dsh-mcp-connector 0.2.46 → 0.2.48

package/CHANGELOG.md

@@ -4,6 +4,30 @@
 
 ## [Unreleased]
 
+## [0.2.48] - 2026-09-15
+
+### Added
+
+- 新增受控 CLI→MCP Provider 框架，首批把钉钉官方 `dws` 的通讯录、日程、待办、文档、OA 待审批和日志查询映射为 11 个只读 MCP 工具。
+- 连接时通过官方 `dws auth status` 验证 OAuth 就绪状态，未登录、无权限或 Token 无法刷新时不误报“已连接”。
+
+### Security
+
+- CLI 只能执行代码审核的命令与参数，不经 Shell；写入动词、未声明参数和控制字符均拒绝。子进程超时、输出大小受限，成功及失败输出中的 Token/Secret 都在返回 Host 前脱敏。
+
+## [0.2.47] - 2026-09-14
+
+### Changed
+
+- 新增三张当前工具工作台宣传截图，覆盖统一工具搜索、参数详情与连接诊断；更新 Storefront 清单、来源版本与完整性哈希。
+- 将演示 GIF 更新为 43 秒六场景流程，并在中英文 README 中补齐当前能力截图。
+- 更新宣传总账、媒体发布登记和外部分发状态；记录 `dshmarket@1.46.1` 的五组搜索复验结果及 D+7/D+14 复盘日期。
+
+### Verification
+
+- 250 项自动测试通过；7 张 Storefront 截图及 43 秒演示通过哈希、尺寸、采集约束和无凭据检查；75 个发布文件通过白名单与敏感信息扫描。
+- npm/GitHub 营销元数据线上检查通过；外部目录非收敛项继续由 Issue #69 跟踪。
+
 ## [0.2.46] - 2026-09-13
 
 ### Changed
@@ -704,7 +728,9 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.46...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.48...HEAD
+[0.2.48]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.47...v0.2.48
+[0.2.47]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.46...v0.2.47
 [0.2.46]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.45...v0.2.46
 [0.2.45]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.44...v0.2.45
 [0.2.44]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.43...v0.2.44

package/README.en.md

@@ -36,7 +36,7 @@ dsh plugin --profile web add dsh-mcp-connector
 
 Fully restart DeepSeek Harness Desktop or `dsh web` after installation or upgrade, then open **MCP Connector** in the primary sidebar, or open it directly from **Settings → Plugins → Plugin Configuration → MCP Connector**.
 
-![16-second MCP Connector walkthrough](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/demo.gif)
+![43-second MCP Connector walkthrough](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/demo.gif)
 
 If the plugin helps you connect an MCP server faster, consider [starring the repository](https://github.com/duhu2000/dsh-mcp-connector/stargazers), [submitting a connector](https://github.com/duhu2000/dsh-mcp-connector-registry/blob/main/docs/ONBOARDING.md), or [contributing a fix](CONTRIBUTING.md).
 
@@ -87,8 +87,12 @@ As of 2026-09-11, the public Registry publishes 106 connector descriptors. After
 | ![Marketplace overview](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/01-market-overview.jpg) | ![Connector details](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/02-connector-detail.jpg) |
 | Tool discovery, descriptions, and scrolling | JSON import |
 | ![Tool discovery](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/03-tool-discovery.jpg) | ![JSON import](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/04-json-import.jpg) |
+| Unified tool search and sources | Parameter details and safe schema |
+| ![Unified tool search](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/05-unified-tool-search.png) | ![Tool parameter details](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/06-tool-parameters.png) |
+| Connection diagnostics and last-success cache |  |
+| ![Connection diagnostics](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/07-connection-diagnostics.png) |  |
 
-The assets are captured from a credential-free UI acceptance harness that mirrors the real 800px product panel, producing two cards per desktop row. They show only public marketplace metadata, example prompts, and explicitly marked mock tool descriptions—never credentials, local paths, or query results. See [`docs/screenshots/README.md`](docs/screenshots/README.md) for provenance.
+Assets `01`–`04` preserve the historical `v0.2.37` marketplace snapshot. Assets `05`–`07` and the 43-second walkthrough come from the current `v0.2.46` credential-free UI harness. The harness mirrors the real 800px product panel, producing two cards per desktop row. It shows only public marketplace metadata, example prompts, and explicitly marked mock tool descriptions—never credentials, local paths, or query results. See [`docs/screenshots/README.md`](docs/screenshots/README.md) for provenance.
 
 ## Installation
 
@@ -186,7 +190,7 @@ npm run dev:ui
 
 Every Registry merge regenerates `catalog-stats.json`; an hourly workflow in this repository synchronizes the Chinese and English product copy plus a local stats snapshot. The static npm README updates with package releases, while the live badges above read the Registry directly and therefore stay current without another npm release.
 
-The current public version is [`dsh-mcp-connector@0.2.46`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.46](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.46).
+The current public version is [`dsh-mcp-connector@0.2.48`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.48](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.48).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 
@@ -198,6 +202,7 @@ See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](d
 - External URLs use HTTPS by default, and HTTP is allowed for loopback development. A user-created connection may explicitly opt in to plaintext HTTP for literal RFC1918 IPv4 or RFC4193 IPv6 ULA addresses; hostnames, public HTTP, link-local addresses, and cloud metadata addresses remain blocked.
 - Remote descriptors and catalogs are limited to 2 MiB, Web API requests to 1 MiB, and imported JSON is scanned for credential fields before normalization.
 - Streamable HTTP and stdio are supported end to end. Legacy `sse` entries are normalized to Streamable HTTP. The connector passes stdio `command/args/env/cwd` to `@deepseek-ai/dsh-mcp-client` instead of reimplementing process transport.
+- Official CLIs that are not MCP servers can be exposed through a separate [controlled CLI Provider](docs/CLI-PROVIDERS.md). Only code-reviewed commands and arguments are available; the initial DingTalk `dws` provider is read-only.
 - stdio starts a local process. Import or connect only trusted commands and packages. Catalog descriptors may declare `credentialFields` and `credentialBindings`, but may never contain actual token/secret values; user input is injected only into the local Host process environment.
 - OAuth DCR client secrets share the same local-only boundary as access and refresh tokens and are omitted from catalog/status responses and logs.
 - OAuth failures identify resource discovery, server discovery, client registration, browser callback, or token exchange. A DCR HTTP 403 is reported as provider-side client admission rejection rather than a missing user authorization.

