dsh-mcp-connector 0.2.6 → 0.2.8

package/CHANGELOG.md

@@ -4,6 +4,46 @@
 
 ## [Unreleased]
 
+## [0.2.8] - 2026-08-22
+
+### Fixed
+
+- 工具详情改为执行完整的 Streamable HTTP MCP 会话流程：`initialize` 后保存 `Mcp-Session-Id`，发送 `notifications/initialized`，再携带会话、协议版本和凭据请求 `tools/list`，修复 QVeris 等有状态 MCP Server 返回 HTTP 400 的问题。
+- 会话结束后尽力发送 `DELETE` 释放服务端资源；鉴权失败、限流、HTTP/协议错误继续按类型更新连接健康状态。
+
+### Registry
+
+- 将 QVeris 工具快照校正为托管端实际返回的 8 个工具；移除当前运行时不存在的 `probe`，补充 3 个兼容旧客户端的弃用别名。
+- QVeris 精选 Prompt 仅使用实际可用的 `discover`、`inspect` 和用量审计工具；未经用户明确确认仍不执行可能消耗 Credits 的 `call`/`execute_tool`。
+
+### Documentation
+
+- 统一 QVerisMCP 品牌名称，记录官方 Logo 因 `same-origin` 策略需由 Registry 自托管的 Desktop 兼容方案。
+- 将已于 `0.1.0`–`0.2.0` 完成的 v2 详情页实施计划标记为已完成/归档，避免与当前待办混淆。
+
+### Verification
+
+- 69 项自动测试、lint 与 44 个 npm 发布文件白名单/敏感内容扫描通过。
+- 使用 DSH 本机已保存的 QVeris API Key 完成真实只读验收：协议版本 `2025-03-26`、有状态会话建立成功、`tools/list` 返回 8 个工具；未执行任何付费能力调用。
+
+## [0.2.7] - 2026-08-22
+
+### Added
+
+- 市场新增“服务商 + 接入方式”组合筛选，可快速查看 OAuth、Key/Token 或免密连接器，并可与全文搜索叠加。
+- 新增 DSH 外部市场注册自动验收：每小时跟踪 PR #2633，合并后继续验证上游 YAML 与 DSH 实际 `plugins.json` 均已生效。
+
+### Registry
+
+- 独立远程 Registry 已扩展为 4 张第三方卡片、12 个 Server 和 16 个 Prompt；与随包目录合并后共 8 张已发布市场卡片。
+- 新增“盈米·基金投顾”与“QVeris·通用能力网络”；QVeris 默认先做免费发现、参数检查与零成本询价，付费 `call` 需用户明确确认。
+
+### Verification
+
+- 自动化门禁通过 69 项测试与 43 个 npm 发布文件白名单/敏感内容扫描。
+- QVeris Hosted MCP 无凭据公网探针返回预期的 HTTP 401，确认端点可达且正确要求 Bearer Key；未进行付费 `call`。
+- DSH Desktop `web` profile 已精确对齐 `dsh-mcp-connector@0.2.7`；完全重启后左侧入口、中文单语界面、组合筛选和 8 张市场卡片通过，19 条连接和 4 组授权保持不变。
+
 ## [0.2.6] - 2026-08-21
 
 ### Documentation
@@ -147,7 +187,9 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.6...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.8...HEAD
+[0.2.8]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.7...v0.2.8
+[0.2.7]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.6...v0.2.7
 [0.2.6]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.5...v0.2.6
 [0.2.5]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.4...v0.2.5
 [0.2.4]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.3...v0.2.4

package/README.en.md

@@ -15,7 +15,7 @@ Browse and install MCP connectors from different providers in DeepSeek Harness D
 ## Features
 
 - A primary sidebar entry below New Conversation and above workspaces/conversations, with a public footer-slot fallback for incompatible DSH DOM versions.
-- Searchable Marketplace and Installed views with catalog refresh and active health checks that distinguish Configured, Connected, Reauthorization Required, Partially Unavailable, and Connection Error states.
+- Searchable Marketplace and Installed views, provider and connection-method filters, catalog refresh, and active health checks that distinguish Configured, Connected, Reauthorization Required, Partially Unavailable, and Connection Error states.
 - OAuth 2.0 Authorization Code with PKCE, API key/Bearer/unauthenticated URL configuration, and `mcpServers` JSON import.
 - Installation from a credential-free connector descriptor URL.
 - Credential and MCP initialize validation before API-key connectors are saved as installed.
@@ -26,7 +26,7 @@ Browse and install MCP connectors from different providers in DeepSeek Harness D
 - A standalone remote Registry, allowing new marketplace cards to appear after refresh without publishing a new npm version.
 - Explicit, non-destructive migration of authorization from the two earlier Qichacha OAuth plugins.
 
