dsh-mcp-connector 0.2.41 → 0.2.43

package/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 ## [Unreleased]
 
+## [0.2.43] - 2026-09-12
+
+### Added
+
+- 新增同源实时状态 SSE：连接、目录、健康、工具目录、治理和作用域发生变化后，市场页面自动刷新，无需轮询。
+- 新增“最后一次成功工具缓存”：实时 `tools/list` 或 Host 工具观测失败时仍可查看上次成功发现的工具，并明确标注缓存时间与超过 24 小时的陈旧状态。
+- 新增 `mcp_connector_tool_search` 与 `mcp_connector_tool_detail` 渐进式发现工具；支持按名称、标题和描述搜索，并按需读取安全裁剪后的输入参数 schema，不执行目标 MCP 工具。
+
+### Security
+
+- SSE 事件仅包含通用类别、递增序号与时间；不会发送连接标识、端点、错误、参数、结果或凭据。
+- 工具缓存按连接配置签名隔离并设置工具数、描述、schema 与总容量上限；剔除 schema 默认值和示例，断开、改配或快照恢复后清理旧缓存。
+
+## [0.2.42] - 2026-09-11
+
+### Fixed
+
+- 示例 Prompt 的“发送”动作会在 DSH 0.1.2 优先调用 `uiWorkspace.connectWorkspace`，并兼容 DSH 0.1.1 的 `workspaces.connectWorkspace` 与 `sessions.create` 安全降级；不再因工作区导航 API 迁移报错。
+
 ## [0.2.41] - 2026-09-09
 
 ### Added
@@ -638,7 +657,8 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.41...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.42...HEAD
+[0.2.42]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.41...v0.2.42
 [0.2.41]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.40...v0.2.41
 [0.2.40]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.39...v0.2.40
 [0.2.39]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.38...v0.2.39

package/README.en.md

@@ -54,7 +54,9 @@ If the plugin helps you connect an MCP server faster, consider [starring the rep
 - OAuth 2.0 Authorization Code with PKCE, including DCR public clients and `client_secret_post` / `client_secret_basic`; API key/Bearer/unauthenticated HTTP configuration, stdio local-process configuration, and `mcpServers` JSON import.
 - Installation from a credential-free connector descriptor URL.
 - Credential and MCP initialize validation before HTTP API-key connectors are saved as installed, plus declarative multi-field credential-to-env bindings for marketplace stdio connectors.
-- Dynamic tool discovery grouped by MCP server, including descriptions, search, batched rendering, and an independent scroll region.
+- Dynamic tool discovery grouped by MCP server, including descriptions, search, parameter details, batched rendering, and an independent scroll region. When live discovery fails, the UI shows the last successful tool cache with observation-time and stale markers.
+- Same-origin SSE updates the UI after connection, catalog, health, tool, governance, or scope changes. Event payloads contain no connection identifiers, endpoints, errors, or credentials.
+- Progressive `mcp_connector_tool_search` and `mcp_connector_tool_detail` tools search last-success metadata and reveal a bounded, sanitized input schema on demand without executing the target MCP tool.
 - Curated prompt templates that can open a DSH conversation and prefill its draft; missing variables are requested before the prompt is sent.
 - Persistent connection lifecycle management: restore on restart, enable/disable, disconnect, retry transient OAuth refresh failures with bounded backoff, and revoke authorization. Cards declaring issuer-level sharing reuse one grant; a cross-process lock and per-grant atomic journal prevent Desktop and Web hosts from consuming or overwriting the same rotating refresh token.
 - In-place configuration editing for custom and JSON-imported connections: edit normalized JSON from Installed and reconnect without deleting the connection. Existing sensitive values use local keep markers, and validation, startup, or persistence failures leave the previous connection usable.
@@ -68,7 +70,7 @@ If the plugin helps you connect an MCP server faster, consider [starring the rep
 - Explicit, non-destructive migration from the two earlier Qichacha OAuth plugins, plus active-plugin conflict detection that blocks duplicate server management and credential overwrites.
 