package/README.md

@@ -36,7 +36,7 @@ dsh plugin --profile web add dsh-mcp-connector
 
 安装或升级后完全重启 DeepSeek Harness Desktop 或 `dsh web`，然后打开左侧「🧩 MCP连接器」；也可从“设置 → 插件 → 插件配置 → MCP连接器”直接打开。
 
-![MCP 连接器 16 秒演示](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/demo.gif)
+![MCP 连接器 43 秒演示](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/demo.gif)
 
 如果它帮你更快地接入 MCP Server，欢迎 [GitHub 点个 Star](https://github.com/duhu2000/dsh-mcp-connector/stargazers)、[提交新的连接器](https://github.com/duhu2000/dsh-mcp-connector-registry/blob/main/docs/ONBOARDING.md)或[参与贡献](CONTRIBUTING.md)。
 
@@ -88,8 +88,12 @@ dsh plugin --profile web add dsh-mcp-connector
 | ![市场总览](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/01-market-overview.jpg) | ![连接器详情](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/02-connector-detail.jpg) |
 | 工具发现、描述与独立滚动 | JSON 导入 |
 | ![工具发现](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/03-tool-discovery.jpg) | ![JSON 导入](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/04-json-import.jpg) |
+| 统一工具搜索与来源 | 参数详情与安全 Schema |
+| ![统一工具搜索](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/05-unified-tool-search.png) | ![工具参数详情](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/06-tool-parameters.png) |
+| 连接诊断与最后成功缓存 |  |
+| ![连接诊断](https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector/main/docs/screenshots/07-connection-diagnostics.png) |  |
 
-素材从复刻真实 800px 产品面板的无凭据 UI 验收环境采集，桌面端一行 2 张卡片；只展示公开市场元数据、示例 Prompt 和明确标识的 Mock 工具说明，不包含凭据、本机路径或查询结果。详见 [`docs/screenshots/README.md`](docs/screenshots/README.md)。
+`01`–`04` 保留 `v0.2.37` 的历史市场快照，`05`–`07` 与 43 秒演示来自 `v0.2.46` 当前无凭据 UI harness。桌面端一行 2 张卡片；只展示公开市场元数据、示例 Prompt 和明确标识的 Mock 工具说明，不包含凭据、本机路径或查询结果。详见 [`docs/screenshots/README.md`](docs/screenshots/README.md)。
 
 ## 安装
 
@@ -181,7 +185,7 @@ npm run dev:ui
 
 公共 Registry 每次合并后会生成 `catalog-stats.json`；本仓库的定时工作流每小时同步中英文介绍和统计快照。npm 页面中的静态正文随版本发布更新，上方动态统计徽标则直接读取 Registry，可在不发布新 npm 版本时保持实时数量一致。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.46`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.46](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.46)。
+当前公开版本为 [`dsh-mcp-connector@0.2.48`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.48](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.48)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。
@@ -197,6 +201,7 @@ stdio 传输的架构、透传边界与安全约束见 [docs/STDIO-SUPPORT.md](d
 - 外部 URL 默认仅允许 HTTPS，HTTP 默认仅允许回环地址。用户自建连接可在明确风险确认后放行 RFC1918 IPv4 / RFC4193 IPv6 ULA 字面量；域名、公网 HTTP、链路本地与云元数据地址仍拒绝。
 - 远程目录/描述响应限制 2 MiB，Web API 请求限制 1 MiB；原始 JSON 在归一化前扫描凭据字段。
 - 完整覆盖 Streamable HTTP 与 stdio；旧 `sse` 配置在导入/恢复时归一为 Streamable HTTP。stdio 的 `command/args/env/cwd` 原样交给 `@deepseek-ai/dsh-mcp-client`，插件本身不重复实现进程传输。
+- 对本身不是 MCP Server 的官方 CLI，使用独立的[受控 CLI Provider](docs/CLI-PROVIDERS.md)桥接为 stdio MCP；只允许代码登记的命令与参数，首个钉钉 `dws` Provider 仅开放只读能力。
 - stdio 会启动本机进程：仅导入或连接可信命令/软件包。市场目录只能用 `credentialFields` + `credentialBindings` 声明输入与 env 映射，不得携带真实 token/secret；用户填写值只写入本机连接记录并交给 Host。
 - OAuth DCR 的 `client_secret` 与 Access/Refresh Token 采用相同的本机存储边界，不会进入市场 API、状态输出或日志。
 - OAuth 连接失败会标明资源发现、服务发现、客户端注册、授权回调或 Token 换取阶段；DCR HTTP 403 表示服务商拒绝未准入客户端，不是用户未点击授权。

