: transport === 'streamable-http' ? (data.headers ?? {}) : {},
-    auth: transport === 'stdio' ? undefined : data.auth,
+    auth: transport === 'stdio' && data.auth?.mode !== 'oauth' ? undefined : data.auth,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "description": "DeepSeek Harness MCP Connector and MCP Server marketplace with over one hundred MCP connectors, continuously updated. Discover, authorize, and manage connections in one place; supports OAuth 2.0 PKCE, API keys, stdio/HTTP, mcpServers JSON import, and tool and prompt discovery. Maintained by Qichacha/QCC.",
   "type": "module",
   "main": "lib/index.js",

package/registry/schema/connector.schema.json

@@ -57,6 +57,8 @@
           "args": { "type": "array", "items": { "type": "string" } },
           "env": { "type": "object", "additionalProperties": { "type": "string" } },
           "credentialBindings": { "type": "object", "additionalProperties": { "type": "string" } },
+          "oauthResource": { "type": "string", "minLength": 1 },
+          "oauthTokenEnv": { "type": "string", "minLength": 1, "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" },
           "cwd": { "type": "string" },
           "serverName": { "type": "string", "minLength": 1 },
           "transport": { "enum": ["streamable-http", "stdio"] },

package/ui/index.html

@@ -521,7 +521,7 @@
     reauthorize: '需重新授权', recovering: '自动重试中', connectionError: '连接异常', partialError: '部分异常', disabled: '已停用',
     send: '发送', fillSend: '填写并发送', connectToUse: '连接后使用', try: '💬 去试试',
     connectTry: '🔗 连接后试用', configureConnect: '🔑 录入凭据并连接',
-    reconfigureCredential: '🔑 重新配置凭据', completeSetup: '补充本地解析', loading: '加载中…',
+    reconfigureCredential: '🔑 重新配置凭据', completeSetup: '补充本地解析', upgradeOauth: '升级一键授权', loading: '加载中…',
   };
   const t = (key) => LABELS[key] || key;
   const MCP_JSON_EXAMPLE = JSON.stringify({
@@ -1064,6 +1064,9 @@
     if (incomplete && ['bearer', 'api-key'].includes(d.authMode)) {
       return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.openConfig('${id}')">${t('completeSetup')}</button>`;
     }
+    if (incomplete && d.authMode === 'oauth2-pkce') {
+      return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.connect('${id}')">${t('upgradeOauth')}</button>`;
+    }
     if (configured) {
       if (state === 'healthy') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn ghost" disabled>${t('connected')}</button>`;
       if (state === 'unknown') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('unknown')}</button>`;
@@ -1630,7 +1633,7 @@
       $('#detail-disconnect-btn').style.display = d.connected?.length > 0 ? 'block' : 'none';
       const needsCredential = ['bearer', 'api-key'].includes(d.authMode);
       $('#detail-try-btn').textContent = detailNeedsReconfigure
-        ? detailFailureState === 'incomplete' ? t('completeSetup') : d.authMode === 'oauth2-pkce' && detailFailureState === 'reauth' ? '🔐 重新授权' : needsCredential && detailFailureState === 'reauth' ? t('reconfigureCredential') : '🔄 重新检查'
+        ? detailFailureState === 'incomplete' ? (d.authMode === 'oauth2-pkce' ? t('upgradeOauth') : t('completeSetup')) : d.authMode === 'oauth2-pkce' && detailFailureState === 'reauth' ? '🔐 重新授权' : needsCredential && detailFailureState === 'reauth' ? t('reconfigureCredential') : '🔄 重新检查'
         : d.connected?.length > 0 ? t('try') : needsCredential ? t('configureConnect') : t('connectTry');
       if (!d.connected?.length && !d.toolsSnapshot?.length) {
         $('#tools-summary').textContent = '连接后查看工具';
@@ -1677,7 +1680,7 @@
         ? `待补充 ${d.missingServers?.length || 1} 个服务`
         : `${detailFailureState === 'degraded' ? '部分服务可用' : '已连接'} ${d.connected?.length || 0} 个服务`;
       $('#detail-vendor').textContent = d.vendor ? `${d.vendor} · ${connectedLabel}` : connectedLabel;
-      $('#detail-try-btn').textContent = incomplete ? t('completeSetup') : t('try');
+      $('#detail-try-btn').textContent = incomplete ? (d.authMode === 'oauth2-pkce' ? t('upgradeOauth') : t('completeSetup')) : t('try');
       renderPromptPage();
       detailToolServers = toolsResult.detail?.servers || [];
       updateToolsSummary();
@@ -1773,6 +1776,17 @@
         openAddConnection('manual', detailConnector);
         return;
       }
+      if (detailFailureState === 'incomplete' && detailConnector?.authMode === 'oauth2-pkce') {
+        const id = detailConnector.id;
+        const r = await call('connect', { connectorId: id }, { timeoutMs: 310_000 });
+        showToast(r.message, r.ok);
+        if (r.ok) {
+          markCommunityCtaEligible();
+          await call('healthCheck', { connectorId: id });
+          await refreshConnectionUi(id);
+        }
+        return;
+      }
       if (detailFailureState === 'reauth' && detailConnector?.authMode === 'oauth2-pkce') {
         const id = detailConnector.id;
         const r = await call('connect', { connectorId: id }, { timeoutMs: 310_000 });