dsh-mcp-connector 0.2.4 → 0.2.6

package/CHANGELOG.md

@@ -4,6 +4,34 @@
 
 ## [Unreleased]
 
+## [0.2.6] - 2026-08-21
+
+### Documentation
+
+- 记录 `0.2.5` GitHub/npm 发布、DSH Desktop 精确版本安装、孤立 grant 自动清理与 19/19 Server 健康回归结果。
+- 扩充 GitHub Topic、仓库简介、README 和 npm 关键词，覆盖 MCP连接器、连接管理、插件/扩展、集成、Qichacha/QCC 和企查查等真实检索入口。
+- 明确“技能扩展”指 MCP 工具与 Prompt 对智能体能力的扩展，不将本包标记为独立 DSH Skill。
+
+## [0.2.5] - 2026-08-21
+
+### Changed
+
+- 同一连接器已有 OAuth 授权流程进行中时，后续重复点击复用同一 Promise，不再重复打开授权页或创建重复 grant。
+
+### Security
+
+- OAuth 重新授权成功后，撤销并删除已不再被连接引用的旧 refresh token/grant；插件启动时同步清理历史孤立 grant，仅保留当前连接仍引用的本机凭据。
+- 授权流程中途失败时清理未被连接引用的临时 grant，避免失败重试累积敏感记录。
+
+### Fixed
+
+- 修复连续或并发 OAuth 重新授权后，本机可能残留重复且未被连接引用的授权记录。
+
+### Documentation
+
+- 记录 `0.2.4` GitHub/npm 发布、DSH Desktop 精确版本安装和连接健康状态实机回归结果。
+- 记录旧企查查 OAuth 插件凭据迁移的用户确认、幂等执行和源数据保留验证结果。
+
 ## [0.2.4] - 2026-08-21
 
 ### Added
@@ -119,7 +147,9 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.4...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.6...HEAD
+[0.2.6]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.5...v0.2.6
+[0.2.5]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.4...v0.2.5
 [0.2.4]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.3...v0.2.4
 [0.2.3]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.1...v0.2.2

package/README.en.md

@@ -1,8 +1,10 @@
-# MCP Connector Marketplace for DeepSeek Harness
+# MCP Connector and Connection Manager Marketplace for DeepSeek Harness
 
-> A general-purpose MCP connector marketplace initiated and maintained by the Qichacha team
+> A general-purpose MCP connector, plugin extension, and integration marketplace initiated and maintained by the Qichacha (QCC) team
 
-Browse and install MCP connectors from different providers in DeepSeek Harness Desktop. Connect through OAuth, API key/URL configuration, JSON import, or a connector descriptor URL; discover tools, start a new conversation from an example prompt, and manage installed connections.
+Browse and install MCP connectors from different providers in DeepSeek Harness Desktop. Connect MCP servers through OAuth, API key/URL configuration, JSON import, or a connector descriptor URL; discover tools and prompts, extend agent skills, start a new conversation, and manage installed connections.
+
+> Here, “skill extension” means extending an agent through MCP tools and prompts; this package does not present itself as a standalone DSH Skill.
 
 [简体中文](README.md)
 
@@ -97,7 +99,7 @@ npm run dev:ui
 
 `npm run check` performs syntax checks, automated tests, and an npm package allowlist/sensitive-content audit. Tags matching `v*` trigger GitHub Actions; the tag must match `package.json`. npm releases use Trusted Publishing through GitHub OIDC and do not require a long-lived `NPM_TOKEN`.
 
-The current public version is [`dsh-mcp-connector@0.2.4`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.4](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.4).
+The current public version is [`dsh-mcp-connector@0.2.6`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.6](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.6).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -1,8 +1,10 @@
-# MCP 连接器市场（DeepSeek Harness 插件）
+# MCP连接器与连接管理市场（DeepSeek Harness 插件 / 扩展）
 
-> 通用 MCP Connector Marketplace，由企查查团队发起并维护
+> 通用 MCP Connector / Connection Manager / Integration Marketplace，由企查查（Qichacha/QCC）团队发起并维护
 
-在 DeepSeek Harness Desktop 中浏览和安装不同厂商的 MCP 连接器，通过 OAuth、API Key/URL 或 JSON 接入服务，发现工具、使用示例 Prompt 发起新会话，并管理已安装连接。
+在 DeepSeek Harness Desktop 中浏览和安装不同厂商的 MCP连接器，连接 MCP Server，通过 OAuth、API Key/URL 或 JSON 接入服务，发现工具与 Prompt，扩展 AI 技能，并管理已安装连接。
+
+> 注：“技能扩展”指通过 MCP 工具和 Prompt 扩展智能体能力，本包不会伪装成独立 DSH Skill。
 
 [English](README.en.md)
 