package/docs/CLI-PROVIDERS.md

@@ -0,0 +1,56 @@
+# 受控 CLI Provider
+
+MCP 连接器原生支持 Streamable HTTP 和 stdio MCP。对于钉钉 `dws` 这类面向人类与 Agent、但本身不是 MCP Server 的官方 CLI，插件通过独立的 CLI→MCP 桥接进程暴露经过审核的结构化工具。
+
+## 安全边界
+
+- Provider 在代码中显式登记，市场卡片和工具参数均不能指定任意可执行文件。
+- 子进程通过 `spawn(command, args, { shell: false })` 启动，不解析 Shell 表达式。
+- 首个 `dingtalk-dws` Provider 仅登记只读命令；创建、发送、审批、拒绝、删除、更新和上传均不暴露。
+- 每个工具只接受 JSON Schema 声明过的字段，参数作为独立 argv 传递。
+- stdout/stderr 均受大小限制，执行有超时；错误中的 Token 和 Secret 在返回 Host 前脱敏。
+- MCP 客户端枚举工具前执行官方 `dws auth status` 预检；未登录、权限不足或 Token 无法刷新时连接直接失败，不会误显示“已连接”。
+- 登录、Token 刷新、企业管理员授权、租户隔离和 API 审计由官方 CLI 与开放平台负责。
+
+## 钉钉前置条件
+
+1. 市场卡片固定使用已审核的 `dingtalk-workspace-cli@1.0.61`，无需全局安装 `dws`。
+2. 首次连接前，在普通终端执行 `npx -y dingtalk-workspace-cli@1.0.61 auth login`；无浏览器环境加 `--device`。
+3. 企业管理员需在钉钉开发者平台开启 CLI 访问。
+4. 多组织用户可在工具参数里传稳定的 `corpId:userId` profile；不传时使用当前 profile。
+
+授权信息保存在钉钉官方 CLI 的用户配置和系统 Keychain 中，不写入 Connector 配置。后续升级 `dws` 需先复核官方命令、权限和输出 Schema，然后通过 Registry PR 更换固定版本。
+
+启动 MCP 桥接：
+
+```json
+{
+  "mcpServers": {
+    "dingtalk-workspace": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "--legacy-peer-deps",
+        "--package",
+        "dsh-mcp-connector@0.2.48",
+        "--package",
+        "dingtalk-workspace-cli@1.0.61",
+        "dsh-mcp-cli-bridge",
+        "--provider",
+        "dingtalk-dws"
+      ]
+    }
+  }
+}
+```
+
+## 首批只读能力
+
+- 当前用户、通讯录搜索与用户详情
+- 日程列表与日程详情
+- 待办列表与待办详情
+- 文档搜索
+- 待处理 OA 审批列表
+- 收到的日志和日志模板
+
+后续增加 Provider 或命令时，必须同时提供：官方来源、固定命令路径、输入 Schema、风险级别、只读/写入分类、脱敏策略和单元测试。写入命令不得混入只读 Provider。

package/docs/STDIO-SUPPORT.md

@@ -12,9 +12,9 @@
 
 ## 一、背景与目标
 
-### 1.1 现状缺口
+### 1.1 实施前的现状缺口（历史记录）
 
-当前 `dsh-mcp-connector` 的传输方式（`transport`）仅支持：
+以下内容记录实施前的缺口；当前版本已经支持 stdio。实施前 `dsh-mcp-connector` 的传输方式（`transport`）仅支持：
 
 - `streamable-http`
 - `sse`
@@ -23,11 +23,11 @@
 
 | 传输方式 | WorkBuddy | TraeWork | Qwen Code | 我们 |
 |---------|:--------:|:--------:|:--------:|:----:|
-| stdio（本地进程） | ✅ | ✅ | ✅ | ❌ |
+| stdio（本地进程） | ✅ | ✅ | ✅ | ✅（当前已完成） |
 | HTTP / streamable-http | ❓ | ✅ | ✅ | ✅ |
 | SSE | ❓ | ❓ | ✅ | ✅ |
 
-**缺失 stdio 导致**：无法接入大量社区 stdio 型 MCP server（GitHub、filesystem、playwright、memory 等 npm/pip 包）。
+**历史影响**：缺失 stdio 时无法接入大量社区 stdio 型 MCP server（GitHub、filesystem、playwright、memory 等 npm/pip 包）；该缺口现已关闭。
 
 ### 1.2 补齐目标
 

package/docs/screenshots/README.md

@@ -1,35 +1,28 @@
 # UI 素材说明
 
-本目录用于保存 `dsh-mcp-connector` 的公开界面截图。素材于 2026-09-06 从 `v0.2.37` 源码的
-无凭据 UI harness 采集：外层浏览器视口为 1280×720，harness 复刻产品宿主在
-`lib/client.js` 中定义的 800px 市场面板，因此桌面端稳定为一行 2 张卡片。公开 Registry
-快照含 105 条描述，与 4 张随包唯一卡片合并后市场显示 109 张。画面只展示公开市场元数据、
-示例 Prompt 和明确标识为 Mock 的工具数据，不包含 OAuth Token、API Key、本机路径、
-用户会话或查询结果。
-
-旧素材直接以 1280px 打开内部 iframe，绕过了真实产品的 800px 宿主面板，因此触发
-`auto-fill/minmax(300px)` 的 3 列布局；这是采集 harness/视口过期，不是当前产品 CSS 漂移。
-本次素材从浏览器中的真实页面状态直接截取，没有后期重排卡片或修改连接状态。
-
-仓库根目录的 [`screenshots.json`](../../screenshots.json) 按市场总览、连接器详情、工具发现、
-JSON 导入的顺序声明这 4 张图片，供 awesome-dsh-plugin 和 DSH Market 的 App Store 风格详情页
-直接采集。根清单保持外部消费者兼容的路径数组；[`assets.json`](assets.json) 记录
-1280×720 视口、800px 产品面板、2 列、无凭据状态，以及每张截图和 `demo.gif` 的
-SHA-256、尺寸与 GIF 时长。
-`npm run storefront:check` 会校验路径、顺序、格式、文件存在性、哈希、尺寸和采集约束；
-`npm run check` 已包含该门禁。
+本目录保存 `dsh-mcp-connector` 的公开界面截图。所有素材均来自无凭据 UI harness：外层浏览器视口为 1280×720，harness 复刻 `lib/client.js` 中定义的 800px 产品面板，因此桌面端稳定为一行 2 张卡片。画面只展示公开目录元数据、示例 Prompt 和明确标识为 Mock 的工具数据，不包含 OAuth Token、API Key、本机路径、用户会话或查询结果。
+
+素材分为两组，避免把历史截图误写成当前版本：
+
+- `01`–`04` 是 2026-09-06 从 `v0.2.37` 采集的历史市场、详情、发现和导入快照；当时公开 Registry 为 105 条，与 4 张随包唯一卡片去重后显示 109 张。
+- `05`–`07` 和 `../demo.gif` 是 2026-09-14 从 `v0.2.46` 当前 UI harness 采集的工具工作台、参数和诊断素材。harness 中的目录数量、连接数量和工具数量属于测试夹具，不代表生产市场统计。
+
+旧素材曾直接以 1280px 打开内部 iframe，绕过真实产品的 800px 宿主面板，因此触发 `auto-fill/minmax(300px)` 的 3 列布局；这是采集 harness/视口过期，不是产品 CSS 漂移。当前全部登记素材都从浏览器中的真实页面状态直接截取，没有后期重排卡片或修改连接状态。
+
+仓库根目录的 [`screenshots.json`](../../screenshots.json) 按市场总览、连接器详情、工具发现、JSON 导入、统一工具搜索、参数详情和连接诊断的顺序声明 7 张图片，供 awesome-dsh-plugin 和 DSH Market 的 App Store 风格详情页采集。根清单保持外部消费者兼容的路径数组；[`assets.json`](assets.json) 记录采集版本、视口、产品面板、无凭据状态，以及每张截图和 `demo.gif` 的 SHA-256、尺寸与 GIF 时长。
 
