dsh-mcp-connector 0.2.36 → 0.2.38

package/CHANGELOG.md

@@ -4,6 +4,37 @@
 
 ## [Unreleased]
 
+## [0.2.38] - 2026-09-08
+
+### Added
+
+- 在 `设置 → 插件 → 插件配置` 新增“MCP连接器”卡片，可按当前 DSH profile 显示或隐藏侧边栏入口。
+- 设置卡片新增“打开 MCP连接器”快捷动作；入口隐藏后仍可随时打开、连接和管理 MCP Server，关闭弹框后返回原操作位置。
+
+### Changed
+
+- 侧边栏可见性保存后即时生效；仅隐藏入口，不影响插件、连接、工具、后台刷新或对话内调用。
+- Settings Host 与客户端服务均采用可选注入；旧版 DSH 或服务暂不可用时安全回退为显示侧边栏，避免升级后失去入口。
+
+### Verification
+
+- 205 项自动测试、lint、版本/营销元数据/商店截图门禁和 npm 发布包白名单/敏感内容扫描全部通过；新增覆盖 Host 设置注册、客户端持久化、快捷打开、隐藏态零挂载、键盘焦点恢复和兼容回退。
+
+## [0.2.37] - 2026-09-06
+
+### Changed
+
+- “企查查·智能文档解析”改为 OAuth 2.0 PKCE 一键授权，一次授权同时启用远程在线 URL 与本地文件解析两个 Server；无需再手工复制 API Key。
+- 更新产品截图和演示 GIF，同步当前 109 张市场卡片、智能文档解析名称及 OAuth 双入口说明。
+
+### Security
+
+- 新增受限制的 OAuth-to-stdio 运行时注入：目录必须将 `oauthResource` 精确绑定到同连接器的 HTTPS MCP resource，Access Token 只注入子进程声明的 `oauthTokenEnv`，不写入连接记录、市场输出或日志。
+
+### Fixed
+
+- 从旧版 API Key 单入口升级时显示“升级一键授权”；只有 OAuth 与远程/本地两个 Server 全部启动成功后才原子替换旧连接，失败时保留旧配置。
+
 ## [0.2.36] - 2026-09-06
 
 ### Changed
@@ -565,7 +596,9 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.36...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.38...HEAD
+[0.2.38]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.37...v0.2.38
+[0.2.37]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.36...v0.2.37
 [0.2.36]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.35...v0.2.36
 [0.2.35]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.34...v0.2.35
 [0.2.34]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.33...v0.2.34

package/README.en.md

@@ -26,7 +26,7 @@ Manage MCP connections from different providers in one place inside DeepSeek Har
 dsh plugin --profile web add dsh-mcp-connector
 ```
 
-Fully restart DeepSeek Harness Desktop or `dsh web` after installation or upgrade, then open **MCP Connector** in the primary sidebar.
+Fully restart DeepSeek Harness Desktop or `dsh web` after installation or upgrade, then open **MCP Connector** in the primary sidebar, or open it directly from **Settings → Plugins → Plugin Configuration → MCP Connector**.
 
 ![16-second MCP Connector walkthrough](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/demo.gif)
 
@@ -49,6 +49,7 @@ If the plugin helps you connect an MCP server faster, consider [starring the rep
 ## Features
 
 - A primary sidebar entry below New Conversation and above workspaces/conversations, with a public footer-slot fallback for incompatible DSH DOM versions.
+- A profile-wide sidebar visibility preference; even when the shortcut is hidden, the existing connector dialog remains available from **Settings → Plugins → Plugin Configuration → MCP Connector**.
 - Searchable Marketplace and Installed views; the default Marketplace groups cards into Featured plus nine business-category sections, previews four cards per section, keeps the category bar visible while scrolling, and shows every card when a single category is selected.
 - OAuth 2.0 Authorization Code with PKCE, including DCR public clients and `client_secret_post` / `client_secret_basic`; API key/Bearer/unauthenticated HTTP configuration, stdio local-process configuration, and `mcpServers` JSON import.
 - Installation from a credential-free connector descriptor URL.
@@ -97,7 +98,7 @@ Run the same command again to upgrade. Fully quit and restart DeepSeek Harness D
 
 ## Usage
 
-1. Select **MCP Connector** in the primary sidebar.
+1. Select **MCP Connector** in the primary sidebar, or choose **Open MCP Connector** from **Settings → Plugins → Plugin Configuration → MCP Connector**.
 2. Choose a connector, confirm **Current project** or **All projects (global)**, and complete authorization or configuration.
 3. Open its details to inspect tools or send an example prompt to a new conversation draft.
 4. Use Installed or the conversation tools to enable, disable, inspect, or disconnect a connection.
@@ -139,10 +140,13 @@ The default bundle configuration is in `cordis.patch.yml`:
     entryPrefix: mcp
     refreshSkewMs: 300000
     openBrowser: true
+    showSidebarEntry: true
 ```
 
 Set `catalogUrl` to an empty string for an explicitly offline/private setup. A custom non-default URL is used as-is and does not fall back to the public registry.
 
+`showSidebarEntry` defaults to `true`. Users can override it from the DSH plugin configuration page; turning it off hides only the shortcut and does not disable the connector, connected MCP servers, or tools.
+
 ## Compatibility and responsibility boundary
 
 | Area | Current boundary |
@@ -171,7 +175,7 @@ npm run dev:ui
 
 Every Registry merge regenerates `catalog-stats.json`; an hourly workflow in this repository synchronizes the Chinese and English product copy plus a local stats snapshot. The static npm README updates with package releases, while the live badges above read the Registry directly and therefore stay current without another npm release.
 
-The current public version is [`dsh-mcp-connector@0.2.36`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.36](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.36).
+The current public version is [`dsh-mcp-connector@0.2.38`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.38](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.38).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -26,7 +26,7 @@
 dsh plugin --profile web add dsh-mcp-connector
 ```
 
-安装或升级后完全重启 DeepSeek Harness Desktop 或 `dsh web`，然后打开左侧「🧩 MCP连接器」。
+安装或升级后完全重启 DeepSeek Harness Desktop 或 `dsh web`，然后打开左侧「🧩 MCP连接器」；也可从“设置 → 插件 → 插件配置 → MCP连接器”直接打开。
 
 ![MCP 连接器 16 秒演示](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/demo.gif)
 
@@ -49,6 +49,7 @@ dsh plugin --profile web add dsh-mcp-connector
 ## 功能
 
 - 左侧主导航入口：目标位置为“新会话”下方、“工作区/会话列表”上方；若 DSH DOM 结构不兼容，自动回退到底部公开插槽。
+- 侧边栏入口可按当前 profile 隐藏；隐藏后仍可从“设置 → 插件 → 插件配置 → MCP连接器”临时打开现有连接器弹框，用完即关。
 - 图形化市场：默认“全部”按推荐与 9 类业务分类分章节展示，每章先展示 4 张并可展开；分类栏固定可见，单分类页展示全部卡片。
 - 图形化添加：手动 HTTP/stdio、`mcpServers` JSON、连接器描述 URL 三种入口，失败时保留表单并给出修复建议。
 - 连接器详情：精选 Prompt 优先展示，点击可带入 DSH 新会话；工具按 Server 分组，支持描述、搜索和独立滚动。
@@ -99,7 +100,7 @@ bash <(curl -fsSL https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/m
 
 ## 使用
 
-1. 点击左侧“🧩 MCP连接器”。
+1. 点击左侧“🧩 MCP连接器”，或从“设置 → 插件 → 插件配置 → MCP连接器”点击“打开 MCP连接器”。
 2. 在市场中选择连接器，确认“当前项目”或“所有项目（全局）”，再完成授权或配置。
 3. 打开卡片详情，可点击示例 Prompt 的发送按钮，在当前工作区创建/复用空白会话并写入草稿。
 4. 在“已安装”或对话工具中查看、停用、恢复或断开连接。
@@ -135,10 +136,13 @@ Bundle 默认配置位于 `cordis.patch.yml`：
     entryPrefix: mcp
     refreshSkewMs: 300000
     openBrowser: true
+    showSidebarEntry: true
 ```
 