 <!-- catalog-stats:start -->
-As of 2026-09-05, the public Registry publishes 105 connector descriptors. After merging and deduplicating them with the 4 bundled Qichacha cards, the Marketplace exposes 109 cards across 9 business categories. Recommendations remain limited to the four Qichacha cards, PKULaw, and Wind, for 6 featured cards in total. The Registry evolves independently; the badge shown after a client refresh and the live badges above are the authoritative current counts.
+As of 2026-09-11, the public Registry publishes 106 connector descriptors. After merging and deduplicating them with the 4 bundled Qichacha cards, the Marketplace exposes 110 cards across 9 business categories. Recommendations remain limited to the four Qichacha cards, PKULaw, and Wind, for 6 featured cards in total. The Registry evolves independently; the badge shown after a client refresh and the live badges above are the authoritative current counts.
 <!-- catalog-stats:end -->
 
 ## Interface and demo
@@ -176,7 +178,7 @@ npm run dev:ui
 
 Every Registry merge regenerates `catalog-stats.json`; an hourly workflow in this repository synchronizes the Chinese and English product copy plus a local stats snapshot. The static npm README updates with package releases, while the live badges above read the Registry directly and therefore stay current without another npm release.
 
-The current public version is [`dsh-mcp-connector@0.2.41`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.41](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.41).
+The current public version is [`dsh-mcp-connector@0.2.43`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.43](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.43).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -52,7 +52,8 @@ dsh plugin --profile web add dsh-mcp-connector
 - 侧边栏入口可按当前 profile 隐藏；隐藏后仍可从“设置 → 插件 → 插件配置 → MCP连接器”临时打开现有连接器弹框，用完即关。
 - 图形化市场：默认“全部”按推荐与 9 类业务分类分章节展示，每章先展示 4 张并可展开；分类栏固定可见，单分类页展示全部卡片。
 - 图形化添加：手动 HTTP/stdio、`mcpServers` JSON、连接器描述 URL 三种入口，失败时保留表单并给出修复建议。
-- 连接器详情：精选 Prompt 优先展示，点击可带入 DSH 新会话；工具按 Server 分组，支持描述、搜索和独立滚动。
+- 连接器详情：精选 Prompt 优先展示，点击可带入 DSH 新会话；工具按 Server 分组，支持描述、搜索、参数详情和独立滚动。实时发现失败时显示带时间/陈旧标记的最后成功工具缓存。
+- 实时状态：页面通过同源 SSE 接收连接、目录、健康、工具、治理和作用域变化通知并自动刷新；事件不携带连接标识、端点、错误或凭据。
 - Prompt 模板：使用 `{{company}}` 等变量，发送前填写真实查询主体。
 - 三种接入：OAuth 2.0 PKCE、自定义 HTTP/stdio、导入 `mcpServers` JSON；也支持从连接器描述 URL 安装。OAuth 动态注册兼容公共客户端以及 `client_secret_post` / `client_secret_basic` 机密客户端。
 - 市场 Bearer/API Key 连接器先执行 MCP initialize 连通性与凭据校验，全部 HTTP Server 通过后才持久化凭据并进入“已安装”；stdio 卡片可声明多个本机凭据字段及其环境变量映射。
@@ -67,10 +68,10 @@ dsh plugin --profile web add dsh-mcp-connector
 - 插件版本与一键更新：版本发现独立于安装来源；页面通过 Update Provider 适配层探测安全更新能力。DSH Market API v1 是首个适配器，支持进度、稳定失败码、回滚及按宿主能力提供的重启/刷新操作；无可用 Provider 时回退到当前插件市场或 npm。
 - Registry 工具链：Schema/唯一性/密钥审计、MCP/OAuth 无凭据探针、每周健康巡检。
 - 平滑迁移：显式扫描并复制两个旧企查查 OAuth 插件授权；检测到旧插件仍启用并管理同名 Server 时阻断重复连接，避免凭据相互覆盖。
-- 对话工具：`mcp_connector_catalog`、`connect`、`configure`、`import_json`、`export_config`、`snapshot`、`install_from_url`、`status`、`scope`、`health_check`、`policy`、`set_enabled`、`disconnect`、`refresh_catalog`、`publish`、`tools_list`。
+- 对话工具：`mcp_connector_catalog`、`connect`、`configure`、`import_json`、`export_config`、`snapshot`、`install_from_url`、`status`、`scope`、`health_check`、`policy`、`set_enabled`、`disconnect`、`refresh_catalog`、`publish`、`tools_list`、`tool_search`、`tool_detail`。搜索/详情只做渐进式能力发现，不执行目标 MCP 工具。
 