 | 文件 | 展示内容 |
 |---|---|
-| `01-market-overview.jpg` | 109 张合并市场卡片、桌面两列、推荐章节、9 分类和固定分类栏；展示“企查查·智能文档解析”新名称与未配置状态 |
-| `02-connector-detail.jpg` | 智能文档解析一次 OAuth 授权同时连接 2 个 Server：远程 Agent 解析在线 URL，本地 Agent 通过 `npx -y qcc-document-mcp` 解析本机文件 |
-| `03-tool-discovery.jpg` | Context7 无凭据 Mock 健康状态、Mock 工具数量/描述、搜索和独立滚动区 |
-| `04-json-import.jpg` | Streamable HTTP / stdio JSON 导入与本机凭据提示 |
-
-`../demo.gif` 由以上 4 个真实浏览器状态顺序编码，时长 16 秒，分辨率 960×540；编码只做
-等比例缩放和 GIF 调色，不改变布局或状态。更新 UI 后应继续使用 1280×720 浏览器视口、
-800px 产品面板和无凭据初始状态重新采集，并检查桌面两列、企查查卡片不出现
-“需重新授权”，且画面不包含凭据、本机路径、真实会话、查询结果或其他不应公开的内容。
-
-截图顶部“无凭据 Mock”标识和工具名中的 `mock_` 前缀用于明确区分验收数据与真实授权。
-真实用户的已安装数量、授权状态和服务健康度会因本机环境而不同。
+| `01-market-overview.jpg` | `v0.2.37` 历史市场快照：109 张合并市场卡片、桌面两列、推荐章节、9 分类和固定分类栏 |
+| `02-connector-detail.jpg` | `v0.2.37` 智能文档解析详情：一次 OAuth 授权同时连接远程 URL 解析与本地 `qcc-document-mcp` 文件解析 |
+| `03-tool-discovery.jpg` | `v0.2.37` Context7 无凭据 Mock 健康状态、Mock 工具数量/描述、搜索和独立滚动区 |
+| `04-json-import.jpg` | `v0.2.37` Streamable HTTP / stdio JSON 导入与本机凭据提示 |
+| `05-unified-tool-search.png` | `v0.2.46` 统一工具搜索：跨连接结果、来源、发现失败和最后成功缓存 |
+| `06-tool-parameters.png` | `v0.2.46` 参数详情：必填、类型、枚举、嵌套结构和原始安全 Schema |
+| `07-connection-diagnostics.png` | `v0.2.46` 连接诊断：成功缓存、可控失败原因、建议、“检查连接”和“重新发现工具” |
+
+`../demo.gif` 由 6 个真实浏览器状态顺序编码：市场、连接器详情、工具详情、统一搜索、参数 Schema、连接诊断。时长 43 秒，分辨率 960×540；编码只做等比例缩放和 GIF 调色，不改变布局或状态。
+
+`npm run storefront:check` 校验路径、顺序、格式、文件存在性、哈希、尺寸和采集约束；`npm run check` 已包含该门禁。更新 UI 后继续使用 1280×720 浏览器视口、800px 产品面板和无凭据初始状态采集，并检查桌面两列、企查查卡片不出现“需重新授权”，且画面不包含凭据、本机路径、真实会话、查询结果或其他不应公开的内容。
+
+截图顶部“无凭据 Mock”标识和工具名中的 `mock_` 前缀用于明确区分验收数据与真实授权。真实用户的已安装数量、授权状态和服务健康度会因本机环境而不同。

package/docs/screenshots/assets.json

@@ -1,14 +1,17 @@
 {
   "schemaVersion": 1,
   "capture": {
-    "capturedOn": "2026-09-06",
+    "capturedOn": "2026-09-14",
+    "sourceVersion": "0.2.46",
     "browserViewport": {
       "width": 1280,
       "height": 720
     },
     "productPanelWidth": 800,
     "desktopCardColumns": 2,
-    "state": "credential-free-mock"
+    "state": "credential-free-mock",
+    "preservedLegacyScreenshots": 4,
+    "notes": "01-04 preserve the 2026-09-06 v0.2.37 storefront snapshot; 05-07 and demo.gif were captured from the current v0.2.46 UI harness on 2026-09-14."
   },
   "screenshots": [
     {
@@ -34,13 +37,39 @@
       "sha256": "de0a87cc7f247fad40ac37188f5a1d026f4087571e98d64595e80f8bcd9410be",
       "width": 1280,
       "height": 720
+    },
+    {
+      "path": "docs/screenshots/05-unified-tool-search.png",
+      "sha256": "a75119afeccdb666e1496917ab1cac50e368882412fe5ce16cfdb268c2a6595b",
+      "width": 1280,
+      "height": 720,
+      "capturedOn": "2026-09-14",
+      "sourceVersion": "0.2.46"
+    },
+    {
+      "path": "docs/screenshots/06-tool-parameters.png",
+      "sha256": "199a960e6c07c84ff2e3b99acf64536b6875f2ebf08b5a86a1df971cc120da70",
+      "width": 1280,
+      "height": 720,
+      "capturedOn": "2026-09-14",
+      "sourceVersion": "0.2.46"
+    },
+    {
+      "path": "docs/screenshots/07-connection-diagnostics.png",
+      "sha256": "5ca0e53cf560c68a06239c29651f9d9e49ee184c43d43432ccdc4139299e811b",
+      "width": 1280,
+      "height": 720,
+      "capturedOn": "2026-09-14",
+      "sourceVersion": "0.2.46"
     }
   ],
   "demo": {
     "path": "docs/demo.gif",
-    "sha256": "c9a84ce9c164c1b9f846f8b5a65afd8dd5c49741c9dfc530f1ad766e47b3d2b6",
+    "sha256": "69250ef0d6730d2c708c1fea6a3c8041d495008a40f53a02a894238601f165ec",
     "width": 960,
     "height": 540,
-    "durationSeconds": 16
+    "durationSeconds": 43,
+    "capturedOn": "2026-09-14",
+    "sourceVersion": "0.2.46"
   }
 }