@@ -93,7 +95,7 @@ npm run dev:ui
 
 `check` 执行语法检查、自动测试和 npm 发布包白名单校验；`dev:ui` 启动不含真实凭据的本地 mock 市场。CI 使用 `--legacy-peer-deps` 安装显式测试依赖，DSH 运行期 peer 仍由 Host 提供。`v*` Tag 会触发 GitHub Actions；Tag 必须与 `package.json` 版本一致。Release 通过 npm Trusted Publishing (GitHub OIDC) 发布，不依赖长期 `NPM_TOKEN`。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.4`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.4](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.4)。
+当前公开版本为 [`dsh-mcp-connector@0.2.6`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.6](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.6)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/lib/index.js

@@ -78,6 +78,7 @@ export async function apply(ctx, config) {
     connections: new Map(),     // key -> ConnectionRecord
     grants: new Map(),          // grantKey -> { grant, timer, refreshPromise, needsReauth }
     health: new Map(),          // connectorId -> 最近一次主动连通性检查摘要（不持久化）
+    oauthConnects: new Map(),   // connectorId -> 正在进行的 OAuth 授权 Promise（防重复弹窗/重复 grant）
   };
 
   /* ───────────────────────── 目录加载 ───────────────────────── */
@@ -192,6 +193,36 @@ export async function apply(ctx, config) {
     entry.timer.unref?.();
   }
 
+  async function retireGrantIfUnused(grantKey, { revoke = false } = {}) {
+    if ([...state.connections.values()].some((record) => record.auth?.grantKey === grantKey)) return false;
+    const entry = state.grants.get(grantKey);
+    if (!entry) return false;
+    if (revoke && entry.grant.refreshToken) {
+      try {
+        const metadata = await discoverServerMetadata(entry.grant.issuer, config.requestTimeoutMs);
+        await revokeRefreshToken(metadata.revocationEndpoint, {
+          clientId: entry.grant.clientId,
+          refreshToken: entry.grant.refreshToken,
+          timeoutMs: config.requestTimeoutMs,
+        });
+      } catch (error) {
+        logger.warn(`retire unused grant ${grantKey}: revoke failed, removing local copy: ${error.message}`);
+      }
+    }
+    if (entry.timer) clearTimeout(entry.timer);
+    state.grants.delete(grantKey);
+    if (config.persistSecrets) await grantStore.delete(grantKey).catch(() => {});
+    return true;
+  }
+
+  async function pruneOrphanGrants({ revoke = false } = {}) {
+    let removed = 0;
+    for (const grantKey of [...state.grants.keys()]) {
+      if (await retireGrantIfUnused(grantKey, { revoke })) removed += 1;
+    }
+    return removed;
+  }
+
   /* ───────────────────────── 连接记录落库 / 挂载 ───────────────────────── */
 
   async function persistRecord(record) {
@@ -323,58 +354,82 @@ export async function apply(ctx, config) {
       if (!connector) return { ok: false, message: `连接器 "${connectorId}" 不存在（可先 mcp_connector_refresh_catalog 或 mcp_connector_catalog 查看）` };
 