 `catalogUrl` 默认通过 jsDelivr CDN 读取公共 [dsh-mcp-connector-registry](https://github.com/duhu2000/dsh-mcp-connector-registry)，支持 ETag/TTL 缓存；主源失败时自动尝试 GitHub raw 备用源，再回退到上次缓存或随包内置目录。jsDelivr 的分支 URL 可能存在缓存延迟，因此 Registry 合并后的新卡片不保证秒级出现。需要离线/私有模式时可将 `catalogUrl` 显式设为空字符串；显式配置其他目录 URL 时不会自动切换到公共备用源。
 
+`showSidebarEntry` 默认为 `true`。用户可在 DSH 插件配置页覆盖该值；关闭后只隐藏侧边栏快捷入口，不停用连接器、已连接 MCP Server 或工具。
+
 ## 兼容性与责任边界
 
 | 项目 | 当前边界 |
@@ -167,7 +171,7 @@ npm run dev:ui
 
 公共 Registry 每次合并后会生成 `catalog-stats.json`；本仓库的定时工作流每小时同步中英文介绍和统计快照。npm 页面中的静态正文随版本发布更新，上方动态统计徽标则直接读取 Registry，可在不发布新 npm 版本时保持实时数量一致。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.36`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.36](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.36)。
+当前公开版本为 [`dsh-mcp-connector@0.2.38`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.38](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.38)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/catalog/catalog.json

@@ -136,29 +136,18 @@
       "icon": "/mcp-connector/ui/assets/qcc-logo.svg",
       "category": "效率工具",
       "summary": "本机文件 / 在线链接 · OCR 与结构化解析",
-      "description": "智能解析 PDF、图片等文档：远程入口处理公网可访问的在线链接，本地入口读取对话中上传、粘贴或指定路径的本机文件并自动提交解析，输出 Markdown 与结构化内容。本地入口需 Node.js 20+。",
+      "description": "一次 OAuth 授权同时连接远程与本地 Agent：远程入口解析公网 PDF/图片 URL，本地入口读取对话中上传、粘贴或指定路径的本机文件，自动上传并输出 Markdown 与结构化内容。本地入口需 Node.js 20+。",
       "tags": ["智能文档解析", "OCR", "本机文件", "在线文档", "PDF", "图片", "Markdown"],
       "published": true,
       "featured": true,
       "homepage": "https://agent.qcc.com/doc",
       "auth": {
-        "mode": "api-key",
-        "apiKeyHeader": "Authorization",
-        "credentialName": "智能文档解析 API Key Authorization",
-        "credentialPlaceholder": "Bearer YOUR_API_KEY",
-        "credentialDescription": "请输入智能文档解析产品签发的完整 Authorization 值（Bearer + 空格 + API Key），不是企查查 OAuth 登录令牌。一次配置后，远程在线链接与本地文件解析共用此凭据。",
-        "credentialHelpLabel": "前往企查查智能文档解析获取 API Key",
-        "credentialFields": [
-          {
-            "key": "authorization",
-            "label": "Authorization",
-            "placeholder": "Bearer YOUR_API_KEY",
-            "description": "格式为 Bearer + 空格 + 智能文档解析 API Key；OAuth 登录令牌不能用于本地文件上传。凭据仅保存在 DSH 本机。",
-            "helpLabel": "前往企查查智能文档解析获取 API Key",
-            "required": true,
-            "secret": true
-          }
-        ]
+        "mode": "oauth2-pkce",
+        "issuer": "https://agent.qcc.com",
+        "scope": "mcp:tools",
+        "clientName": "DeepSeek Harness - MCP 连接器",
+        "tokenEndpointAuthMethod": "none",
+        "grantSharing": "issuer"
       },
       "servers": [
         { "serverKey": "document", "url": "https://agent.qcc.com/mcp/document/stream", "serverName": "qcc-document", "transport": "streamable-http", "headers": {} },
@@ -168,7 +157,8 @@
           "transport": "stdio",
           "command": "npx",
           "args": ["-y", "qcc-document-mcp"],
-          "credentialBindings": { "QCC_DOCUMENT_AUTHORIZATION": "authorization" }
+          "oauthResource": "https://agent.qcc.com/mcp/document/stream",
+          "oauthTokenEnv": "QCC_DOCUMENT_AUTHORIZATION"
         }
       ],
       "prompts": [

package/cordis.patch.yml

@@ -10,3 +10,4 @@
         entryPrefix: 'mcp'
         refreshSkewMs: 300000
         openBrowser: true
+        showSidebarEntry: true

package/docs/STDIO-SUPPORT.md

@@ -152,7 +152,7 @@ const Config = z.union([
 
 - stdio 是本地进程，密钥最终仍通过环境变量传递（如 `GITHUB_TOKEN`、`OPENAI_API_KEY`）。
 - 无凭据的 stdio 连接器使用 `auth.mode: "none"`；需要用户输入的卡片使用 `bearer` 或 `api-key`，并在 `auth.credentialFields` 声明一个或多个输入字段。
-- `servers[].credentialBindings` 只保存“环境变量名 → 凭据字段 key”的映射；`servers[].env` 只能包含非敏感默认值。
+- `servers[].credentialBindings` 只保存“环境变量名 → 凭据字段 key”的映射；OAuth stdio 只能用 `oauthResource` 引用同连接器的 HTTP resource，并通过 `oauthTokenEnv` 声明运行时 Token 环境变量。`servers[].env` 只能包含非敏感默认值。
 - 用户输入存入本机 `ConnectionRecord.env` 并透传给 `dsh-mcp-client`，不回写目录，也不出现在 catalog/status/log 输出。
 - Registry 探针只校验声明与命令形状，绝不执行本地 stdio 命令。
 
@@ -614,7 +614,7 @@ cwd: { type: 'string', description: 'transport=stdio 时的工作目录，默认
 | stdio `command` 可执行任意本地命令 | command 来自（a）维护者审核的 catalog，或（b）用户主动 configure，风险可控；DSH 运行时沙箱机制兜底 |
 | `env` 里的密钥泄露到日志 | dsh-mcp-client 的 `buildChildEnv` 已用 `scrubbedParentEnv()` 清理敏感父环境变量；我们持久化 env 到 storage domain 与现有 headers 鉴权一致，无新增泄露面 |
 | `cwd` 空字符串导致 spawn 异常 | provisioning 层显式 `record.cwd \|\| process.cwd()` |
-| 目录夹带密钥 | `auditRawDescriptor` 拒绝真实凭据字段，`auditDescriptor` 拒绝 `env` 中的 token/secret/API Key/password 类变量；只允许 `credentialBindings` 引用已声明字段 |
+| 目录夹带密钥 | `auditRawDescriptor` 拒绝真实凭据字段，`auditDescriptor` 拒绝 `env` 中的 token/secret/API Key/password 类变量；手工凭据只允许 `credentialBindings` 引用已声明字段，OAuth Token 只允许按同连接器 `oauthResource` 在运行时注入 `oauthTokenEnv` |
 | 凭据映射错误或未使用 | Schema 与目录审计检查字段 key、env 名、重复映射、未知引用及未被任何 HTTP/stdio Server 使用的必填字段 |
 
 ---

package/docs/USER-GUIDE.md

@@ -34,7 +34,12 @@ dsh web
 
 ## 2. 打开 MCP连接器
 
-重启后，在 DSH 左侧主导航点击“🧩 MCP连接器”。入口通常位于“新会话”下方、工作区/会话列表上方；如果当前 DSH 版本没有对应的公开插槽，入口会回退到左侧底部。
+重启后，可以用以下任一方式打开：
+
+- 在 DSH 左侧主导航点击“🧩 MCP连接器”。入口通常位于“新会话”下方、工作区/会话列表上方；如果当前 DSH 版本没有对应的公开插槽，入口会回退到左侧底部。
+- 打开“设置 → 插件 → 插件配置 → MCP连接器”，展开卡片并点击“打开 MCP连接器”。该按钮直接复用同一个连接器弹框，不要求侧边栏入口可见；关闭弹框后仍回到设置页。
+
+如需腾出侧边栏空间，可在同一配置卡片关闭“在侧边栏显示 MCP连接器”。该偏好作用于当前 DSH profile，并在重启后保留；它只隐藏快捷入口，不停用插件、已连接 MCP Server 或工具。隐藏后可以随时从该配置卡片直接打开连接器，或重新开启入口。旧版 DSH 没有 Settings 能力时，插件保持入口可见，不会因设置功能进入 Safe Mode。
 