package/lib/cli-providers.js

@@ -0,0 +1,436 @@
+import { spawn } from 'node:child_process';
+
+const MAX_OUTPUT_BYTES = 1024 * 1024;
+const DEFAULT_TIMEOUT_MS = 30_000;
+const WRITE_VERBS = new Set([
+  'add', 'approve', 'create', 'delete', 'disable', 'done', 'enable', 'insert',
+  'invite', 'move', 'recall', 'reject', 'remove', 'rename', 'reply', 'revoke',
+  'send', 'switch', 'update', 'upload',
+]);
+
+function stringField(flag, options = {}) {
+  return { flag, type: 'string', ...options };
+}
+
+function integerField(flag, options = {}) {
+  return { flag, type: 'integer', ...options };
+}
+
+function booleanField(flag, options = {}) {
+  return { flag, type: 'boolean', ...options };
+}
+
+function stringArrayField(flag, options = {}) {
+  return { flag, type: 'string-array', ...options };
+}
+
+const profileField = stringField('--profile', {
+  global: true,
+  description: '可选的钉钉账号 profile（建议使用 corpId:userId）。不填写时使用 dws 当前 profile。',
+});
+
+function readTool(name, description, command, fields = {}) {
+  return { name, description, command, fields, readOnly: true };
+}
+
+const dingtalkDwsTools = [
+  readTool(
+    'dingtalk_get_current_user',
+    '读取当前钉钉 OAuth 身份的用户、组织和部门信息。',
+    ['contact', 'user', 'get-self'],
+    { profile: profileField },
+  ),
+  readTool(
+    'dingtalk_search_users',
+    '按关键词只读搜索钉钉企业通讯录。多人同名时应展示候选，不得自动选择。',
+    ['contact', 'user', 'search'],
+    {
+      profile: profileField,
+      query: stringField('--query', { required: true, description: '姓名、职位或通讯录关键词。' }),
+    },
+  ),
+  readTool(
+    'dingtalk_get_users',
+    '按一个或多个 userId 批量读取钉钉用户资料。',
+    ['contact', 'user', 'get'],
+    {
+      profile: profileField,
+      ids: stringArrayField('--ids', { required: true, description: '钉钉 userId 列表。' }),
+    },
+  ),
+  readTool(
+    'dingtalk_list_calendar_events',
+    '只读列出当前用户在指定时间范围内的钉钉日程；不传时间时由 dws 使用默认范围。',
+    ['calendar', 'event', 'list'],
+    {
+      profile: profileField,
+      start: stringField('--start', { description: 'ISO 8601 开始时间。' }),
+      end: stringField('--end', { description: 'ISO 8601 结束时间。' }),
+    },
+  ),
+  readTool(
+    'dingtalk_get_calendar_event',
+    '按日程 ID 只读获取钉钉日程详情。',
+    ['calendar', 'event', 'get'],
+    {
+      profile: profileField,
+      id: stringField('--id', { required: true, description: '日程 ID。' }),
+    },
+  ),
+  readTool(
+    'dingtalk_list_todos',
+    '只读列出当前用户的钉钉待办。',
+    ['todo', 'task', 'list'],
+    {
+      profile: profileField,
+      page: integerField('--page', { minimum: 1, maximum: 10000, description: '页码。' }),
+      size: integerField('--size', { minimum: 1, maximum: 100, description: '每页数量。' }),
+      completed: booleanField('--status', { description: 'true 仅已完成，false 仅未完成；不传则不过滤。' }),
+    },
+  ),
+  readTool(
+    'dingtalk_get_todo',
+    '按待办 ID 只读获取钉钉待办详情。',
+    ['todo', 'task', 'get'],
+    {
+      profile: profileField,
+      taskId: stringField('--task-id', { required: true, description: '待办任务 ID。' }),
+    },
+  ),
+  readTool(
+    'dingtalk_search_documents',
+    '只读搜索当前用户有权访问的钉钉文件和文档。',
+    ['drive', 'search'],
+    {
+      profile: profileField,
+      query: stringField('--query', { required: true, description: '文件或文档标题、内容关键词。' }),
+    },
+  ),
+  readTool(
+    'dingtalk_list_pending_approvals',
+    '只读列出指定时间范围内当前用户待处理的钉钉 OA 审批实例；不会执行同意或拒绝。',
+    ['oa', 'approval', 'list-pending'],
+    {
+      profile: profileField,
+      start: stringField('--start', { required: true, description: 'ISO 8601 开始时间。' }),
+      end: stringField('--end', { required: true, description: 'ISO 8601 结束时间。' }),
+      page: integerField('--page', { minimum: 1, maximum: 10000, description: '页码。' }),
+      limit: integerField('--limit', { minimum: 1, maximum: 100, description: '每页数量。' }),
+    },
+  ),
+  readTool(
+    'dingtalk_list_reports',
+    '只读列出指定时间范围内当前用户收到的钉钉日志。',
+    ['report', 'inbox', 'list'],
+    {
+      profile: profileField,
+      start: stringField('--start', { required: true, description: 'ISO 8601 开始时间。' }),
+      end: stringField('--end', { required: true, description: 'ISO 8601 结束时间。' }),
+      cursor: integerField('--cursor', { minimum: 0, description: '分页游标。' }),
+      size: integerField('--size', { minimum: 1, maximum: 20, description: '返回数量。' }),
+    },
+  ),
+  readTool(
+    'dingtalk_list_report_templates',
+    '只读列出当前用户可用的钉钉日志模板。',
+    ['report', 'template', 'list'],
+    { profile: profileField },
+  ),
+];
+
+export const CLI_PROVIDERS = Object.freeze({
+  'dingtalk-dws': Object.freeze({
+    id: 'dingtalk-dws',
+    name: '钉钉工作台 CLI',
+    executable: 'dws',
+    homepage: 'https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli',
+    preflight: Object.freeze(['auth', 'status']),
+    tools: Object.freeze(dingtalkDwsTools),
+  }),
+});
+
+function inputSchema(tool) {
+  const properties = {};
+  const required = [];
+  for (const [name, field] of Object.entries(tool.fields)) {
+    const schema = { description: field.description };
+    if (field.type === 'integer') {
+      schema.type = 'integer';
+      if (field.minimum !== undefined) schema.minimum = field.minimum;
+      if (field.maximum !== undefined) schema.maximum = field.maximum;
+    } else if (field.type === 'boolean') {
+      schema.type = 'boolean';
+    } else if (field.type === 'string-array') {
+      schema.type = 'array';
+      schema.items = { type: 'string', minLength: 1 };
+      schema.minItems = 1;
+      schema.maxItems = 100;
+    } else {
+      schema.type = 'string';
+      schema.minLength = 1;
+    }
+    properties[name] = schema;
+    if (field.required) required.push(name);
+  }
+  return {
+    type: 'object',
+    properties,
+    additionalProperties: false,
+    ...(required.length ? { required } : {}),
+  };
+}
+
+export function listCliProviderTools(providerId) {
+  const provider = CLI_PROVIDERS[providerId];
+  if (!provider) throw new Error(`unknown CLI provider: ${providerId}`);
+  return provider.tools.map((tool) => ({
+    name: tool.name,
+    description: tool.description,
+    inputSchema: inputSchema(tool),
+    annotations: {
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true,
+    },
+  }));
+}
+
+function assertSafeExecutable(executable) {
+  const value = String(executable ?? '').trim();
+  if (!value || /[\0\r\n]/.test(value) || /\s/.test(value)) {
+    throw new Error('CLI executable must be one command name or an absolute path without whitespace');
+  }
+  return value;
+}
+
+function validateField(name, value, field) {
+  if (value === undefined || value === null || value === '') {
+    if (field.required) throw new Error(`missing required argument: ${name}`);
+    return undefined;
+  }
+  if (field.type === 'string') {