 <!-- catalog-stats:start -->
-截至 2026-09-05，公共 Registry 已发布 105 条连接器描述；与随包的 4 张企查查卡片合并去重后，市场页可浏览 109 张卡片，覆盖企业数据、金融投资、法律合规、开发工具、办公协作、调研分析、设计创意、效率工具、其他 9 类。推荐位严格保留 4 张企查查卡片、北大法宝和 Wind，共 6 张；其他连接器按业务分类展示。Registry 可独立持续更新，实际数量以客户端刷新后的市场页签徽标和上方实时统计徽标为准。
+截至 2026-09-11，公共 Registry 已发布 106 条连接器描述；与随包的 4 张企查查卡片合并去重后，市场页可浏览 110 张卡片，覆盖企业数据、金融投资、法律合规、开发工具、办公协作、调研分析、设计创意、效率工具、其他 9 类。推荐位严格保留 4 张企查查卡片、北大法宝和 Wind，共 6 张；其他连接器按业务分类展示。Registry 可独立持续更新，实际数量以客户端刷新后的市场页签徽标和上方实时统计徽标为准。
 <!-- catalog-stats:end -->
 
 ## 界面与演示
@@ -172,7 +173,7 @@ npm run dev:ui
 
 公共 Registry 每次合并后会生成 `catalog-stats.json`；本仓库的定时工作流每小时同步中英文介绍和统计快照。npm 页面中的静态正文随版本发布更新，上方动态统计徽标则直接读取 Registry，可在不发布新 npm 版本时保持实时数量一致。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.41`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.41](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.41)。
+当前公开版本为 [`dsh-mcp-connector@0.2.43`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.43](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.43)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/docs/USER-GUIDE.md

@@ -99,10 +99,12 @@ OAuth 一键连接要求服务商支持标准 OAuth 2.1/PKCE 和公开元数据
 
 1. 阅读服务说明、鉴权方式、数据范围与可能产生的费用或副作用。
 2. 在“试试这样用”中选择示例 Prompt；带变量的模板会先要求补齐查询主体等信息。
-3. 展开“工具详情”查看 Server 数量、工具名称与描述，并可搜索工具；连接后还可按 Connection、Server、Tool 设置治理规则。
+3. 展开“工具详情”查看 Server 数量、工具名称与描述，并可搜索工具；点击“参数详情”可按需查看输入 schema；连接后还可按 Connection、Server、Tool 设置治理规则。
 4. 点击“去试试”或 Prompt 的发送按钮，在当前工作区创建或复用空白会话并写入草稿。
 
-连接成功后，工具按 `mcp__<serverName>__*` 前缀提供给模型。工具清单来自服务端，实际数量会随服务商权限和版本变化。详情与“已安装”列表会展示最近一次诊断的阶段、稳定错误码、说明、建议动作和最近成功时间。
+连接成功后，工具按 `mcp__<serverName>__*` 前缀提供给模型。工具清单来自服务端，实际数量会随服务商权限和版本变化。成功发现后，插件会在当前 profile 保存一份安全裁剪的工具元数据；实时发现失败时仍显示这份“最后成功缓存”，但保持连接失败/未知状态并标注缓存时间，超过 24 小时还会显示陈旧提示。详情与“已安装”列表会展示最近一次诊断的阶段、稳定错误码、说明、建议动作和最近成功时间。
+
+对话中可用 `mcp_connector_tool_search` 按名称、标题或描述搜索缓存，再用 `mcp_connector_tool_detail` 精确读取某个工具的参数 schema。两者只用于发现，不代理或执行 MCP 调用。
 
 ## 6. 添加自定义连接
 
@@ -233,6 +235,8 @@ OAuth 断开时，插件会尽力调用服务商的撤销端点；无撤销端
 
 - 健康摘要和最近成功时间目前只保留在插件进程内；重启后先显示“状态未知”，直至重新检查。
 - HTTP 工具清单使用只读 MCP `tools/list` 发现；stdio 工具清单读取 Host 已注册工具。Host 不提供可观测状态时只能报告未知。
+- 最后成功工具缓存只保存名称、标题、描述和安全裁剪后的输入 schema，不保存调用参数、调用结果、原始错误或凭据；断开、修改连接配置或恢复快照会清理相关缓存。
+- 页面实时状态使用同源 SSE，事件只发送变化类别、序号和时间；断线时浏览器按 EventSource 规则自动重连，页面重新可见时主动刷新一次。
 - 连接凭据、快照、治理规则和作用域历史都存储在当前 profile；project/global 不跨 profile 同步。
 - Workspace 被删除后，原 project-only 绑定保持 fail closed，需手动移动到当前项目或全局。
 - 连接级停用可逆；断开会删除本机连接，并在授权不再共享时尽力撤销 OAuth。非 OAuth 配置可用断开前快照恢复；已撤销的 OAuth 必须重新授权。