 页面顶部提供：
 
@@ -75,14 +80,14 @@ Bearer/API Key 连接器会先执行 MCP `initialize` 验证。所有 Server 通
 
 stdio 市场卡片也可能显示一个或多个凭据字段，例如 API Token、区域或租户标识。卡片目录只声明字段名称及其环境变量映射；提交后，真实值仅保存到 DSH 本机连接记录，并由插件注入该 stdio 进程的 `env`。市场、状态页和日志不会返回这些值。插件会等待 Host 完成首次 MCP 初始化与工具同步后再保存连接；失败或超时不会增加已安装数量，卡片也不会提前显示“已连接”。
 
-“企查查·智能文档解析”会一次配置两个互不冲突的入口，并共用同一份完整 `Authorization` 值（格式为 `Bearer YOUR_API_KEY`）：
+“企查查·智能文档解析”会通过一次 OAuth 一键授权配置两个互不冲突的入口：
 
 - `qcc-document`：远程 Agent，解析公网可访问的在线文档或图片 URL。
 - `qcc-document-mcp`：本地 Agent，通过 `npx -y qcc-document-mcp` 读取对话中上传、粘贴或指定路径的本机文件，自动上传并提交解析；要求 Node.js 20+。
 
-这里必须使用智能文档解析产品签发的 API Key，不是企查查 OAuth 登录令牌。旧版远程 `qcc-document` 的 OAuth 授权可以继续访问远程 MCP，但不能直接充当 `QCC_DOCUMENT_AUTHORIZATION`；本地上传网关会拒绝这种令牌。请从卡片的“前往企查查智能文档解析获取 API Key”入口取得凭据，且不要把真实值粘贴到对话、日志或截图中。
+点击“连接”后只需完成一次企查查 OAuth 授权，插件会同时注册上述两个 Server。OAuth Access Token 仅在运行时注入本地子进程的 `QCC_DOCUMENT_AUTHORIZATION`，不会写入市场目录、连接记录、页面状态或日志；Token 刷新后本地 Agent 会自动更新。从旧版手工 API Key 配置升级时，点击“升级一键授权”，只有在新授权与两个 Server 都启动成功后才会原子替换旧连接；失败会保留原配置。
 
-旧版本只配置过远程入口时，卡片会显示“补充本地解析”，不会把单入口误报为完整连接。重新录入一次 Authorization 后，插件先验证两个 Server，再原子保存；任一入口失败都不会留下半套配置。
+旧版本只配置过远程入口时，卡片会显示“升级一键授权”，不会把单入口误报为完整连接。完成 OAuth 后，插件先验证两个 Server，再原子保存；任一入口失败都不会留下半套配置。
 
 OAuth 一键连接要求服务商支持标准 OAuth 2.1/PKCE 和公开元数据发现。动态客户端注册既支持无需客户端密钥的 `none`，也支持服务商签发密钥的 `client_secret_post` 与 `client_secret_basic`。客户端密钥仅与 OAuth Grant 一同保存在 DSH 本机，用于换取、刷新和撤销 Token；插件不会要求用户把 OAuth Token 或客户端密钥复制到聊天中。如服务商在动态客户端注册阶段返回 HTTP 403，页面会明确提示“客户端注册被拒绝、尚未进入浏览器授权”；这通常需要服务商审核或登记客户端，重试用户授权无法绕过。
 

package/docs/screenshots/README.md

@@ -1,9 +1,9 @@
 # UI 素材说明
 
-本目录用于保存 `dsh-mcp-connector` 的公开界面截图。素材于 2026-08-30 从当前源码的
+本目录用于保存 `dsh-mcp-connector` 的公开界面截图。素材于 2026-09-06 从 `v0.2.37` 源码的
 无凭据 UI harness 采集：外层浏览器视口为 1280×720，harness 复刻产品宿主在
 `lib/client.js` 中定义的 800px 市场面板，因此桌面端稳定为一行 2 张卡片。公开 Registry
-快照含 79 条描述，与 4 张随包唯一卡片合并后市场显示 83 张。画面只展示公开市场元数据、
+快照含 105 条描述，与 4 张随包唯一卡片合并后市场显示 109 张。画面只展示公开市场元数据、
 示例 Prompt 和明确标识为 Mock 的工具数据，不包含 OAuth Token、API Key、本机路径、
 用户会话或查询结果。
 
@@ -21,8 +21,8 @@ SHA-256、尺寸与 GIF 时长。
 
 | 文件 | 展示内容 |
 |---|---|
-| `01-market-overview.jpg` | 83 张合并市场卡片、桌面两列、推荐章节、9 分类和固定分类栏；企查查卡片均为未连接的“连接”状态 |
-| `02-connector-detail.jpg` | Seedream 第三方服务说明、精选 Prompt 和未连接状态 |
+| `01-market-overview.jpg` | 109 张合并市场卡片、桌面两列、推荐章节、9 分类和固定分类栏；展示“企查查·智能文档解析”新名称与未配置状态 |
+| `02-connector-detail.jpg` | 智能文档解析一次 OAuth 授权同时连接 2 个 Server：远程 Agent 解析在线 URL，本地 Agent 通过 `npx -y qcc-document-mcp` 解析本机文件 |
 | `03-tool-discovery.jpg` | Context7 无凭据 Mock 健康状态、Mock 工具数量/描述、搜索和独立滚动区 |
 | `04-json-import.jpg` | Streamable HTTP / stdio JSON 导入与本机凭据提示 |
 

package/docs/screenshots/assets.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "capture": {
-    "capturedOn": "2026-08-30",
+    "capturedOn": "2026-09-06",
     "browserViewport": {
       "width": 1280,
       "height": 720
@@ -13,32 +13,32 @@
   "screenshots": [
     {
       "path": "docs/screenshots/01-market-overview.jpg",
-      "sha256": "856dc020a285752f4cd4a1c1025df9ce68ace2cd90ee1aa06c6b0699c78763f6",
+      "sha256": "9c9bc1c6f9e5b247c71ce283b86895b9e971f6283dc6eabaa9dbb1c42ae408c3",
       "width": 1280,
       "height": 720
     },
     {
       "path": "docs/screenshots/02-connector-detail.jpg",
-      "sha256": "0e15a26bbd21f8587b6354174d6d3411a6487e7a2df45d20c89f396b26f2ef65",
+      "sha256": "dbb7a1493378c30e743dd77c8a35c1779f443a2f8b720871de1efc61ee54eb27",
       "width": 1280,
       "height": 720
     },
     {
       "path": "docs/screenshots/03-tool-discovery.jpg",
-      "sha256": "ca1eccf06506c829fc23212eee39306e64c5781da9c1eff959d4b597d5df2f97",
+      "sha256": "5eeb896db75a5f141a8463f128f7733ffe89af6a447cecb2d1b19f8287a3e1ec",
       "width": 1280,
       "height": 720
     },
     {
       "path": "docs/screenshots/04-json-import.jpg",
-      "sha256": "2619ae8ba8f5d40131c6dfa2a367ee5ee64b8fee7782e5f4eddebd2a1cc79934",
+      "sha256": "de0a87cc7f247fad40ac37188f5a1d026f4087571e98d64595e80f8bcd9410be",
       "width": 1280,
       "height": 720
     }
   ],
   "demo": {
     "path": "docs/demo.gif",
-    "sha256": "4fa49853df79faa1c53d28938d79dd43bde3603712ecdc2e3b62d93a4c219d9a",
+    "sha256": "c9a84ce9c164c1b9f846f8b5a65afd8dd5c49741c9dfc530f1ad766e47b3d2b6",
     "width": 960,
     "height": 540,
     "durationSeconds": 16