+    if (typeof value !== 'string' || !value.trim()) throw new Error(`${name} must be a non-empty string`);
+    if (/[\0\r\n]/.test(value)) throw new Error(`${name} contains forbidden control characters`);
+    return value;
+  }
+  if (field.type === 'integer') {
+    if (!Number.isInteger(value)) throw new Error(`${name} must be an integer`);
+    if (field.minimum !== undefined && value < field.minimum) throw new Error(`${name} must be >= ${field.minimum}`);
+    if (field.maximum !== undefined && value > field.maximum) throw new Error(`${name} must be <= ${field.maximum}`);
+    return String(value);
+  }
+  if (field.type === 'boolean') {
+    if (typeof value !== 'boolean') throw new Error(`${name} must be a boolean`);
+    return String(value);
+  }
+  if (field.type === 'string-array') {
+    if (!Array.isArray(value) || !value.length || value.length > 100) {
+      throw new Error(`${name} must be an array containing 1-100 strings`);
+    }
+    const values = value.map((item) => {
+      if (typeof item !== 'string' || !item.trim() || /[\0\r\n,]/.test(item)) {
+        throw new Error(`${name} contains an invalid item`);
+      }
+      return item;
+    });
+    return values.join(',');
+  }
+  throw new Error(`unsupported field type for ${name}`);
+}
+
+export function buildCliInvocation(providerId, toolName, input = {}, options = {}) {
+  const provider = CLI_PROVIDERS[providerId];
+  if (!provider) throw new Error(`unknown CLI provider: ${providerId}`);
+  const tool = provider.tools.find((candidate) => candidate.name === toolName);
+  if (!tool) throw new Error(`unknown tool for ${providerId}: ${toolName}`);
+  if (!tool.readOnly || tool.command.some((part) => WRITE_VERBS.has(part))) {
+    throw new Error(`CLI provider tool is not approved for read-only execution: ${toolName}`);
+  }
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw new Error('tool arguments must be an object');
+  }
+  const unknown = Object.keys(input).filter((key) => !Object.hasOwn(tool.fields, key));
+  if (unknown.length) throw new Error(`unknown tool arguments: ${unknown.join(', ')}`);
+
+  const globalArgs = [];
+  const commandArgs = [];
+  for (const [name, field] of Object.entries(tool.fields)) {
+    const value = validateField(name, input[name], field);
+    if (value === undefined) continue;
+    const target = field.global ? globalArgs : commandArgs;
+    target.push(field.flag, value);
+  }
+  return {
+    command: assertSafeExecutable(options.executable ?? process.env.DSH_MCP_DINGTALK_DWS_BIN ?? provider.executable),
+    args: [...globalArgs, ...tool.command, ...commandArgs, '--format', 'json'],
+    provider,
+    tool,
+  };
+}
+
+export function buildCliPreflightInvocation(providerId, options = {}) {
+  const provider = CLI_PROVIDERS[providerId];
+  if (!provider) throw new Error(`unknown CLI provider: ${providerId}`);
+  if (!Array.isArray(provider.preflight) || !provider.preflight.length) return null;
+  if (provider.preflight.some((part) => WRITE_VERBS.has(part))) {
+    throw new Error(`CLI provider preflight is not approved for read-only execution: ${providerId}`);
+  }
+  return {
+    command: assertSafeExecutable(options.executable ?? process.env.DSH_MCP_DINGTALK_DWS_BIN ?? provider.executable),
+    args: [...provider.preflight, '--format', 'json'],
+  };
+}
+
+export function redactCliError(value) {
+  return String(value ?? '')
+    .replace(/(authorization\s*[:=]\s*bearer\s+)[^\s"']+/gi, '$1[REDACTED]')
+    .replace(/(["']?(?:(?:access|refresh)[_-]?token|client[_-]?secret|app[_-]?secret)["']?\s*[=:]\s*["']?)[^\s,"'}]+/gi, '$1[REDACTED]')
+    .replace(/Bearer\s+[A-Za-z0-9._~+\/-]+/gi, 'Bearer [REDACTED]')
+    .trim();
+}
+
+export function runCliProcess(command, args, options = {}) {
+  const timeoutMs = Number.isInteger(options.timeoutMs) ? options.timeoutMs : DEFAULT_TIMEOUT_MS;
+  const maxOutputBytes = Number.isInteger(options.maxOutputBytes) ? options.maxOutputBytes : MAX_OUTPUT_BYTES;
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      shell: false,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: options.env ?? process.env,
+    });
+    const stdout = [];
+    const stderr = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let settled = false;
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(error);
+    };
+    const timer = setTimeout(() => {
+      child.kill('SIGTERM');
+      fail(new Error(`CLI command timed out after ${timeoutMs}ms`));
+    }, Math.max(1000, Math.min(timeoutMs, 300_000)));
+
+    child.once('error', (error) => {
+      if (error?.code === 'ENOENT') {
+        fail(new Error(`未找到官方 CLI 命令“${command}”；请先完成安装和 OAuth 登录，再重启 DSH`));
+        return;
+      }
+      fail(error);
+    });
+    child.stdout.on('data', (chunk) => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes > maxOutputBytes) {
+        child.kill('SIGTERM');
+        fail(new Error(`CLI stdout exceeded ${maxOutputBytes} bytes`));
+        return;
+      }
+      stdout.push(chunk);
+    });
+    child.stderr.on('data', (chunk) => {
+      stderrBytes += chunk.length;
+      if (stderrBytes <= maxOutputBytes) stderr.push(chunk);
+    });
+    child.once('close', (code, signal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      const output = Buffer.concat(stdout).toString('utf8').trim();
+      const errorOutput = redactCliError(Buffer.concat(stderr).toString('utf8'));
+      if (code !== 0) {
+        const hint = {
+          2: '身份认证或授权失败；请运行 dws auth login，并确认企业管理员已开启 CLI 访问',
+          3: '参数未通过当前固定 dws 版本校验；请核对工具参数或升级 MCP 连接器目录',
+          4: '钉钉要求补充权限授权；请按官方授权提示完成后重试',
+          6: 'dws 命令或服务发现失败；请检查网络、登录状态与 MCP 连接器目录版本',
+        }[code] ?? '';
+        const details = [hint, errorOutput, signal ? `signal=${signal}` : ''].filter(Boolean).join('；');
+        reject(new Error(`CLI command failed with exit code ${code}${details ? `: ${details}` : ''}`));
+        return;
+      }
+      resolve(output);
+    });
+  });
+}
+
+export async function executeCliProviderTool(providerId, toolName, input = {}, options = {}) {
+  const invocation = buildCliInvocation(providerId, toolName, input, options);
+  const runner = options.runner ?? runCliProcess;
+  const output = await runner(invocation.command, invocation.args, options);
+  let normalized = redactCliError(output || '{"ok":true}');
+  try {
+    normalized = JSON.stringify(JSON.parse(normalized), null, 2);
+  } catch {
+    // Keep non-JSON success output readable; dws normally emits JSON with --format json.
+  }
+  return {
+    content: [{ type: 'text', text: normalized }],
+    isError: false,
+  };
+}
+
+export async function ensureCliProviderReady(providerId, options = {}) {
+  const invocation = buildCliPreflightInvocation(providerId, options);
+  if (!invocation) return;
+  const runner = options.runner ?? runCliProcess;