       if (connector.auth.mode === 'oauth2-pkce') {
-        try {
-          const authz = await oauthAuthorize({ connector, config, logger, signal });
-          const grantKey = grantStore.keyFor(config.account, authz.issuer, authz.clientId, authz.scope);
-          const entryResource = authz.entryResource;
-          const grant = {
-            key: grantKey,
-            issuer: authz.issuer,
-            clientId: authz.clientId,
-            clientName: authz.clientName,
-            scope: authz.scope,
-            account: config.account,
-            accessToken: authz.token.accessToken,
-            accessTokenExpiresAt: Date.now() + authz.token.expiresIn * 1000 - config.refreshSkewMs,
-            refreshToken: authz.token.refreshToken ?? '',
-            authorizedResources: connector.servers
-              .filter((s) => authz.grantedKeys.includes(s.serverKey))
-              .map((s) => s.url).length
-              ? connector.servers.filter((s) => authz.grantedKeys.includes(s.serverKey)).map((s) => s.url)
-              : [entryResource],
-            connectorIds: [connector.id],
-            updatedAt: Date.now(),
-          };
-          state.grants.set(grantKey, { grant, timer: undefined, refreshPromise: null, needsReauth: false });
-          if (config.persistSecrets) await grantStore.put(grant);
-
-          const created = [];
-          for (const sk of authz.grantedKeys) {
-            const server = connector.servers.find((s) => s.serverKey === sk);
-            if (!server) continue;
-            const record = {
-              key: `${connector.id}-${sk}`,
-              connectorId: connector.id,
-              kind: 'oauth',
-              name: connector.servers.length > 1 ? `${connector.name}·${sk}` : connector.name,
-              serverKey: sk,
-              transport: server.transport,
-              url: server.url,
-              serverName: server.serverName,
-              headers: server.headers,
-              auth: { mode: 'oauth', grantKey },
-              enabled: true,
-              createdAt: Date.now(),
+        const inFlight = state.oauthConnects.get(connector.id);
+        if (inFlight) return inFlight;
+        const promise = (async () => {
+          try {
+            const previousGrantKeys = new Set(
+              [...state.grants]
+                .filter(([, entry]) => entry.grant.connectorIds?.includes(connector.id))
+                .map(([key]) => key),
+            );
+            const authz = await oauthAuthorize({ connector, config, logger, signal });
+            const grantKey = grantStore.keyFor(config.account, authz.issuer, authz.clientId, authz.scope);
+            const entryResource = authz.entryResource;
+            const grant = {
+              key: grantKey,
+              issuer: authz.issuer,
+              clientId: authz.clientId,
+              clientName: authz.clientName,
+              scope: authz.scope,
+              account: config.account,
+              accessToken: authz.token.accessToken,
+              accessTokenExpiresAt: Date.now() + authz.token.expiresIn * 1000 - config.refreshSkewMs,
+              refreshToken: authz.token.refreshToken ?? '',
+              authorizedResources: connector.servers
+                .filter((s) => authz.grantedKeys.includes(s.serverKey))
+                .map((s) => s.url).length
+                ? connector.servers.filter((s) => authz.grantedKeys.includes(s.serverKey)).map((s) => s.url)
+                : [entryResource],
+              connectorIds: [connector.id],
               updatedAt: Date.now(),
             };
-            await upsertRecord(record);
-            created.push(record.key);
+            state.grants.set(grantKey, { grant, timer: undefined, refreshPromise: null, needsReauth: false });
+            if (config.persistSecrets) await grantStore.put(grant);
+
+            const created = [];
+            for (const sk of authz.grantedKeys) {
+              const server = connector.servers.find((s) => s.serverKey === sk);
+              if (!server) continue;
+              const record = {
+                key: `${connector.id}-${sk}`,
+                connectorId: connector.id,
+                kind: 'oauth',
+                name: connector.servers.length > 1 ? `${connector.name}·${sk}` : connector.name,
+                serverKey: sk,
+                transport: server.transport,
+                url: server.url,
+                serverName: server.serverName,
+                headers: server.headers,
+                auth: { mode: 'oauth', grantKey },
+                enabled: true,
+                createdAt: Date.now(),
+                updatedAt: Date.now(),
+              };
+              await upsertRecord(record);
+              created.push(record.key);
+            }
+            scheduleRefresh(grantKey);
+            let retiredGrantCount = 0;
+            for (const previousKey of previousGrantKeys) {
+              if (previousKey !== grantKey && await retireGrantIfUnused(previousKey, { revoke: true })) retiredGrantCount += 1;
+            }
+            return {
+              ok: true,
+              message: `已连接 "${connector.name}"（${created.length} 个 MCP server），共 ${created.length} 条`,
+              detail: { keys: created, grantKey, retiredGrantCount },
+            };
+          } catch (error) {
+            logger.error(`oauth connect failed: ${error.message}`);
+            await pruneOrphanGrants();
+            return { ok: false, message: `连接失败: ${error.message}` };
           }
-          scheduleRefresh(grantKey);
-          return { ok: true, message: `已连接 "${connector.name}"（${created.length} 个 MCP server），共 ${created.length} 条`, detail: { keys: created, grantKey } };
-        } catch (error) {
-          logger.error(`oauth connect failed: ${error.message}`);
-          return { ok: false, message: `连接失败: ${error.message}` };
+        })();
+        state.oauthConnects.set(connector.id, promise);
+        try {
+          return await promise;
+        } finally {
+          if (state.oauthConnects.get(connector.id) === promise) state.oauthConnects.delete(connector.id);
         }
       }
 
@@ -845,6 +900,9 @@ export async function apply(ctx, config) {
     }
   }
 
+  const prunedGrantCount = await pruneOrphanGrants();
+  if (prunedGrantCount > 0) logger.info(`removed ${prunedGrantCount} unreferenced OAuth grant(s) from local storage`);
+
   for (const [grantKey, g] of state.grants) {
     if (g.grant.accessTokenExpiresAt <= Date.now()) {
       try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.4",
-  "description": "General-purpose MCP Connector Marketplace for DeepSeek Harness with OAuth 2.0 PKCE, API key/URL, JSON import, tool discovery, prompt templates, and connection management.",
+  "version": "0.2.6",
+  "description": "General-purpose MCP connector, connection manager, plugin extension, and integration marketplace for DeepSeek Harness, initiated and maintained by Qichacha/QCC.",
   "type": "module",
   "main": "lib/index.js",
   "exports": {
@@ -46,18 +46,36 @@
     "cordis",
     "mcp",
     "mcp-client",
+    "mcp-server",
     "mcp-connector",
+    "mcp-marketplace",
     "connector",
+    "connection",
+    "connection-manager",
     "marketplace",
+    "plugin",
+    "extension",
+    "integration",
+    "agent-skills",
+    "skill-extension",
+    "ai-tools",
     "oauth",
     "oauth2",
     "pkce",
+    "api-key",
     "json-import",
     "enterprise-data",
     "qichacha",
     "qcc",
     "tools",
-    "prompts"
+    "prompts",
+    "MCP连接器",
+    "连接器",
+    "连接管理",
+    "技能扩展",
+    "插件",
+    "扩展",
+    "企查查"
   ],
   "license": "MIT",
   "publishConfig": {