package/lib/catalog.js

@@ -43,6 +43,11 @@ export function loadBundledCatalog() {
 
 /** 安全审计：目录禁止携带密钥、URL 协议白名单、header 名白名单。 */
 export function auditDescriptor(descriptor) {
+  const oauthHttpResources = new Set(
+    descriptor.servers
+      .filter((server) => server.transport === 'streamable-http')
+      .map((server) => server.url),
+  );
   const credentialFields = descriptor.auth.credentialFields ?? [];
   const credentialKeys = new Set();
   for (const field of credentialFields) {
@@ -59,7 +64,26 @@ export function auditDescriptor(descriptor) {
       }
       const bindings = server.credentialBindings ?? {};
       if (descriptor.auth.mode === 'oauth2-pkce') {
-        throw new Error(`connector "${descriptor.id}" 的 stdio server 不支持 auth.mode=oauth2-pkce`);
+        if (Object.keys(bindings).length > 0) {
+          throw new Error(`connector "${descriptor.id}" 的 OAuth stdio server 不能同时声明 credentialBindings`);
+        }
+        if (!server.oauthResource || !server.oauthTokenEnv) {
+          throw new Error(`connector "${descriptor.id}" 的 OAuth stdio server 必须声明 oauthResource 和 oauthTokenEnv`);
+        }
+        assertSafeUrl(server.oauthResource);
+        if (!oauthHttpResources.has(server.oauthResource)) {
+          throw new Error(`connector "${descriptor.id}" 的 OAuth stdio oauthResource 必须引用同一连接器的 HTTP resource`);
+        }
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(server.oauthTokenEnv)) {
+          throw new Error(`connector "${descriptor.id}" oauthTokenEnv 环境变量名非法: ${server.oauthTokenEnv}`);
+        }
+        if (Object.hasOwn(server.env ?? {}, server.oauthTokenEnv)) {
+          throw new Error(`connector "${descriptor.id}" oauthTokenEnv 与 servers[].env 重复声明: ${server.oauthTokenEnv}`);
+        }
+        continue;
+      }
+      if (server.oauthResource || server.oauthTokenEnv) {
+        throw new Error(`connector "${descriptor.id}" 只有 OAuth stdio server 可声明 oauthResource/oauthTokenEnv`);
       }
       if (descriptor.auth.mode === 'none' && Object.keys(bindings).length > 0) {
         throw new Error(`connector "${descriptor.id}" 的 stdio credentialBindings 需要 bearer/api-key 凭据定义`);
@@ -89,6 +113,9 @@ export function auditDescriptor(descriptor) {
       }
     }
   }
+  if (descriptor.auth.mode === 'oauth2-pkce' && oauthHttpResources.size === 0) {
+    throw new Error(`connector "${descriptor.id}" 的 OAuth 授权至少需要一个 HTTP resource`);
+  }
   if (['bearer', 'api-key'].includes(descriptor.auth.mode)) {
     const httpServers = descriptor.servers.filter((server) => server.transport === 'streamable-http');
     if (httpServers.length > 0 && credentialFields[0]) referencedCredentials.add(credentialFields[0].key);

package/lib/client.js

@@ -23,6 +23,8 @@ window.__ModuleLoader__.load({
 		const VERSION_CHECK_RETRY_MS = 5 * 60 * 1e3;
 		const NPM_PACKAGE_URL = "https://www.npmjs.com/package/dsh-mcp-connector";
 		const PLUGIN_PACKAGE_NAME = "dsh-mcp-connector";
+		const CONNECTOR_SETTINGS_NAMESPACE = "mcp-connector";
+		const SHOW_SIDEBAR_ENTRY_FIELD = "showSidebarEntry";
 		const UPDATE_PROVIDER_OPERATION_POLL_MS = 1e3;
 		const UPDATE_PROVIDER_ADAPTERS = Object.freeze([
 			createHttpUpdateProviderAdapter({
@@ -110,6 +112,9 @@ window.__ModuleLoader__.load({
 .mcpConnectorTopEntry[data-wide="false"] .mcpConnectorLauncher {
 	margin: 0 0 8px;
 }
+`;
+		const OVERLAY_STYLE_ID = "dsh-mcp-connector-overlay";
+		const overlayCss = `
 
 .mcpConnectorMarketPanel { background: #ffffff; color: #111827; }
 .mcpConnectorMarketHeader { border-color: #e5e7eb; }
@@ -218,19 +223,189 @@ window.__ModuleLoader__.load({
 	.mcpConnectorMarketClose:hover,
 	.mcpConnectorMarketClose:focus-visible { background: #30343d !important; color: #ffffff; }
 }
+`;
+		const SETTINGS_STYLE_ID = "dsh-mcp-connector-settings";
+		const settingsCss = `
+.mcpConnectorSettingsCard {
+	border: 1px solid var(--dsw-alias-border-l2, rgba(127, 127, 127, 0.28));
+	background: var(--dsw-alias-bg-layer-3, transparent);
+	border-radius: 12px;
+	list-style: none;
+}
+.mcpConnectorSettingsCard[data-open="true"] {
+	background: var(--dsw-alias-bg-layer-2, rgba(127, 127, 127, 0.06));
+	border-color: var(--dsw-alias-label-dimmed, rgba(127, 127, 127, 0.5));
+}
+.mcpConnectorSettingsHeader {
+	appearance: none;
+	display: flex;
+	align-items: center;
+	gap: 12px;
+	width: 100%;
+	padding: 14px 16px;
+	border: 0;
+	border-radius: 12px;
+	color: inherit;
+	background: transparent;
+	font: inherit;
+	text-align: left;
+	cursor: pointer;
+}
+.mcpConnectorSettingsHeader:focus-visible,
+.mcpConnectorSettingsButton:focus-visible,
+.mcpConnectorSettingsSwitch:focus-visible {
+	outline: 2px solid var(--dsw-alias-brand-primary, currentColor);
+	outline-offset: 2px;
+}
+.mcpConnectorSettingsHeadText {
+	display: flex;
+	flex: 1;
+	flex-direction: column;
+	gap: 4px;
+	min-width: 0;
+}
+.mcpConnectorSettingsName {
+	color: var(--dsw-alias-label-primary, inherit);
+	font-size: 15px;
+	font-weight: 600;
+	line-height: 1.4;
+}
+.mcpConnectorSettingsDescription,
+.mcpConnectorSettingsHint,
+.mcpConnectorSettingsState {
+	color: var(--dsw-alias-label-tertiary, rgba(127, 127, 127, 0.9));
+	font-size: 13px;
+	line-height: 1.5;
+}
+.mcpConnectorSettingsChevron {
+	flex: none;
+	color: var(--dsw-alias-label-tertiary, currentColor);
+	font-size: 16px;
+	transition: transform 0.16s;
+}
+.mcpConnectorSettingsCard[data-open="true"] .mcpConnectorSettingsChevron {
+	transform: rotate(180deg);
+}
+.mcpConnectorSettingsBody {
+	margin: 0 16px;
+	padding: 14px 0 10px;
+	border-top: 1px solid var(--dsw-alias-border-l2, rgba(127, 127, 127, 0.28));
+}
+.mcpConnectorSettingsRow {
+	display: grid;
+	grid-template-columns: minmax(0, 1fr) auto;
+	align-items: center;
+	gap: 18px;
+}
+.mcpConnectorSettingsLabel {
+	display: block;
+	color: var(--dsw-alias-label-primary, inherit);
+	font-size: 14px;
+	font-weight: 600;
+}
+.mcpConnectorSettingsHint {
+	display: block;
+	margin-top: 5px;
+}
+.mcpConnectorSettingsSwitch {
+	position: relative;
+	appearance: none;
+	width: 42px;
+	height: 24px;
+	margin: 0;
+	border: 0;
+	border-radius: 999px;
+	background: var(--dsw-alias-fill-secondary, rgba(127, 127, 127, 0.35));
+	cursor: pointer;
+	transition: background 0.16s;
+}
+.mcpConnectorSettingsSwitch::after {
+	position: absolute;
+	top: 3px;
+	left: 3px;
+	width: 18px;
+	height: 18px;
+	border-radius: 50%;
+	background: #ffffff;
+	box-shadow: 0 1px 3px rgba(0, 0, 0, 0.28);
+	content: "";
+	transition: transform 0.16s;
+}
+.mcpConnectorSettingsSwitch:checked {
+	background: var(--dsw-alias-state-success, #16a34a);
+}
+.mcpConnectorSettingsSwitch:checked::after {
+	transform: translateX(18px);
+}
+.mcpConnectorSettingsSwitch:disabled {
+	cursor: default;
+	opacity: 0.55;
+}
+.mcpConnectorSettingsFooter {
+	display: flex;
+	align-items: center;
+	flex-wrap: wrap;
+	gap: 8px;
+	margin-top: 14px;
+	padding-top: 12px;
+	border-top: 1px solid var(--dsw-alias-border-l2, rgba(127, 127, 127, 0.28));
+}
+.mcpConnectorSettingsState {
+	flex: 1 1 210px;
+	margin: 0;
+}
+.mcpConnectorSettingsState[data-tone="error"] {
+	color: var(--dsw-alias-label-error, #b91c1c);
+}
+.mcpConnectorSettingsButton {
+	appearance: none;
+	padding: 6px 12px;
+	border: 1px solid var(--dsw-alias-border-l2, rgba(127, 127, 127, 0.28));
+	border-radius: 8px;
+	color: var(--dsw-alias-label-secondary, inherit);
+	background: transparent;
+	font: inherit;
+	font-size: 13px;
+	cursor: pointer;
+}
+.mcpConnectorSettingsButton[data-primary="true"] {
+	border-color: transparent;
+	color: var(--dsw-alias-bg-layer-3, #ffffff);
+	background: var(--dsw-alias-label-primary, #111827);
+}
+.mcpConnectorSettingsButton:disabled {
+	cursor: default;
+	opacity: 0.45;
+}
+@media (max-width: 520px) {
+	.mcpConnectorSettingsRow { grid-template-columns: 1fr; }
+	.mcpConnectorSettingsFooter .mcpConnectorSettingsButton { flex: 1 1 140px; }
+}
 `;
 		const SIDEBAR_WORKSPACES_SELECTOR = '[data-slot="sidebar.workspaces"]';
 		const TOP_MOUNT_SELECTOR = '[data-mcp-connector-top-mount="true"]';
 