package/lib/client.js

@@ -999,7 +999,23 @@ window.__ModuleLoader__.load({
 			if (targetWorkspaceId === void 0) {
 				throw new Error("请先选择一个工作空间，再使用示例 Prompt");
 			}
-			const sessionId = await ctx.workspaces.connectWorkspace(targetWorkspaceId);
+			// DSH 0.1.2 将跨 Controller 的导航能力从 workspaces 移到
+			// uiWorkspace；0.1.1 Desktop 仍暴露旧方法。优先使用当前公开能力，
+			// 再兼容旧版，最后以 sessions.create 保证未来移除桥接方法时仍能
+			// 在目标 Workspace 创建原生会话。
+			const uiWorkspace = typeof ctx.get === "function"
+				? ctx.get("uiWorkspace")
+				: ctx.uiWorkspace;
+			let sessionId;
+			if (typeof uiWorkspace?.connectWorkspace === "function") {
+				sessionId = await uiWorkspace.connectWorkspace(targetWorkspaceId);
+			} else if (typeof ctx.workspaces?.connectWorkspace === "function") {
+				sessionId = await ctx.workspaces.connectWorkspace(targetWorkspaceId);
+			} else if (typeof ctx.sessions?.create === "function") {
+				sessionId = await ctx.sessions.create({ workspaceId: targetWorkspaceId });
+			} else {
+				throw new Error("当前 DSH 版本没有可用的工作区会话创建能力，请升级 DSH 后重试");
+			}
 			const conversation = ctx.get("conversation");
 			if (conversation === void 0) {
 				throw new Error("DSH 对话服务尚未就绪，请稍后重试");

package/lib/index.js

@@ -5,10 +5,11 @@
  *   - 连接器目录（内置 + 远程 registry + config 注入 + 本地上下架覆盖）
  *   - 三通道连接：通用 OAuth(PKCE) / 自定义配置 / 粘贴 JSON / URL 安装
  *   - 连接记录与 OAuth grant 持久化，重启恢复与跨 Host Token 轮换
+ *   - 实时状态 SSE、最后成功工具缓存与渐进式工具搜索/详情
  *   - 通过 ctx.loader 动态配置 @deepseek-ai/dsh-mcp-client 条目
  *   - 对话工具：mcp_connector_catalog / connect / configure / import_json /
  *     export_config / snapshots / install_from_url / status / rename / set_enabled /
- *     disconnect / refresh_catalog / publish
+ *     disconnect / refresh_catalog / publish / tools_list / tool_search / tool_detail
  */
 import { randomUUID } from 'node:crypto';
 import z from '@deepseek-ai/schemastery';
@@ -23,7 +24,7 @@ import {
   DEFAULT_REFRESH_RETRY_MAX_MS,
   DEFAULT_CATALOG_TTL_MS,
 } from './constants.js';
-import { defineConnectorDomain, ConnectionStore, GrantStore, CatalogStore, SnapshotStore, GovernanceStore, ConnectionScopeStore } from './stores.js';
+import { defineConnectorDomain, ConnectionStore, GrantStore, CatalogStore, SnapshotStore, GovernanceStore, ConnectionScopeStore, ToolCatalogStore } from './stores.js';
 import { normalizeConnectorDescriptor, normalizeConnectionRecord } from './schema.js';
 import { loadBundledCatalog, fetchRemoteCatalogWithFallback, mergeCatalog, listCatalog, auditDescriptor, auditRawDescriptor, readLimitedJson } from './catalog.js';
 import { describeOAuthAuthorizationError, oauthAuthorize } from './connectors/oauth-connector.js';
@@ -68,6 +69,14 @@ import {
   scopeTargets,
 } from './connection-scopes.js';
 import { installConnectorSettings } from './settings.js';
+import {
+  connectionToolCacheSignature,
+  createToolCatalogRecord,
+  findToolDetails,
+  searchToolCatalog,
+  toolCatalogCacheView,
+} from './tool-catalog-cache.js';
+import { observeStatusEvents, StatusEventHub } from './status-events.js';
 
 export const name = 'mcp-connector';
 