-The first four bundled cards are Qichacha connectors. The public catalog also includes PKULaw and Wind connectors; the architecture is provider-neutral.
+The first four bundled cards are Qichacha connectors, followed by PKULaw and Wind. After a remote Registry refresh, Yingmi and QVeris are also available, for eight published marketplace cards in total; the architecture is provider-neutral.
 
 ## Interface and demo
 
@@ -94,12 +94,13 @@ Set `catalogUrl` to an empty string for an explicitly offline/private setup.
 npm run check
 npm run registry:build
 npm run registry:validate
+npm run market:check
 npm run dev:ui
 ```
 
-`npm run check` performs syntax checks, automated tests, and an npm package allowlist/sensitive-content audit. Tags matching `v*` trigger GitHub Actions; the tag must match `package.json`. npm releases use Trusted Publishing through GitHub OIDC and do not require a long-lived `NPM_TOKEN`.
+`npm run check` performs syntax checks, automated tests, and an npm package allowlist/sensitive-content audit. `npm run market:check` tracks the external DSH marketplace PR and live directory. Tags matching `v*` trigger GitHub Actions; the tag must match `package.json`. npm releases use Trusted Publishing through GitHub OIDC and do not require a long-lived `NPM_TOKEN`.
 
-The current public version is [`dsh-mcp-connector@0.2.6`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.6](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.6).
+The current public version is [`dsh-mcp-connector@0.2.7`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.7](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.7).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -15,7 +15,7 @@
 ## 功能
 
 - 左侧主导航入口：目标位置为“新会话”下方、“工作区/会话列表”上方；若 DSH DOM 结构不兼容，自动回退到底部公开插槽。
-- 图形化市场：市场/已安装、搜索、刷新与主动健康检查；区分“已配置”、“已连接”、“需重新授权”、“部分异常”和“连接异常”。
+- 图形化市场：市场/已安装、全文搜索、服务商/接入方式组合筛选、刷新与主动健康检查；区分“已配置”、“已连接”、“需重新授权”、“部分异常”和“连接异常”。
 - 图形化添加：手动 URL/鉴权、`mcpServers` JSON、连接器描述 URL 三种入口，失败时保留表单并给出修复建议。
 - 连接器详情：精选 Prompt 优先展示，点击可带入 DSH 新会话；工具按 Server 分组，支持描述、搜索和独立滚动。
 - Prompt 模板：使用 `{{company}}` 等变量，发送前填写真实查询主体。
@@ -28,7 +28,7 @@
 - 平滑迁移：显式扫描并复制两个旧企查查 OAuth 插件授权；不删除原插件或原凭据。
 - 对话工具：`mcp_connector_catalog`、`connect`、`configure`、`import_json`、`install_from_url`、`status`、`health_check`、`set_enabled`、`disconnect`、`refresh_catalog`、`publish`、`tools_list`。
 
-当前市场前 4 张为企查查连接器，第 5 张为“北大法宝·法律检索”，第 6 张为“Wind·股票数据”；插件架构不限定厂商。
+随包目录前 4 张为企查查连接器，另含“北大法宝·法律检索”和“Wind·股票数据”。远程 Registry 刷新后还会加入“盈米·基金投顾”和“QVerisMCP”，当前共 8 张已发布市场卡片；插件架构不限定厂商。
 
 ## 界面与演示
 
@@ -90,12 +90,13 @@ Bundle 默认配置位于 `cordis.patch.yml`：
 npm run check
 npm run registry:build
 npm run registry:validate
+npm run market:check
 npm run dev:ui
 ```
 