-		function installSidebarStyles() {
-			if (document.querySelector(`style[data-plugin="${SIDEBAR_STYLE_ID}"]`) !== null) return () => {};
+		function installStyles(id, css) {
+			if (document.querySelector(`style[data-plugin="${id}"]`) !== null) return () => {};
 			const style = document.createElement("style");
-			style.dataset.plugin = SIDEBAR_STYLE_ID;
-			style.textContent = sidebarCss;
+			style.dataset.plugin = id;
+			style.textContent = css;
 			document.head.append(style);
 			return () => { style.remove(); };
 		}
 
+		function installSidebarStyles() {
+			return installStyles(SIDEBAR_STYLE_ID, sidebarCss);
+		}
+
+		function installOverlayStyles() {
+			return installStyles(OVERLAY_STYLE_ID, overlayCss);
+		}
+
+		function installSettingsStyles() {
+			return installStyles(SETTINGS_STYLE_ID, settingsCss);
+		}
+
 		/**
 		 * DSH rc.7 没有公开的「新会话与工作区之间」插槽。插件仍注册在公开的
 		 * footer list slot 中保证生命周期与降级可用，再把实际按钮 Portal 到
@@ -548,17 +723,24 @@ window.__ModuleLoader__.load({
 		 * 包名或客户端模块到达顺序让整个 Desktop 进入 Safe Mode。
 		 */
 		function createMarketViewStore() {
+			let sidebarVisible = true;
+			const liveActions = new Set();
 			const spec = {
-				init: () => ({ open: false, detailOpen: false }),
+				init: () => ({ open: false, detailOpen: false, sidebarVisible }),
 				actions: {
 					open: (draft) => { draft.open = true; },
 					close: (draft) => { draft.open = false; draft.detailOpen = false; },
 					detailOpened: (draft) => { draft.detailOpen = true; },
-					detailClosed: (draft) => { draft.detailOpen = false; }
+					detailClosed: (draft) => { draft.detailOpen = false; },
+					setSidebarVisible: (draft, visible) => { draft.sidebarVisible = visible !== false; }
 				}
 			};
 			return {
 				spec,
+				syncSidebarVisible(visible) {
+					sidebarVisible = visible !== false;
+					for (const actions of liveActions) actions.setSidebarVisible(sidebarVisible);
+				},
 				create() {
 					let state = spec.init();
 					const listeners = new Set();
@@ -571,6 +753,7 @@ window.__ModuleLoader__.load({
 							for (const listener of listeners) listener();
 						};
 					}
+					liveActions.add(actions);
 					return {
 						actions,
 						getSnapshot: () => state,
@@ -578,12 +761,216 @@ window.__ModuleLoader__.load({
 							listeners.add(listener);
 							return () => { listeners.delete(listener); };
 						},
-						clearPersisted() {}
+						clearPersisted() {
+							liveActions.delete(actions);
+							listeners.clear();
+						}
 					};
 				}
 			};
 		}
 