@@ -137,6 +146,7 @@ export async function apply(ctx, config) {
   });
   const catalogStore = new CatalogStore(domain);
   const snapshotStore = new SnapshotStore(domain);
+  const toolCatalogStore = new ToolCatalogStore(domain);
   const governanceStore = new GovernanceStore(domain);
   const governancePolicies = new GovernancePolicyService(governanceStore);
   await governancePolicies.load();
@@ -155,7 +165,9 @@ export async function apply(ctx, config) {
     oauthConnects: new Map(),   // sharingKey -> { promise, requestedConnectorIds }（防同 issuer 重复弹窗）
     warnedLegacyConflicts: new Set(),
     toolInventories: new Map(),  // serverName -> { observed, observedAt, tools: Set<rawName> }
+    toolCatalogCache: new Map(), // connection key -> 最近成功、安全裁剪后的工具元数据
   };
+  const statusEvents = new StatusEventHub();
 
   const hostGovernance = createHostGovernanceController(ctx, {
     getRules: () => governancePolicies.snapshot().rules,
@@ -421,6 +433,7 @@ export async function apply(ctx, config) {
         });
       }
       scheduleRefresh(grantKey);
+      statusEvents.publish('status');
       return next;
     })();
     try {
@@ -472,6 +485,7 @@ export async function apply(ctx, config) {
       entry.refreshRetryAt = Date.now() + delay;
       scheduleRefresh(grantKey, { delayMs: delay });
     }
+    statusEvents.publish('status');
     return failure;
   }
 
@@ -494,6 +508,7 @@ export async function apply(ctx, config) {
           logger.info(`OAuth grant ${grantKey} adopted a newer cross-process journal token`);
           if (persisted.accessTokenExpiresAt > Date.now()) {
             scheduleRefresh(grantKey);
+            statusEvents.publish('status');
             return persisted;
           }
         }
@@ -523,6 +538,7 @@ export async function apply(ctx, config) {
           try {
             if (persisted.accessTokenExpiresAt > Date.now()) {
               scheduleRefresh(grantKey);
+              statusEvents.publish('status');
               return persisted;
             }
             return await grantStore.withRefreshLock(grantKey, () => refreshGrant(grantKey), {
@@ -609,6 +625,7 @@ export async function apply(ctx, config) {
       throw wrapped;
     }
     state.connections.delete(record.key);
+    await deleteLastSuccessfulTools(record.key);
     clearRecordHealth(record);
   }
 
@@ -957,6 +974,7 @@ export async function apply(ctx, config) {
           publicName: schema.name,
           title: schema.title || schema.name.slice(prefix.length),
           description: schema.description || '',
+          inputSchema: schema.parameters ?? {},
         }));
       return { supported: true, tools };
     } catch (error) {
@@ -965,6 +983,48 @@ export async function apply(ctx, config) {
     }
   }
 
+  async function cacheLastSuccessfulTools(record, tools) {
+    const entry = createToolCatalogRecord(record, tools);
+    state.toolCatalogCache.set(record.key, entry);
+    if (config.persistSecrets) {
+      try {
+        state.toolCatalogCache.set(record.key, await toolCatalogStore.put(entry));
+      } catch (error) {
+        logger.warn(`persist tool catalog "${record.key}" failed: ${error.message}`);
+      }
+    }
+    return state.toolCatalogCache.get(record.key);
+  }
+
+  async function deleteLastSuccessfulTools(key) {
+    state.toolCatalogCache.delete(key);
+    if (config.persistSecrets) {
+      await toolCatalogStore.delete(key).catch((error) => {
+        logger.warn(`delete tool catalog "${key}" failed: ${error.message}`);
+      });
+    }
+  }
+
+  function cachedToolsForRecord(record) {
+    const entry = state.toolCatalogCache.get(record.key);
+    if (!entry
+        || entry.connectorId !== record.connectorId
+        || entry.serverName !== record.serverName
+        || entry.connectionSignature !== connectionToolCacheSignature(record)) return null;
+    return { entry, ...toolCatalogCacheView(entry) };
+  }
+
+  function visibleToolCatalogEntries(workspaceId) {
+    const entries = [];
+    for (const record of state.connections.values()) {
+      if (record.enabled === false) continue;
+      if (workspaceId && !connectionVisibleInWorkspace(connectionScopes.binding(record.key), workspaceId)) continue;
+      const cached = cachedToolsForRecord(record);
+      if (cached) entries.push(cached.entry);
+    }
+    return entries;
+  }
+
   function readinessResults(records, validationResults = []) {
     return records.map((record, index) => {
       const validated = validationResults[index];
@@ -2168,6 +2228,7 @@ export async function apply(ctx, config) {
           .map((key) => state.connections.get(key)?.auth?.grantKey)
           .filter(Boolean));
         const restored = await replaceConnectionSet(snapshot.targetKeys, snapshot.records);
+        for (const key of snapshot.targetKeys) await deleteLastSuccessfulTools(key);
         let retiredGrantCount = 0;
         for (const grantKey of previousGrantKeys) {
           if (await retireGrantIfUnused(grantKey, { revoke: true })) retiredGrantCount += 1;
@@ -2444,6 +2505,7 @@ export async function apply(ctx, config) {
           };
         }
         const { committed: [committed], snapshot } = await commitWithSnapshot([next], 'reconfigure');
+        await deleteLastSuccessfulTools(committed.key);
         if (committed.connectorId && committed.enabled !== false) {
           cacheHealth(committed.connectorId, [committed], readinessResults([committed], validation.detail.results));
         }
@@ -2579,6 +2641,70 @@ export async function apply(ctx, config) {
       return { ok: true, message: `已将 "${connector.name}" ${published ? '上架' : '下架'}` };
     },
 
