dsh-mcp-connector 0.2.48 → 0.2.49

package/CHANGELOG.md

@@ -4,6 +4,18 @@
 
 ## [Unreleased]
 
+## [0.2.49] - 2026-09-15
+
+### Fixed
+
+- 修复钉钉 CLI 状态查询返回 `success: true, authenticated: false` 时误显示已连接：枚举工具前严格检查授权布尔值，异常响应安全拒绝，并提示官方 OAuth 登录命令。
+- 重建运行配置时精确升级旧市场钉钉桥接版本，保留用户自定义命令与凭据。
+
+### Changed
+
+- 卡片、详情和连接入口显示提供方、授权方式、运行位置和权限提示；连接失败在弹窗内保留原因。
+- 增加 0.2.50 授权设计及 WPS / 腾讯会议接入验证清单，尚不代表完成真实租户验收。
+
 ## [0.2.48] - 2026-09-15
 
 ### Added

package/README.en.md

@@ -190,7 +190,7 @@ npm run dev:ui
 
 Every Registry merge regenerates `catalog-stats.json`; an hourly workflow in this repository synchronizes the Chinese and English product copy plus a local stats snapshot. The static npm README updates with package releases, while the live badges above read the Registry directly and therefore stay current without another npm release.
 
-The current public version is [`dsh-mcp-connector@0.2.48`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.48](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.48).
+The current public version is [`dsh-mcp-connector@0.2.49`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.49](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.49).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -185,7 +185,7 @@ npm run dev:ui
 
 公共 Registry 每次合并后会生成 `catalog-stats.json`；本仓库的定时工作流每小时同步中英文介绍和统计快照。npm 页面中的静态正文随版本发布更新，上方动态统计徽标则直接读取 Registry，可在不发布新 npm 版本时保持实时数量一致。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.48`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.48](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.48)。
+当前公开版本为 [`dsh-mcp-connector@0.2.49`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.49](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.49)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/docs/CLI-PROVIDERS.md

@@ -9,7 +9,9 @@ MCP 连接器原生支持 Streamable HTTP 和 stdio MCP。对于钉钉 `dws` 这
 - 首个 `dingtalk-dws` Provider 仅登记只读命令；创建、发送、审批、拒绝、删除、更新和上传均不暴露。
 - 每个工具只接受 JSON Schema 声明过的字段，参数作为独立 argv 传递。
 - stdout/stderr 均受大小限制，执行有超时；错误中的 Token 和 Secret 在返回 Host 前脱敏。
-- MCP 客户端枚举工具前执行官方 `dws auth status` 预检；未登录、权限不足或 Token 无法刷新时连接直接失败，不会误显示“已连接”。
+- MCP 客户端枚举工具前执行官方 `dws auth status` 预检；只有 JSON 明确返回 `success: true` 且 `authenticated: true` 才列出工具。退出码为 0 不代表已登录；未授权或响应异常时拒绝连接并提供登录提示。预检不代表全部业务权限已获批，具体工具仍由官方 CLI 校验权限。
+- 首次登录请在运行 DSH 的同一电脑、同一系统用户下执行 `npx -y dingtalk-workspace-cli@1.0.61 auth login`（无浏览器环境加 `--device`），完成后重新连接。不会自动替用户登录或读取聊天记录。
+- Authentication readiness requires both `success === true` and `authenticated === true`; a successful status query alone is insufficient. Invalid responses fail closed without exposing identity or tokens. Run the login command above as the same OS user running DSH, then reconnect. Per-tool permissions are still enforced by the official CLI.
 - 登录、Token 刷新、企业管理员授权、租户隔离和 API 审计由官方 CLI 与开放平台负责。
 
 ## 钉钉前置条件

package/lib/cli-providers.js

@@ -378,7 +378,30 @@ export async function ensureCliProviderReady(providerId, options = {}) {
   const invocation = buildCliPreflightInvocation(providerId, options);
   if (!invocation) return;
   const runner = options.runner ?? runCliProcess;
-  await runner(invocation.command, invocation.args, options);
+  const output = await runner(invocation.command, invocation.args, options);
+  // Exit code 0 / success:true means the status query succeeded, not that
+  // the user is authenticated. Never expose the raw status (identity/tokens).
+  let status;
+  try {
+    status = JSON.parse(output);
+  } catch {
+    throw new Error('无法验证钉钉 OAuth 状态：官方 CLI 未返回有效 JSON；请检查 CLI 版本后重试');
+  }
+  if (!status || typeof status !== 'object' || Array.isArray(status)
+    || status.success !== true || status.authenticated !== true) {
+    throw new Error('钉钉 OAuth 未就绪：请先在运行 DSH 的同一电脑、同一系统用户下执行 npx -y dingtalk-workspace-cli@1.0.61 auth login（无浏览器环境加 --device），完成授权后重新连接；如仍失败，请确认企业管理员已开启 CLI 访问');
+  }
+}
+
+// Upgrade only the exact managed legacy invocation; preserve custom commands,
+// environment, cwd and credentials. Applied on every provision, including restore.
+export function cliBridgeArgs(record) {
+  const legacy = ['--yes', '--legacy-peer-deps', '--package', 'dsh-mcp-connector@0.2.48',
+    '--package', 'dingtalk-workspace-cli@1.0.61', 'dsh-mcp-cli-bridge', '--provider', 'dingtalk-dws'];
+  const args = record.args ?? [];
+  if (record.connectorId !== 'dingtalk' || record.command !== 'npx'
+    || JSON.stringify(args) !== JSON.stringify(legacy)) return args;
+  return args.map((arg) => arg === 'dsh-mcp-connector@0.2.48' ? 'dsh-mcp-connector@0.2.49' : arg);
 }
 