+		function resolveSidebarVisible(snapshot) {
+			return snapshot?.status === "ready"
+				? snapshot.value?.[SHOW_SIDEBAR_ENTRY_FIELD] !== false
+				: true;
+		}
+
+		function connectorSettingsCopy() {
+			const language = document.documentElement?.lang || window.navigator?.language || "zh";
+			if (String(language).toLowerCase().startsWith("en")) {
+				return {
+					title: "MCP Connector",
+					description: "Control how the MCP Connector is opened.",
+					show: "Show MCP Connector in the sidebar",
+					hint: "Turning this off only hides the shortcut. Connected MCP servers and tools remain available.",
+					visible: "The sidebar shortcut is visible.",
+					hidden: "The shortcut is hidden. You can still open MCP Connector here.",
+					readOnly: "This settings page is read-only.",
+					saving: "Saving…",
+					failed: "The setting was not saved. Please try again.",
+					reset: "Reset",
+					open: "Open MCP Connector",
+					expand: "Expand MCP Connector settings",
+					collapse: "Collapse MCP Connector settings"
+				};
+			}
+			return {
+				title: "MCP连接器",
+				description: "控制侧边栏入口和快捷打开方式。",
+				show: "在侧边栏显示 MCP连接器",
+				hint: "关闭后只隐藏入口，不影响已连接的 MCP Server 和工具。",
+				visible: "侧边栏入口当前显示。",
+				hidden: "入口已隐藏，仍可从这里打开 MCP连接器。",
+				readOnly: "当前设置页只读。",
+				saving: "正在保存…",
+				failed: "设置未保存，请重试。",
+				reset: "恢复默认",
+				open: "打开 MCP连接器",
+				expand: "展开 MCP连接器设置",
+				collapse: "收起 MCP连接器设置"
+			};
+		}
+
+		function ConnectorSettingsCard(props) {
+			const { settingsScope, actions } = props;
+			const copy = connectorSettingsCopy();
+			const snapshot = (0, react.useSyncExternalStore)(
+				(listener) => settingsScope.subscribe(listener),
+				() => settingsScope.getSnapshot()
+			);
+			const [open, setOpen] = (0, react.useState)(false);
+			const [saving, setSaving] = (0, react.useState)(false);
+			const [failed, setFailed] = (0, react.useState)(false);
+			if (snapshot.status !== "ready") return null;
+			const visible = resolveSidebarVisible(snapshot);
+			const writable = snapshot.writable === true;
+			const overridden = snapshot.user !== null
+				&& typeof snapshot.user === "object"
+				&& Object.prototype.hasOwnProperty.call(snapshot.user, SHOW_SIDEBAR_ENTRY_FIELD);
+
+			const save = async (next) => {
+				setSaving(true);
+				setFailed(false);
+				try {
+					await settingsScope.set(SHOW_SIDEBAR_ENTRY_FIELD, next);
+					const confirmed = settingsScope.getSnapshot();
+					setFailed(confirmed.status !== "ready" || resolveSidebarVisible(confirmed) !== next);
+				} catch (error) {
+					console.error("[mcp-connector] sidebar setting update failed:", error);
+					setFailed(true);
+				} finally {
+					setSaving(false);
+				}
+			};
+
+			const reset = async () => {
+				setSaving(true);
+				setFailed(false);
+				try {
+					await settingsScope.unset(SHOW_SIDEBAR_ENTRY_FIELD);
+					const confirmed = settingsScope.getSnapshot();
+					const stillOverridden = confirmed.user !== null
+						&& typeof confirmed.user === "object"
+						&& Object.prototype.hasOwnProperty.call(confirmed.user, SHOW_SIDEBAR_ENTRY_FIELD);
+					setFailed(confirmed.status !== "ready" || stillOverridden);
+				} catch (error) {
+					console.error("[mcp-connector] sidebar setting reset failed:", error);
+					setFailed(true);
+				} finally {
+					setSaving(false);
+				}
+			};
+
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
+				className: "mcpConnectorSettingsCard",
+				"data-open": open,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+						type: "button",
+						className: "mcpConnectorSettingsHeader",
+						"aria-expanded": open,
+						"aria-label": open ? copy.collapse : copy.expand,
+						onClick: () => { setOpen(!open); },
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "mcpConnectorSettingsHeadText",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: "mcpConnectorSettingsName", children: copy.title }),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: "mcpConnectorSettingsDescription", children: copy.description })
+								]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: "mcpConnectorSettingsChevron", "aria-hidden": true, children: "⌄" })
+						]
+					}),
+					open ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "mcpConnectorSettingsBody",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "mcpConnectorSettingsRow",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+										htmlFor: "mcp-connector-show-sidebar-entry",
+										children: [
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: "mcpConnectorSettingsLabel", children: copy.show }),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: "mcpConnectorSettingsHint", children: copy.hint })
+										]
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+										id: "mcp-connector-show-sidebar-entry",
+										className: "mcpConnectorSettingsSwitch",
+										type: "checkbox",
+										role: "switch",
+										"aria-checked": visible,
+										checked: visible,
+										disabled: !writable || saving,
+										onChange: (event) => { void save(event.target.checked); }
+									})
+								]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "mcpConnectorSettingsFooter",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+										className: "mcpConnectorSettingsState",
+										"data-tone": failed ? "error" : "normal",
+										role: failed ? "alert" : "status",
+										children: failed ? copy.failed : saving ? copy.saving : !writable ? copy.readOnly : visible ? copy.visible : copy.hidden
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "mcpConnectorSettingsButton",
+										disabled: !writable || saving || !overridden,
+										onClick: () => { void reset(); },
+										children: copy.reset
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "mcpConnectorSettingsButton",
+										"data-primary": true,
+										"aria-haspopup": "dialog",
+										onClick: () => { actions.open(); },
+										children: copy.open
+									})
+								]
+							})
+						]
+					}) : null
+				]
+			});
+		}
+
+		function installClientSettings(ctx, marketView) {
+			if (typeof ctx.inject !== "function") return;
+			ctx.inject(["settingsScope"], (settingsCtx) => {
+				const settingsScope = settingsCtx.settingsScope.bind({
+					namespace: CONNECTOR_SETTINGS_NAMESPACE,
+					decode(value) {
+						if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+						return typeof value[SHOW_SIDEBAR_ENTRY_FIELD] === "boolean"
+							? { [SHOW_SIDEBAR_ENTRY_FIELD]: value[SHOW_SIDEBAR_ENTRY_FIELD] }
+							: void 0;
+					}
+				});
+				settingsCtx.effect(() => {
+					const sync = () => { marketView.syncSidebarVisible(resolveSidebarVisible(settingsScope.getSnapshot())); };
+					sync();
+					const unsubscribe = settingsScope.subscribe(sync);
+					return () => {
+						unsubscribe();
+						marketView.syncSidebarVisible(true);
+					};
+				}, "mcp-connector: sidebar visibility setting");
+				settingsCtx.effect(() => installSettingsStyles(), "mcp-connector: settings styles");
+				settingsCtx.slots.inject("settings.plugin.item", () => settingsCtx.slots.register({
+					name: "settings.plugin.item",
+					key: CONNECTOR_SETTINGS_NAMESPACE,
+					store: marketView,
+					inject: () => ({ settingsScope })
+				}, ConnectorSettingsCard));
+			});
+		}
+
 		/**
 		 * 用 DSH 自身的工作区/会话/输入机把示例 Prompt 带入新会话。
 		 * connectWorkspace 与 DSH 的「新会话」按钮同源：优先复用当前工作区的
@@ -815,10 +1202,14 @@ window.__ModuleLoader__.load({
 			}, [open, updateOperation?.operationId, updateProviderSelection?.provider?.id, expectedUpdateVersion]);
 			(0, react.useEffect)(() => {
 				if (!open) return void 0;
+				const opener = document.activeElement;
 				closeRef.current?.focus?.();
 				const onKeyDown = (event) => { if (event.key === "Escape") actions.close(); };
 				window.addEventListener("keydown", onKeyDown);
-				return () => { window.removeEventListener("keydown", onKeyDown); };
+				return () => {
+					window.removeEventListener("keydown", onKeyDown);
+					if (opener?.isConnected !== false) opener?.focus?.();
+				};
 			}, [open, actions]);
 			if (!open) return null;
 			const updateRunning = updateStarting || updateOperation !== null && ["queued", "running"].includes(updateOperation.state);
@@ -1188,8 +1579,14 @@ window.__ModuleLoader__.load({
 		function SidebarEntry(props) {
 			const { wide, useStore, actions } = props;
 			const open = useStore((state) => state.open);
+			const visible = useStore((state) => state.sidebarVisible !== false);
 			const [topMount, setTopMount] = (0, react.useState)(null);
 			(0, react.useEffect)(() => {
+				if (!visible) {
+					setTopMount(null);
+					return void 0;
+				}
+				const removeStyles = installSidebarStyles();
 				let disposed = false;
 				const ownedMounts = new Set();
 				const syncMount = () => {
@@ -1208,8 +1605,10 @@ window.__ModuleLoader__.load({
 					disposed = true;
 					observer?.disconnect();
 					for (const mount of ownedMounts) mount.remove();
+					removeStyles();
 				};
-			}, []);
+			}, [visible]);
+			if (!visible) return null;
 			const launcher = /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 				type: "button",
 				className: "mcpConnectorLauncher",
@@ -1232,7 +1631,8 @@ window.__ModuleLoader__.load({
 			console.log('[mcp-connector] client apply() called');
 			try {
 				const marketView = createMarketViewStore();
-				ctx.effect(() => installSidebarStyles(), "mcp-connector: sidebar styles");
+				ctx.effect(() => installOverlayStyles(), "mcp-connector: overlay styles");
+				installClientSettings(ctx, marketView);
 
 				// 弹框：注册到 shell.overlay（类似社区插件市场）
 				ctx.slots.inject("shell.overlay", () => {

package/lib/connectors/oauth-connector.js

@@ -88,8 +88,8 @@ export function describeOAuthAuthorizationError(error) {
  * @param {AbortSignal} [args.signal]
  */
 export async function oauthAuthorize({ connector, config, logger, signal }) {
-  const entryServer = connector.servers[0];
-  if (!entryServer) throw stagedError('resource-discovery', `connector "${connector.id}" has no servers`);
+  const entryServer = connector.servers.find((server) => server.url);
+  if (!entryServer) throw stagedError('resource-discovery', `connector "${connector.id}" has no HTTP OAuth resource`);
 
   const protectedResource = await atOAuthStage(
     'resource-discovery',
@@ -166,16 +166,16 @@ export async function oauthAuthorize({ connector, config, logger, signal }) {
     let grantedResources;
     if (grantedUrls) {
       const granted = new Set(grantedUrls);
-      const grantedServers = connector.servers.filter((s) => granted.has(s.url));
+      const grantedServers = connector.servers.filter((s) => granted.has(s.oauthResource ?? s.url));
       grantedKeys = grantedServers.map((s) => s.serverKey);
-      grantedResources = grantedServers.map((s) => s.url);
+      grantedResources = [...new Set(grantedServers.map((s) => s.oauthResource ?? s.url).filter(Boolean))];
       if (grantedKeys.length === 0) {
         grantedKeys = [entryServer.serverKey];
         grantedResources = [entryServer.url];
       }
     } else {
       grantedKeys = connector.servers.map((s) => s.serverKey);
-      grantedResources = connector.servers.map((s) => s.url);
+      grantedResources = [...new Set(connector.servers.map((s) => s.oauthResource ?? s.url).filter(Boolean))];
     }
 
     return {

package/lib/index.js

@@ -62,6 +62,7 @@ import {
   scopeLabel,
   scopeTargets,
 } from './connection-scopes.js';
+import { installConnectorSettings } from './settings.js';
 
 export const name = 'mcp-connector';
 
