dsh-mcp-connector 0.2.54 → 0.2.55

package/CHANGELOG.md

@@ -4,6 +4,13 @@
 
 ## [Unreleased]
 
+## [0.2.55] - 2026-09-22
+
+### Fixed
+
+- Windows 钉钉 CLI 桥接解析官方 npm 包内原生 `dws.exe`，覆盖全局与 npx 布局，不执行 cmd shim，保持 shell:false；允许带空格的显式绝对路径并提供安装/原生文件缺失诊断（#91）。
+- 精确迁移标准受管钉钉 0.2.48/0.2.49 桥接到 0.2.55，保留自定义命令、参数、环境和授权配置。
+
 ## [0.2.54] - 2026-09-21
 
 ### Fixed

package/README.en.md

@@ -190,7 +190,7 @@ npm run dev:ui
 
 Every Registry merge regenerates `catalog-stats.json`; an hourly workflow in this repository synchronizes the Chinese and English product copy plus a local stats snapshot. The static npm README updates with package releases, while the live badges above read the Registry directly and therefore stay current without another npm release.
 
-The current public version is [`dsh-mcp-connector@0.2.54`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.54](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.54).
+The current public version is [`dsh-mcp-connector@0.2.55`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.55](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.55).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -185,7 +185,7 @@ npm run dev:ui
 
 公共 Registry 每次合并后会生成 `catalog-stats.json`；本仓库的定时工作流每小时同步中英文介绍和统计快照。npm 页面中的静态正文随版本发布更新，上方动态统计徽标则直接读取 Registry，可在不发布新 npm 版本时保持实时数量一致。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.54`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.54](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.54)。
+当前公开版本为 [`dsh-mcp-connector@0.2.55`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.55](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.55)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/docs/CLI-PROVIDERS.md

@@ -34,7 +34,7 @@ MCP 连接器原生支持 Streamable HTTP 和 stdio MCP。对于钉钉 `dws` 这
         "-y",
         "--legacy-peer-deps",
         "--package",
-        "dsh-mcp-connector@0.2.48",
+        "dsh-mcp-connector@0.2.55",
         "--package",
         "dingtalk-workspace-cli@1.0.61",
         "dsh-mcp-cli-bridge",
@@ -48,6 +48,10 @@ MCP 连接器原生支持 Streamable HTTP 和 stdio MCP。对于钉钉 `dws` 这
 
 ## 首批只读能力
 
+Windows 从 DSH 进程 PATH 中的全局 npm 或 npx `.bin` 位置查找官方包，直接运行包内 `vendor/dws.exe`；不执行 `.cmd`/`.bat`/`.ps1`，不启用 shell。也可在启动 DSH 的环境中设置 `DSH_MCP_DINGTALK_DWS_BIN` 为原生 exe 的绝对路径（允许空格），随后重启 DSH。无需复制 exe 到 npm 前缀；复制品可能在 CLI 升级后过期。缺失程序不等于 OAuth 未登录。
+
+升级主插件并重启后，标准受管钉钉 0.2.48/0.2.49 桥接参数会在加载时迁移到 0.2.55；自定义命令和参数不自动修改，需自行更新固定桥接版本。授权信息和环境配置保持不变。
+
 - 当前用户、通讯录搜索与用户详情
 - 日程列表与日程详情
 - 待办列表与待办详情

package/lib/cli-providers.js

@@ -1,4 +1,6 @@
 import { spawn } from 'node:child_process';
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
 
 const MAX_OUTPUT_BYTES = 1024 * 1024;
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -198,8 +200,8 @@ export function listCliProviderTools(providerId) {
 
 function assertSafeExecutable(executable) {
   const value = String(executable ?? '').trim();
-  if (!value || /[\0\r\n]/.test(value) || /\s/.test(value)) {
-    throw new Error('CLI executable must be one command name or an absolute path without whitespace');
+  if (!value || /[\0\r\n]/.test(value) || (/\s/.test(value) && !path.isAbsolute(value) && !path.win32.isAbsolute(value))) {
+    throw new Error('CLI executable must be one command name or an absolute path');
   }
   return value;
 }
@@ -290,11 +292,48 @@ export function redactCliError(value) {
     .trim();
 }
 