 export async function handleCliBridgeRequest(message, options = {}) {

package/lib/mcp-provision.js

@@ -3,6 +3,8 @@
  * entryId = {entryPrefix}-{record.key}；serverName 决定工具名前缀，生命周期内不变 → 幂等。
  */
 
+import { cliBridgeArgs } from './cli-providers.js';
+
 export function entryIdFor(config, record) {
   return `${config.entryPrefix}-${record.key}`;
 }
@@ -35,7 +37,7 @@ export function buildEntryConfig(record, grants, { failOnStartupError = false }
       transport: 'stdio',
       serverName: record.serverName,
       command: record.command,
-      args: record.args ?? [],
+      args: cliBridgeArgs(record),
       env,
       cwd: record.cwd || process.cwd(),
       failOnStartupError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.48",
+  "version": "0.2.49",
   "description": "DeepSeek Harness MCP Connector: connect servers, search tools across active connections, and troubleshoot discovery. Includes a continuously updated catalog; supports OAuth 2.0 PKCE, API keys, Streamable HTTP/stdio, and mcpServers JSON import.",
   "type": "module",
   "main": "lib/index.js",

package/ui/index.html

@@ -1155,6 +1155,15 @@
     }
   }
 
+  function connectionLabels(d) {
+    const local = (d.servers || []).some((s) => s.transport === 'stdio');
+    const auth = d.id === 'dingtalk' ? '官方 CLI OAuth'
+      : ({ 'oauth2-pkce': 'OAuth 授权', bearer: 'Bearer 凭据', 'api-key': 'API Key' }[d.authMode] || '按服务要求授权');
+    return [d.vendor ? `提供方：${d.vendor}` : '提供方：待核实', auth,
+      local ? '运行于 DSH 主机' : '远程服务',
+      d.id === 'dingtalk' ? '当前桥接仅提供只读工具' : '权限以授权页和工具策略为准'];
+  }
+
   function cardHtml(d) {
     const icon = isImageIcon(d.icon)
       ? `<img src="${esc(d.icon)}" alt="" onerror="this.parentElement.innerHTML='🔌';" />`
@@ -1166,6 +1175,7 @@
       <div class="content">
         <div class="name">${esc(d.name)} ${probe}</div>
         <div class="summary">${esc(d.summary || '')}</div>
+        <div class="hint">${connectionLabels(d).map(esc).join(' · ')}</div>
       </div>
       <div class="actions">${actions}</div>
     </div>`;
@@ -1408,6 +1418,7 @@
     if (!connector) return;
     openModal(`连接 ${connector.name}`, `
       <input id="scope-connector-id" type="hidden" value="${esc(connectorId)}" />
+      <div class="form-note">${connectionLabels(connector).map(esc).join(' · ')}${connector.credentialDescription ? `<p>${esc(connector.credentialDescription)}</p>` : ''}${connectorId === 'dingtalk' ? '<p>尚未登录？请在运行 DSH 的同一系统用户终端执行 <code>npx -y dingtalk-workspace-cli@1.0.61 auth login</code>，完成后点击确认连接。本版本不会自动发起登录；工具注册不代表已获得全部业务权限。</p>' : ''}</div>
       <div class="form-note"><strong>选择连接影响范围</strong>连接配置与凭据仍只保存一份；项目范围会由 Host 在工具可见性和执行层强制隔离。</div>
       ${scopeFieldHtml()}
       <div class="inline-error" id="modal-error" tabindex="-1"></div>
@@ -1571,6 +1582,7 @@
       const r = await call('connect', { connectorId, ...scopeParams }, { timeoutMs });
       setModalBusy(false);
       showToast(r.message, r.ok);
+      if (!r.ok) showModalError(r.message);
       if (r.ok) {
         markCommunityCtaEligible();
         closeModal();
@@ -1881,6 +1893,7 @@
         : (d.connectionLabel || (d.connected?.length ? '已配置' : '未连接'));
       $('#detail-vendor').textContent = d.vendor ? `${d.vendor} · ${initialStateLabel} ${d.connected?.length || 0} 个服务` : `${initialStateLabel} ${d.connected?.length || 0} 个服务`;
       $('#detail-desc').textContent = d.description || d.summary || '';
+      $('#detail-desc').textContent += '\n' + connectionLabels(d).join(' · ');
       detailPrompts = (d.prompts || []).filter((prompt) => prompt?.text || prompt?.title);
       promptPage = 0;
       renderPromptPage();