@@ -105,9 +106,12 @@ export const Config = z.object({
   openBrowser: z.boolean().default(true),
   /** 授权账号标识（预留多账号） */
   account: z.string().default(DEFAULT_ACCOUNT),
+  /** 是否在 DSH 主侧边栏显示 MCP连接器快捷入口 */
+  showSidebarEntry: z.boolean().default(true),
 });
 
 export async function apply(ctx, config) {
+  installConnectorSettings(ctx, config);
   const logger = ctx.logger('mcp-connector');
   const versionStatusService = createVersionStatusService({
     timeoutMs: config.requestTimeoutMs,
@@ -1051,7 +1055,7 @@ export async function apply(ctx, config) {
 
   function oauthResourceOrigins(connector) {
     return [...new Set((connector.servers ?? []).map((server) => {
-      try { return new URL(server.url).origin; } catch { return ''; }
+      try { return new URL(server.oauthResource ?? server.url).origin; } catch { return ''; }
     }).filter(Boolean))].sort();
   }
 
@@ -1084,6 +1088,7 @@ export async function apply(ctx, config) {
     const servers = [];
     for (const candidate of sharingConnectors) {
       for (const server of candidate.servers) {
+        if (!server.url) continue;
         if (seen.has(server.url)) continue;
         seen.add(server.url);
         servers.push({ ...server, serverKey: `${candidate.id}:${server.serverKey}` });
@@ -1097,7 +1102,7 @@ export async function apply(ctx, config) {
     const now = Date.now();
     const records = [];
     for (const connector of connectors) {
-      for (const server of connector.servers.filter((candidate) => granted.has(candidate.url))) {
+      for (const server of connector.servers.filter((candidate) => granted.has(candidate.oauthResource ?? candidate.url))) {
         records.push({
           key: `${connector.id}-${server.serverKey}`,
           connectorId: connector.id,
@@ -1106,6 +1111,11 @@ export async function apply(ctx, config) {
           serverKey: server.serverKey,
           transport: server.transport,
           url: server.url,
+          command: server.command,
+          args: server.args,
+          env: server.env,
+          oauthTokenEnv: server.oauthTokenEnv,
+          cwd: server.cwd,
           serverName: server.serverName,
           headers: server.headers,
           auth: { mode: 'oauth', grantKey },
@@ -1146,7 +1156,7 @@ export async function apply(ctx, config) {
           continue;
         }
       }
-      if (connector.servers.some((server) => entry.grant.authorizedResources.includes(server.url))) {
+      if (connector.servers.some((server) => entry.grant.authorizedResources.includes(server.oauthResource ?? server.url))) {
         return { grantKey, entry };
       }
     }
@@ -1757,6 +1767,8 @@ export async function apply(ctx, config) {
           command: s.command,
           args: s.args,
           credentialBindings: s.credentialBindings,
+          oauthResource: s.oauthResource,
+          oauthTokenEnv: s.oauthTokenEnv,
           transport: s.transport,
           serverName: s.serverName,
         })),

package/lib/mcp-provision.js

@@ -26,12 +26,17 @@ export function authHeaders(record, grants) {
 
 export function buildEntryConfig(record, grants, { failOnStartupError = false } = {}) {
   if (record.transport === 'stdio') {
+    const env = { ...(record.env ?? {}) };
+    if (record.auth?.mode === 'oauth' && record.oauthTokenEnv) {
+      const grant = record.auth.grantKey ? grants.get(record.auth.grantKey) : null;
+      if (grant?.accessToken) env[record.oauthTokenEnv] = `Bearer ${grant.accessToken}`;
+    }
     return {
       transport: 'stdio',
       serverName: record.serverName,
       command: record.command,
       args: record.args ?? [],
-      env: record.env ?? {},
+      env,
       cwd: record.cwd || process.cwd(),
       failOnStartupError,
     };

package/lib/schema.js

@@ -13,6 +13,8 @@ export const serverRefSchema = z.object({
   args: z.array(z.string()).optional(),
   env: z.record(z.string()).optional(),
   credentialBindings: z.record(z.string()).optional(),
+  oauthResource: z.string().min(1).optional(),
+  oauthTokenEnv: z.string().min(1).optional(),
   cwd: z.string().optional(),
   serverName: z.string().min(1),
   transport: z.enum(['streamable-http', 'sse', 'stdio']).optional(),
@@ -110,6 +112,7 @@ export const connectionRecordSchema = z.object({
   command: z.string().min(1).optional(),
   args: z.array(z.string()).optional(),
   env: z.record(z.string()).optional(),
+  oauthTokenEnv: z.string().min(1).optional(),
   cwd: z.string().optional(),
   serverName: z.string().min(1),
   headers: z.record(z.string()).optional(),
@@ -238,6 +241,8 @@ export function normalizeConnectorDescriptor(raw) {
       args: transport === 'stdio' ? (s.args ?? []) : undefined,
       env: transport === 'stdio' ? (s.env ?? {}) : undefined,
       credentialBindings: transport === 'stdio' ? (s.credentialBindings ?? {}) : undefined,
+      oauthResource: transport === 'stdio' ? s.oauthResource : undefined,
+      oauthTokenEnv: transport === 'stdio' ? s.oauthTokenEnv : undefined,
       cwd: transport === 'stdio' ? (s.cwd ?? '') : undefined,
       serverName: s.serverName,
       transport,
@@ -334,8 +339,9 @@ export function normalizeConnectionRecord(raw) {
     command: transport === 'stdio' ? data.command : undefined,
     args: transport === 'stdio' ? (data.args ?? []) : undefined,
     env: transport === 'stdio' ? (data.env ?? {}) : undefined,
+    oauthTokenEnv: transport === 'stdio' && data.auth?.mode === 'oauth' ? data.oauthTokenEnv : undefined,
     cwd: transport === 'stdio' ? (data.cwd ?? '') : undefined,
     headers: transport === 'streamable-http' ? (data.headers ?? {}) : {},
-    auth: transport === 'stdio' ? undefined : data.auth,
+    auth: transport === 'stdio' && data.auth?.mode !== 'oauth' ? undefined : data.auth,
   };
 }