+  await runner(invocation.command, invocation.args, options);
+}
+
+export async function handleCliBridgeRequest(message, options = {}) {
+  const providerId = options.providerId ?? 'dingtalk-dws';
+  if (!message || typeof message !== 'object') throw new Error('invalid JSON-RPC message');
+  if (!Object.hasOwn(message, 'id')) return null;
+  const base = { jsonrpc: '2.0', id: message.id };
+  try {
+    if (message.method === 'initialize') {
+      return {
+        ...base,
+        result: {
+          protocolVersion: message.params?.protocolVersion ?? '2025-06-18',
+          capabilities: { tools: { listChanged: false } },
+          serverInfo: { name: `dsh-mcp-cli-bridge/${providerId}`, version: '1.0.0' },
+        },
+      };
+    }
+    if (message.method === 'ping') return { ...base, result: {} };
+    if (message.method === 'tools/list') {
+      try {
+        const preflight = options.preflight ?? ensureCliProviderReady;
+        await preflight(providerId, options);
+      } catch (error) {
+        return {
+          ...base,
+          error: {
+            code: -32001,
+            message: `CLI Provider 未就绪：${redactCliError(error?.message ?? error)}`,
+          },
+        };
+      }
+      return { ...base, result: { tools: listCliProviderTools(providerId) } };
+    }
+    if (message.method === 'tools/call') {
+      const name = message.params?.name;
+      const args = message.params?.arguments ?? {};
+      try {
+        const execute = options.execute ?? executeCliProviderTool;
+        return { ...base, result: await execute(providerId, name, args, options) };
+      } catch (error) {
+        return {
+          ...base,
+          result: {
+            content: [{ type: 'text', text: redactCliError(error?.message ?? error) }],
+            isError: true,
+          },
+        };
+      }
+    }
+    return { ...base, error: { code: -32601, message: `Method not found: ${message.method}` } };
+  } catch (error) {
+    return { ...base, error: { code: -32603, message: redactCliError(error?.message ?? error) } };
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.46",
+  "version": "0.2.48",
   "description": "DeepSeek Harness MCP Connector: connect servers, search tools across active connections, and troubleshoot discovery. Includes a continuously updated catalog; supports OAuth 2.0 PKCE, API keys, Streamable HTTP/stdio, and mcpServers JSON import.",
   "type": "module",
   "main": "lib/index.js",
@@ -10,7 +10,8 @@
     "./package.json": "./package.json"
   },
   "bin": {
-    "dsh-mcp-connector-probe": "scripts/probe-connector.mjs"
+    "dsh-mcp-connector-probe": "scripts/probe-connector.mjs",
+    "dsh-mcp-cli-bridge": "scripts/cli-bridge.mjs"
   },
   "files": [
     "lib",
@@ -25,6 +26,7 @@
     "docs/TOOL-GOVERNANCE.md",
     "docs/FIRST-CONTRIBUTION.md",
     "docs/STDIO-SUPPORT.md",
+    "docs/CLI-PROVIDERS.md",
     "docs/USER-GUIDE.md",
     "docs/screenshots",
     "cordis.patch.yml",
@@ -36,12 +38,13 @@
     "LICENSE",
     "install.sh",
     "scripts/probe-connector.mjs",
+    "scripts/cli-bridge.mjs",
     "scripts/build-registry.mjs",
     "scripts/ui-harness.mjs"
   ],
   "scripts": {
     "test": "node --test",
-    "lint": "node --check lib/discovery-policy.js && node --check lib/index.js && node --check lib/web.js && node --check lib/client.js && node --check lib/settings.js && node --check lib/version-status.js && node --check lib/schema.js && node --check lib/catalog.js && node --check lib/prompts.js && node --check lib/probe.js && node --check lib/diagnostics.js && node --check lib/connection-backup.js && node --check lib/connection-editor.js && node --check lib/connection-scopes.js && node --check lib/governance.js && node --check lib/tool-catalog-cache.js && node --check lib/status-events.js && node --check lib/mcp-validation.js && node --check lib/mcp-http.js && node --check lib/migration.js && node --check lib/stores.js && node --check lib/grant-journal.js && node --check lib/oauth.js && node --check lib/grant-lifecycle.js && node --check lib/callback-server.js && node --check lib/mcp-provision.js && node --check lib/util.js && node --check lib/constants.js && node --check lib/tools.js && node --check lib/connectors/oauth-connector.js && node --check lib/connectors/manual-connector.js && node --check lib/connectors/json-connector.js && node --check scripts/probe-connector.mjs && node --check scripts/build-registry.mjs && node --check scripts/ui-harness.mjs && node --check scripts/check-market-registration.mjs && node --check scripts/check-distribution-sync.mjs && node --check scripts/check-readme-version.mjs && node --check scripts/check-marketing-metadata.mjs && node --check scripts/check-storefront-screenshots.mjs && node --check scripts/sync-registry-stats.mjs && node --check scripts/verify-pack.mjs",
+    "lint": "node --check lib/discovery-policy.js && node --check lib/index.js && node --check lib/web.js && node --check lib/client.js && node --check lib/settings.js && node --check lib/version-status.js && node --check lib/schema.js && node --check lib/catalog.js && node --check lib/prompts.js && node --check lib/probe.js && node --check lib/diagnostics.js && node --check lib/connection-backup.js && node --check lib/connection-editor.js && node --check lib/connection-scopes.js && node --check lib/governance.js && node --check lib/tool-catalog-cache.js && node --check lib/status-events.js && node --check lib/mcp-validation.js && node --check lib/mcp-http.js && node --check lib/migration.js && node --check lib/stores.js && node --check lib/grant-journal.js && node --check lib/oauth.js && node --check lib/grant-lifecycle.js && node --check lib/callback-server.js && node --check lib/mcp-provision.js && node --check lib/cli-providers.js && node --check lib/util.js && node --check lib/constants.js && node --check lib/tools.js && node --check lib/connectors/oauth-connector.js && node --check lib/connectors/manual-connector.js && node --check lib/connectors/json-connector.js && node --check scripts/probe-connector.mjs && node --check scripts/cli-bridge.mjs && node --check scripts/build-registry.mjs && node --check scripts/ui-harness.mjs && node --check scripts/check-market-registration.mjs && node --check scripts/check-distribution-sync.mjs && node --check scripts/check-readme-version.mjs && node --check scripts/check-marketing-metadata.mjs && node --check scripts/check-storefront-screenshots.mjs && node --check scripts/sync-registry-stats.mjs && node --check scripts/verify-pack.mjs",
     "registry:build": "node scripts/build-registry.mjs",
     "registry:validate": "node scripts/probe-connector.mjs catalog/catalog.json --validate-only",
     "dev:ui": "node scripts/ui-harness.mjs",