+    async toolSearch(input = {}) {
+      try {
+        const connectorId = String(input.connectorId ?? '').trim() || undefined;
+        if (connectorId && !state.merged.some((connector) => connector.id === connectorId)) {
+          return { ok: false, message: `连接器 "${connectorId}" 不存在` };
+        }
+        const items = searchToolCatalog(visibleToolCatalogEntries(input.workspaceId), {
+          query: input.query,
+          connectorId,
+          limit: input.limit,
+        });
+        const staleCount = items.filter((item) => item.stale).length;
+        return {
+          ok: true,
+          message: `最后成功工具缓存中找到 ${items.length} 个匹配项${staleCount ? `，其中 ${staleCount} 个已超过 24 小时` : ''}`,
+          detail: {
+            items,
+            source: 'last-success-cache',
+            discoveryOnly: true,
+            credentialsStored: false,
+          },
+        };
+      } catch (error) {
+        return { ok: false, message: `搜索工具失败: ${error.message}` };
+      }
+    },
+
+    async toolDetail(input = {}) {
+      try {
+        const connectorId = String(input.connectorId ?? '').trim() || undefined;
+        const serverName = String(input.serverName ?? '').trim() || undefined;
+        const matches = findToolDetails(visibleToolCatalogEntries(input.workspaceId), {
+          toolName: input.toolName,
+          connectorId,
+          serverName,
+        });
+        if (matches.length === 0) {
+          return { ok: false, message: `最后成功工具缓存中找不到 "${String(input.toolName ?? '').trim()}"` };
+        }
+        if (matches.length > 1) {
+          return {
+            ok: false,
+            message: `找到 ${matches.length} 个同名工具，请补充 connectorId 或 serverName`,
+            detail: {
+              candidates: matches.map(({ connectorId: id, serverName: server, name }) => ({ connectorId: id, serverName: server, name })),
+              discoveryOnly: true,
+            },
+          };
+        }
+        return {
+          ok: true,
+          message: `工具详情：${matches[0].serverName}/${matches[0].name}${matches[0].stale ? '（缓存已超过 24 小时）' : ''}`,
+          detail: {
+            tool: matches[0],
+            source: 'last-success-cache',
+            discoveryOnly: true,
+            credentialsStored: false,
+          },
+        };
+      } catch (error) {
+        return { ok: false, message: `读取工具详情失败: ${error.message}` };
+      }
+    },
+
     /**
      * 从已连接的 MCP server 动态获取工具清单
      * 通过 MCP JSON-RPC 协议调用 tools/list 方法
@@ -2617,13 +2743,22 @@ export async function apply(ctx, config) {
           const snapshot = (connector.toolsSnapshot ?? []).find((item) =>
             item.serverKey === record.serverKey || item.serverName === record.serverName);
           const liveTools = registered.tools;
+          let cached = cachedToolsForRecord(record);
           if (liveTools.length > 0) {
             state.toolInventories.set(record.serverName, {
               observed: true,
               observedAt: Date.now(),
               tools: new Set(liveTools.map((tool) => tool.name)),
             });
+            await cacheLastSuccessfulTools(record, liveTools);
+            cached = cachedToolsForRecord(record);
           }
+          const cachedFallback = liveTools.length === 0 ? cached : null;
+          const displayTools = liveTools.length > 0
+            ? liveTools
+            : cachedFallback?.entry.tools?.length > 0
+              ? cachedFallback.entry.tools
+              : snapshot?.tools ?? [];
           const diagnosticCode = registered.error
             ? 'host-status-error'
             : registered.supported ? 'host-tools-pending' : 'host-status-unavailable';
@@ -2633,17 +2768,23 @@ export async function apply(ctx, config) {
             ok: liveTools.length > 0,
             managed: true,
             live: liveTools.length > 0,
-            preview: liveTools.length === 0 && Boolean(snapshot),
+            cached: Boolean(cachedFallback),
+            preview: liveTools.length === 0 && !cachedFallback && Boolean(snapshot),
             unknown: liveTools.length === 0,
             diagnosticCode,
             policy: serverPolicy(record),
-            tools: (liveTools.length > 0
-              ? liveTools
-              : (snapshot?.tools ?? []).map((tool) => ({
-                  name: tool.name,
-                  title: tool.title || tool.name,
-                  description: tool.description || '',
-                }))).map((tool) => decorateToolPolicy(record, tool, observedNames)),
+            tools: displayTools.map((tool) => decorateToolPolicy(record, {
+              name: tool.name,
+              ...(tool.publicName ? { publicName: tool.publicName } : {}),
+              title: tool.title || tool.name,
+              description: tool.description || '',
+            }, observedNames)),
+            ...(cachedFallback ? {
+              cacheObservedAt: cachedFallback.observedAt,
+              cacheAgeMs: cachedFallback.cacheAgeMs,
+              stale: cachedFallback.stale,
+              cacheTruncated: cachedFallback.entry.truncated === true,
+            } : {}),
             ...(liveTools.length === 0 ? {
               errorKind: registered.supported ? 'startup' : 'host-version',
               error: registered.supported
@@ -2663,6 +2804,7 @@ export async function apply(ctx, config) {
             observedAt: Date.now(),
             tools: new Set(listed.tools.map((tool) => tool.name)),
           });
+          await cacheLastSuccessfulTools(record, listed.tools);
           servers.push({
             serverKey: record.serverKey || record.name,
             serverName: record.serverName,
@@ -2675,6 +2817,19 @@ export async function apply(ctx, config) {
             }, observedNames)),
           });
         } catch (error) {
+          const cached = cachedToolsForRecord(record);
+          const cachedFields = cached ? {
+            cached: true,
+            cacheObservedAt: cached.observedAt,
+            cacheAgeMs: cached.cacheAgeMs,
+            stale: cached.stale,
+            cacheTruncated: cached.entry.truncated === true,
+            tools: cached.entry.tools.map((tool) => decorateToolPolicy(record, {
+              name: tool.name,
+              title: tool.title || tool.name,
+              description: tool.description || '',
+            }, observedNames)),
+          } : { tools: [] };
           if (error instanceof McpHttpError) {
             servers.push({
               serverKey: record.serverKey || record.name,
@@ -2683,12 +2838,12 @@ export async function apply(ctx, config) {
               error: error.message,
               errorKind: error.kind,
               policy: serverPolicy(record),
-              tools: [],
+              ...cachedFields,
             });
             continue;
           }
           const classified = classifyConnectionError(error);
-          servers.push({ serverKey: record.serverKey || record.name, serverName: record.serverName, ok: false, error: classified.message, errorKind: classified.kind, policy: serverPolicy(record), tools: [] });
+          servers.push({ serverKey: record.serverKey || record.name, serverName: record.serverName, ok: false, error: classified.message, errorKind: classified.kind, policy: serverPolicy(record), ...cachedFields });
         }
       }
 