package/lib/settings.js

@@ -0,0 +1,24 @@
+import z from '@deepseek-ai/schemastery';
+
+export const CONNECTOR_SETTINGS_NAMESPACE = 'mcp-connector';
+export const SHOW_SIDEBAR_ENTRY_FIELD = 'showSidebarEntry';
+
+export const ConnectorSettings = z.object({
+  [SHOW_SIDEBAR_ENTRY_FIELD]: z.boolean().default(true),
+});
+
+/**
+ * Register the connector's user-facing settings only while a Settings provider
+ * is present. The provider owns persistence; older DSH hosts keep the composed
+ * config and continue loading the connector normally.
+ */
+export function installConnectorSettings(ctx, config = {}) {
+  if (typeof ctx.inject !== 'function') return;
+  ctx.inject(['settings'], (settingsCtx) => {
+    settingsCtx.settings.register(CONNECTOR_SETTINGS_NAMESPACE, ConnectorSettings, {
+      base: {
+        [SHOW_SIDEBAR_ENTRY_FIELD]: config[SHOW_SIDEBAR_ENTRY_FIELD] !== false,
+      },
+    });
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.36",
+  "version": "0.2.38",
   "description": "DeepSeek Harness MCP Connector and MCP Server marketplace with over one hundred MCP connectors, continuously updated. Discover, authorize, and manage connections in one place; supports OAuth 2.0 PKCE, API keys, stdio/HTTP, mcpServers JSON import, and tool and prompt discovery. Maintained by Qichacha/QCC.",
   "type": "module",
   "main": "lib/index.js",
@@ -41,7 +41,7 @@
   ],
   "scripts": {
     "test": "node --test",
-    "lint": "node --check lib/index.js && node --check lib/web.js && node --check lib/client.js && node --check lib/version-status.js && node --check lib/schema.js && node --check lib/catalog.js && node --check lib/prompts.js && node --check lib/probe.js && node --check lib/diagnostics.js && node --check lib/connection-backup.js && node --check lib/connection-scopes.js && node --check lib/governance.js && node --check lib/mcp-validation.js && node --check lib/mcp-http.js && node --check lib/migration.js && node --check lib/stores.js && node --check lib/grant-journal.js && node --check lib/oauth.js && node --check lib/grant-lifecycle.js && node --check lib/callback-server.js && node --check lib/mcp-provision.js && node --check lib/util.js && node --check lib/constants.js && node --check lib/tools.js && node --check lib/connectors/oauth-connector.js && node --check lib/connectors/manual-connector.js && node --check lib/connectors/json-connector.js && node --check scripts/probe-connector.mjs && node --check scripts/build-registry.mjs && node --check scripts/ui-harness.mjs && node --check scripts/check-market-registration.mjs && node --check scripts/check-readme-version.mjs && node --check scripts/check-marketing-metadata.mjs && node --check scripts/check-storefront-screenshots.mjs && node --check scripts/sync-registry-stats.mjs && node --check scripts/verify-pack.mjs",
+    "lint": "node --check lib/index.js && node --check lib/web.js && node --check lib/client.js && node --check lib/settings.js && node --check lib/version-status.js && node --check lib/schema.js && node --check lib/catalog.js && node --check lib/prompts.js && node --check lib/probe.js && node --check lib/diagnostics.js && node --check lib/connection-backup.js && node --check lib/connection-scopes.js && node --check lib/governance.js && node --check lib/mcp-validation.js && node --check lib/mcp-http.js && node --check lib/migration.js && node --check lib/stores.js && node --check lib/grant-journal.js && node --check lib/oauth.js && node --check lib/grant-lifecycle.js && node --check lib/callback-server.js && node --check lib/mcp-provision.js && node --check lib/util.js && node --check lib/constants.js && node --check lib/tools.js && node --check lib/connectors/oauth-connector.js && node --check lib/connectors/manual-connector.js && node --check lib/connectors/json-connector.js && node --check scripts/probe-connector.mjs && node --check scripts/build-registry.mjs && node --check scripts/ui-harness.mjs && node --check scripts/check-market-registration.mjs && node --check scripts/check-readme-version.mjs && node --check scripts/check-marketing-metadata.mjs && node --check scripts/check-storefront-screenshots.mjs && node --check scripts/sync-registry-stats.mjs && node --check scripts/verify-pack.mjs",
     "registry:build": "node scripts/build-registry.mjs",
     "registry:validate": "node scripts/probe-connector.mjs catalog/catalog.json --validate-only",
     "dev:ui": "node scripts/ui-harness.mjs",

package/registry/schema/connector.schema.json

@@ -57,6 +57,8 @@
           "args": { "type": "array", "items": { "type": "string" } },
           "env": { "type": "object", "additionalProperties": { "type": "string" } },
           "credentialBindings": { "type": "object", "additionalProperties": { "type": "string" } },
+          "oauthResource": { "type": "string", "minLength": 1 },
+          "oauthTokenEnv": { "type": "string", "minLength": 1, "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" },
           "cwd": { "type": "string" },
           "serverName": { "type": "string", "minLength": 1 },
           "transport": { "enum": ["streamable-http", "stdio"] },

package/ui/index.html

@@ -521,7 +521,7 @@
     reauthorize: '需重新授权', recovering: '自动重试中', connectionError: '连接异常', partialError: '部分异常', disabled: '已停用',
     send: '发送', fillSend: '填写并发送', connectToUse: '连接后使用', try: '💬 去试试',
     connectTry: '🔗 连接后试用', configureConnect: '🔑 录入凭据并连接',
-    reconfigureCredential: '🔑 重新配置凭据', completeSetup: '补充本地解析', loading: '加载中…',
+    reconfigureCredential: '🔑 重新配置凭据', completeSetup: '补充本地解析', upgradeOauth: '升级一键授权', loading: '加载中…',
   };
   const t = (key) => LABELS[key] || key;
   const MCP_JSON_EXAMPLE = JSON.stringify({
@@ -1064,6 +1064,9 @@
     if (incomplete && ['bearer', 'api-key'].includes(d.authMode)) {
       return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.openConfig('${id}')">${t('completeSetup')}</button>`;
     }
+    if (incomplete && d.authMode === 'oauth2-pkce') {
+      return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.connect('${id}')">${t('upgradeOauth')}</button>`;
+    }
     if (configured) {
       if (state === 'healthy') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn ghost" disabled>${t('connected')}</button>`;
       if (state === 'unknown') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('unknown')}</button>`;
@@ -1630,7 +1633,7 @@
       $('#detail-disconnect-btn').style.display = d.connected?.length > 0 ? 'block' : 'none';
       const needsCredential = ['bearer', 'api-key'].includes(d.authMode);
       $('#detail-try-btn').textContent = detailNeedsReconfigure
-        ? detailFailureState === 'incomplete' ? t('completeSetup') : d.authMode === 'oauth2-pkce' && detailFailureState === 'reauth' ? '🔐 重新授权' : needsCredential && detailFailureState === 'reauth' ? t('reconfigureCredential') : '🔄 重新检查'
+        ? detailFailureState === 'incomplete' ? (d.authMode === 'oauth2-pkce' ? t('upgradeOauth') : t('completeSetup')) : d.authMode === 'oauth2-pkce' && detailFailureState === 'reauth' ? '🔐 重新授权' : needsCredential && detailFailureState === 'reauth' ? t('reconfigureCredential') : '🔄 重新检查'
         : d.connected?.length > 0 ? t('try') : needsCredential ? t('configureConnect') : t('connectTry');
       if (!d.connected?.length && !d.toolsSnapshot?.length) {
         $('#tools-summary').textContent = '连接后查看工具';
@@ -1677,7 +1680,7 @@
         ? `待补充 ${d.missingServers?.length || 1} 个服务`
         : `${detailFailureState === 'degraded' ? '部分服务可用' : '已连接'} ${d.connected?.length || 0} 个服务`;
       $('#detail-vendor').textContent = d.vendor ? `${d.vendor} · ${connectedLabel}` : connectedLabel;
-      $('#detail-try-btn').textContent = incomplete ? t('completeSetup') : t('try');
+      $('#detail-try-btn').textContent = incomplete ? (d.authMode === 'oauth2-pkce' ? t('upgradeOauth') : t('completeSetup')) : t('try');
       renderPromptPage();
       detailToolServers = toolsResult.detail?.servers || [];
       updateToolsSummary();
@@ -1773,6 +1776,17 @@
         openAddConnection('manual', detailConnector);
         return;
       }
+      if (detailFailureState === 'incomplete' && detailConnector?.authMode === 'oauth2-pkce') {
+        const id = detailConnector.id;
+        const r = await call('connect', { connectorId: id }, { timeoutMs: 310_000 });
+        showToast(r.message, r.ok);
+        if (r.ok) {
+          markCommunityCtaEligible();
+          await call('healthCheck', { connectorId: id });
+          await refreshConnectionUi(id);
+        }
+        return;
+      }
       if (detailFailureState === 'reauth' && detailConnector?.authMode === 'oauth2-pkce') {
         const id = detailConnector.id;
         const r = await call('connect', { connectorId: id }, { timeoutMs: 310_000 });