package/screenshots.json

@@ -2,5 +2,8 @@
   "docs/screenshots/01-market-overview.jpg",
   "docs/screenshots/02-connector-detail.jpg",
   "docs/screenshots/03-tool-discovery.jpg",
-  "docs/screenshots/04-json-import.jpg"
+  "docs/screenshots/04-json-import.jpg",
+  "docs/screenshots/05-unified-tool-search.png",
+  "docs/screenshots/06-tool-parameters.png",
+  "docs/screenshots/07-connection-diagnostics.png"
 ]

package/scripts/cli-bridge.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import { handleCliBridgeRequest } from '../lib/cli-providers.js';
+
+function providerFromArgs(argv) {
+  const index = argv.indexOf('--provider');
+  if (index < 0) return 'dingtalk-dws';
+  const value = argv[index + 1];
+  if (!value || value.startsWith('-')) throw new Error('--provider requires a value');
+  return value;
+}
+
+const providerId = providerFromArgs(process.argv.slice(2));
+let buffer = '';
+
+function send(message) {
+  process.stdout.write(`${JSON.stringify(message)}\n`);
+}
+
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => {
+  buffer += chunk;
+  while (buffer.includes('\n')) {
+    const index = buffer.indexOf('\n');
+    const line = buffer.slice(0, index).trim();
+    buffer = buffer.slice(index + 1);
+    if (!line) continue;
+    Promise.resolve()
+      .then(() => handleCliBridgeRequest(JSON.parse(line), { providerId }))
+      .then((response) => { if (response) send(response); })
+      .catch((error) => send({
+        jsonrpc: '2.0',
+        id: null,
+        error: { code: -32700, message: String(error?.message ?? error) },
+      }));
+  }
+});