@@ -2697,6 +2852,7 @@ export async function apply(ctx, config) {
       const unknownServers = servers.filter((server) => server.unknown).length;
       const failedServers = servers.length - availableServers - unknownServers;
       const pendingManagedServers = unknownServers;
+      const cachedServers = servers.filter((server) => server.cached).length;
       const health = cacheHealth(connectorId, records, servers.map((server) => server.ok
         ? { ok: true, kind: 'connected', serverKey: server.serverKey, serverName: server.serverName }
         : server.unknown
@@ -2716,7 +2872,7 @@ export async function apply(ctx, config) {
       return {
         ok: availableServers > 0,
         message: failedServers > 0
-          ? `工具加载失败：${failureSummary}${failedServers > 3 ? `；另有 ${failedServers - 3} 个 Server 不可用` : ''}${availableServers > 0 ? `；${availableServers} 个 Server 仍可用` : ''}`
+          ? `工具加载失败：${failureSummary}${failedServers > 3 ? `；另有 ${failedServers - 3} 个 Server 不可用` : ''}${availableServers > 0 ? `；${availableServers} 个 Server 仍可用` : ''}${cachedServers > 0 ? `；${cachedServers} 个 Server 显示最后成功缓存` : ''}`
           : unknownServers > 0
             ? `工具状态未知：${unknownSummary}${unknownServers > 3 ? `；另有 ${unknownServers - 3} 个 Server 尚未确认` : ''}`
           : `共 ${servers.length} 个 server，${totalTools} 个工具`,
@@ -2728,6 +2884,7 @@ export async function apply(ctx, config) {
           failedServers,
           unknownServers,
           pendingManagedServers,
+          cachedServers,
           connectionState: health.connectionState,
           lastSuccessfulAt: health.lastSuccessfulAt,
           diagnostic: health.diagnostic,
@@ -2755,6 +2912,19 @@ export async function apply(ctx, config) {
       logger.warn(`skip invalid stored connection "${key}": ${error.message}`);
     }
   }
+  if (config.persistSecrets) {
+    for (const [key, cached] of await toolCatalogStore.entries().catch(() => [])) {
+      const record = state.connections.get(key);
+      if (record
+          && cached.connectorId === record.connectorId
+          && cached.serverName === record.serverName
+          && cached.connectionSignature === connectionToolCacheSignature(record)) {
+        state.toolCatalogCache.set(key, cached);
+      } else {
+        await toolCatalogStore.delete(key).catch(() => {});
+      }
+    }
+  }
   for (const [key, raw] of await grantStore.entries().catch(() => [])) {
     try {
       state.grants.set(key, grantRuntime(raw));
@@ -2812,7 +2982,8 @@ export async function apply(ctx, config) {
   hostGovernance.refresh();
   hostScopes.refresh();
 