-`check` 执行语法检查、自动测试和 npm 发布包白名单校验；`dev:ui` 启动不含真实凭据的本地 mock 市场。CI 使用 `--legacy-peer-deps` 安装显式测试依赖，DSH 运行期 peer 仍由 Host 提供。`v*` Tag 会触发 GitHub Actions；Tag 必须与 `package.json` 版本一致。Release 通过 npm Trusted Publishing (GitHub OIDC) 发布，不依赖长期 `NPM_TOKEN`。
+`check` 执行语法检查、自动测试和 npm 发布包白名单校验；`market:check` 检查外部 DSH 市场 PR 与线上目录；`dev:ui` 启动不含真实凭据的本地 mock 市场。CI 使用 `--legacy-peer-deps` 安装显式测试依赖，DSH 运行期 peer 仍由 Host 提供。`v*` Tag 会触发 GitHub Actions；Tag 必须与 `package.json` 版本一致。Release 通过 npm Trusted Publishing (GitHub OIDC) 发布，不依赖长期 `NPM_TOKEN`。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.6`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.6](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.6)。
+当前公开版本为 [`dsh-mcp-connector@0.2.7`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.7](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.7)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/docs/MARKET-REGISTRATION.md

@@ -27,7 +27,18 @@ Bearer/API Key 型连接器可在卡片上点「配置」，一次填写凭据
 
 插件默认读取 `https://raw.githubusercontent.com/duhu2000/dsh-mcp-connector-registry/main/catalog.json`；远程不可用时自动回退上次缓存或随包内置目录。
 
-## 4. OAuth 一键授权要求
+## 4. DSH 外部插件市场验收
+
+`dsh-mcp-connector` 在 `awesome-dsh-plugin` 的注册 PR 为 [#2633](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/2633)。仓库每小时自动执行 `.github/workflows/market-registration.yml`：
+
+1. PR 未合并时记录为 `awaiting-merge`，不误报构建失败；
+2. PR 合并后检查上游 `data/plugins/duhu2000__dsh-mcp-connector.yml` 已进入 `main`；
+3. 继续检查 DSH Market 实际使用的 `https://awesome-dsh-plugin.com/plugins.json`；
+4. YAML 与线上目录均生效后状态为 `accepted`，否则在合并后明确报告目录同步未完成。
+
+本地可运行 `npm run market:check`查看状态；CI 使用 `--strict-after-merge` 让“已合并但尚未可搜索”成为可见的验收信号。此检查仅需 GitHub Actions 默认的只读 `GITHUB_TOKEN`，不需要新增长期密钥。
+
+## 5. OAuth 一键授权要求
 