+// Resolve only the known provider package; never interpret or execute a shell shim.
+export function resolveCliExecutable(command, options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  if (platform !== 'win32') return command;
+  if (/\.(cmd|bat|ps1)$/i.test(command)) throw new Error('[CLI_SHIM_UNSUPPORTED] 请指定原生 exe，而非 shell 启动脚本');
+  if (command !== 'dws') return command; // Explicit override stays authoritative.
+  const pathValue = Object.entries(env).find(([key]) => key.toLowerCase() === 'path')?.[1] ?? '';
+  let sawShim = false;
+  for (const raw of pathValue.split(';')) {
+    const dir = raw.replace(/^"(.*)"$/, '$1');
+    if (!path.isAbsolute(dir)) continue; // Never search cwd or relative PATH entries.
+    const native = path.join(dir, 'dws.exe');
+    if (existsSync(native) && statSync(native).isFile()) return native;
+    if (existsSync(path.join(dir, 'dws.cmd'))) sawShim = true;
+    const roots = path.basename(dir).toLowerCase() === '.bin'
+      ? [path.join(dir, '..', 'dingtalk-workspace-cli')]
+      : [path.join(dir, 'node_modules', 'dingtalk-workspace-cli')];
+    for (const root of roots) {
+      if (!existsSync(path.join(root, 'package.json'))) continue;
+      try {
+        const pkg = JSON.parse(readFileSync(path.join(root, 'package.json'), 'utf8'));
+        if (pkg.name !== 'dingtalk-workspace-cli' || pkg.bin?.dws !== 'bin/dws.js') continue;
+        const realRoot = realpathSync(root);
+        const binary = realpathSync(path.join(root, 'vendor', 'dws.exe'));
+        const relative = path.relative(realRoot, binary);
+        if (relative.startsWith('..') || path.isAbsolute(relative) || !statSync(binary).isFile()) continue;
+        return binary;
+      } catch { /* Missing/corrupt packages must fail closed, not launch a shim. */ }
+    }
+  }
+  throw new Error(sawShim
+    ? '[CLI_NATIVE_MISSING] 已发现 dws npm 启动脚本，但未找到有效的官方原生程序；请检查 CLI 安装，或通过 DSH_MCP_DINGTALK_DWS_BIN 指定 dws.exe'
+    : '[CLI_NOT_FOUND] DSH 进程 PATH 中未找到 dws 原生程序或官方 npm 包；请检查安装与 DSH 环境后重启，不代表 OAuth 未登录');
+}
+
 export function runCliProcess(command, args, options = {}) {
   const timeoutMs = Number.isInteger(options.timeoutMs) ? options.timeoutMs : DEFAULT_TIMEOUT_MS;
   const maxOutputBytes = Number.isInteger(options.maxOutputBytes) ? options.maxOutputBytes : MAX_OUTPUT_BYTES;
   return new Promise((resolve, reject) => {
-    const child = spawn(command, args, {
+    const executable = resolveCliExecutable(command, options);
+    const child = spawn(executable, args, {
       shell: false,
       windowsHide: true,
       stdio: ['ignore', 'pipe', 'pipe'],
@@ -399,12 +438,17 @@ export async function ensureCliProviderReady(providerId, options = {}) {
 // Upgrade only the exact managed legacy invocation; preserve custom commands,
 // environment, cwd and credentials. Applied on every provision, including restore.
 export function cliBridgeArgs(record) {
-  const legacy = ['--yes', '--legacy-peer-deps', '--package', 'dsh-mcp-connector@0.2.48',
+  const legacy = ['--yes', '--legacy-peer-deps', '--package', argsVersion(record),
     '--package', 'dingtalk-workspace-cli@1.0.61', 'dsh-mcp-cli-bridge', '--provider', 'dingtalk-dws'];
   const args = record.args ?? [];
-  if (record.connectorId !== 'dingtalk' || record.command !== 'npx'
+  if (!legacy[3] || record.connectorId !== 'dingtalk' || record.command !== 'npx'
     || JSON.stringify(args) !== JSON.stringify(legacy)) return args;
-  return args.map((arg) => arg === 'dsh-mcp-connector@0.2.48' ? 'dsh-mcp-connector@0.2.49' : arg);
+  return args.map((arg) => arg === legacy[3] ? 'dsh-mcp-connector@0.2.55' : arg);
+}
+
+function argsVersion(record) {
+  const value = record.args?.[3];
+  return ['dsh-mcp-connector@0.2.48', 'dsh-mcp-connector@0.2.49'].includes(value) ? value : null;
 }
 
 export async function handleCliBridgeRequest(message, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.54",
+  "version": "0.2.55",
   "description": "DeepSeek Harness MCP Connector: connect servers, search tools across active connections, and troubleshoot discovery. Includes a continuously updated catalog; supports OAuth 2.0 PKCE, API keys, Streamable HTTP/stdio, and mcpServers JSON import.",
   "type": "module",
   "main": "lib/index.js",