-  const disposeTools = registerTools(ctx, api);
+  const observableApi = observeStatusEvents(api, statusEvents);
+  const disposeTools = registerTools(ctx, observableApi);
 
   /* ───────────────────────── web 半区（图形化市场）──────────────────────── */
   // webServer / webRuntime 仅存在于 web 部署；无此服务时静默跳过（纯对话工具场景仍可用）。
@@ -2820,7 +2991,7 @@ export async function apply(ctx, config) {
   if (typeof ctx.inject === 'function') {
     try {
       ctx.inject(['webServer', 'webRuntime'], (wctx) => {
-        disposeWeb = mountWebRoutes(wctx, api, { logger });
+        disposeWeb = mountWebRoutes(wctx, observableApi, { logger, eventHub: statusEvents });
         logger.info('mcp-connector web UI mounted at /mcp-connector/ui/');
       });
     } catch (error) {
@@ -2833,6 +3004,7 @@ export async function apply(ctx, config) {
     disposeWeb?.();
     hostGovernance.dispose();
     hostScopes.dispose();
+    statusEvents.dispose();
     versionStatusService.dispose();
     for (const g of state.grants.values()) if (g.timer) clearTimeout(g.timer);
   });

package/lib/schema.js

@@ -190,6 +190,28 @@ export const connectionScopeDocumentSchema = z.object({
   history: z.array(connectionScopeRevisionSchema),
 });
 
+/**
+ * 最近一次成功 tools/list 的安全能力快照。
+ * 这里只允许工具元数据与经过裁剪的输入 schema；调用参数、调用结果、凭据和原始错误均不入库。
+ */
+export const toolCatalogRecordSchema = z.object({
+  key: z.string().min(1).max(512),
+  connectorId: z.string().min(1).max(256),
+  serverKey: z.string().min(1).max(256).optional(),
+  serverName: z.string().min(1).max(256),
+  connectionSignature: z.string().regex(/^[a-f0-9]{64}$/),
+  observedAt: z.number().int().nonnegative(),
+  updatedAt: z.number().int().nonnegative(),
+  truncated: z.boolean().optional(),
+  tools: z.array(z.object({
+    name: z.string().min(1).max(512),
+    title: z.string().max(1024).optional(),
+    description: z.string().max(4096).optional(),
+    inputSchema: z.unknown().optional(),
+    schemaTruncated: z.boolean().optional(),
+  })).max(512),
+});
+
 /** OAuth 授权记录（通用多厂商） */
 export const grantRecordSchema = z.object({
   key: z.string().min(1),