 `auth.mode: "oauth2-pkce"` 不是将现有 Bearer Token 改个名称。厂商服务端必须支持：
 
@@ -67,7 +78,7 @@ Bearer/API Key 型连接器可在卡片上点「配置」，一次填写凭据
 }
 ```
 
-## 5. 北大法宝当前适配结论
+## 6. 北大法宝当前适配结论
 
 北大法宝当前公开文档的主路径是在控制台生成 Access Token，然后通过 `Authorization: Bearer ...` 访问多个 MCP Server。因此：
 
@@ -89,7 +100,7 @@ Bearer/API Key 型连接器可在卡片上点「配置」，一次填写凭据
 - https://mcp.pkulaw.com/docs?doc=authentication
 - https://mcp.pkulaw.com/docs?doc=mcp-integration
 
-## 6. Wind 股票数据当前适配结论
+## 7. Wind 股票数据当前适配结论
 
 万得 AIFin Market 的“万得股票数据服务”详情页公开了标准 MCP 手工配置：
 
@@ -105,3 +116,40 @@ Bearer/API Key 型连接器可在卡片上点「配置」，一次填写凭据
 参考：
 
 - https://aifinmarket.wind.com.cn/#/market?tab=mcps&detailType=mcp&detailId=wind_stock_data-0
+
+## 8. QVerisMCP 适配结论
+
+QVeris Hosted MCP 提供单一 Streamable HTTP 端点 `https://mcp.qveris.ai/mcp`，
+通过 `Authorization: Bearer <QVERIS_API_KEY>` 鉴权，与本插件现有的 Bearer
+凭据表单、持久化前 `initialize` 校验和 Streamable HTTP 传输完全兼容。
+
+2026-08-22 使用真实 API Key 完成只读 `tools/list` 验收，QVeris 托管端实际返回
+8 个 MCP 工具：`discover`、`inspect`、`call`、`usage_history`、
+`credits_ledger`，以及 3 个兼容旧客户端的弃用别名 `search_tools`、
+`get_tools_by_ids`、`execute_tool`。当前运行时没有官网文档所列的 `probe`；
+市场快照以实际端点为准。官方宣传的上万项能力是经 `discover` 找到的下游能力，
+不写成上万个 MCP 工具。
+
+由于 `call` 可能消耗 Credits，且查询内容可能由第三方服务商处理，
+该卡片保持 `featured: false`，并执行以下产品约束：
+
+- Prompt 默认只执行 `discover`/`inspect` 和用量审计工具；
+- 未经用户明确确认，不执行可能消耗 Credits 的 `call` 或弃用别名 `execute_tool`；
+- 卡片明确提醒用户不要提交未获授权的个人信息、商业秘密或敏感业务数据；
+- 市场使用用户指定的 QVeris 官方 Logo；由于官网原图返回
+  `Cross-Origin-Resource-Policy: same-origin`，在 DSH Desktop 中直链会被浏览器拦截，
+  Registry 因此保留官方原图像素并自托管于
+  `assets/qveris-logo.png`，对外提供可跨域嵌入的 Raw GitHub URL。
+
+公共无凭据探针已确认端点可达并正确返回 HTTP 401；使用 DSH 本机自有 API Key
+执行完整 `initialize → notifications/initialized → tools/list` 后，服务返回
+`Mcp-Session-Id`、协议版本 `2025-03-26` 和 8 个工具。验收未执行 `call` 或
+`execute_tool`，没有产生付费能力调用。
+
+参考：
+
+- https://qveris.ai/hosted-mcp
+- https://qveris.ai/docs/mcp-server
+- https://qveris.ai/pricing
+- https://qveris.ai/privacy
+- https://qveris.ai/terms

package/lib/index.js

@@ -24,8 +24,9 @@ import { oauthAuthorize } from './connectors/oauth-connector.js';
 import { buildManualRecord } from './connectors/manual-connector.js';
 import { normalizeJsonImport } from './connectors/json-connector.js';
 import { discoverServerMetadata, refreshAccessToken, revokeRefreshToken } from './oauth.js';
-import { provision, disable, remove, entryIdFor, authHeaders } from './mcp-provision.js';
+import { provision, disable, remove, entryIdFor } from './mcp-provision.js';
 import { classifyConnectionError, validateConnectionRecords } from './mcp-validation.js';
+import { listMcpTools, McpHttpError } from './mcp-http.js';
 import { registerTools } from './tools.js';
 import { mountWebRoutes } from './web.js';
 import { assertSafeUrl } from './util.js';
@@ -793,70 +794,33 @@ export async function apply(ctx, config) {
 
       const servers = [];
       for (const record of records) {
-        const headers = {
-          'Content-Type': 'application/json',
-          'Accept': 'application/json, text/event-stream',
-          ...authHeaders(record, grantMap()),
-        };
-
         try {
-          const response = await fetch(record.url, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify({
-              jsonrpc: '2.0',
-              id: 1,
-              method: 'tools/list',
-              params: {},
-            }),
-            signal: AbortSignal.timeout(config.requestTimeoutMs),
+          const listed = await listMcpTools(record, {
+            timeoutMs: config.requestTimeoutMs,
+            grants: grantMap(),
           });
-
-          if (!response.ok) {
-            const error = response.status === 401 || response.status === 403
-              ? `凭据无效、已过期或权限不足（HTTP ${response.status}）`
-              : `HTTP ${response.status}`;
-            servers.push({
-              serverKey: record.serverKey || record.name,
-              serverName: record.serverName,
-              ok: false,
-              error,
-              errorKind: response.status === 401 || response.status === 403 ? 'auth' : 'http',
-              tools: [],
-            });
-            continue;
-          }
-
-          const contentType = response.headers.get('content-type') || '';
-          let result;
-          if (contentType.includes('text/event-stream')) {
-            // Parse SSE response
-            const text = await response.text();
-            const lines = text.split('\n');
-            for (const line of lines) {
-              if (line.startsWith('data: ')) {
-                try {
-                  result = JSON.parse(line.slice(6));
-                  break;
-                } catch {}
-              }
-            }
-          } else {
-            result = await response.json();
-          }
-
-          const tools = result?.result?.tools ?? [];
           servers.push({
             serverKey: record.serverKey || record.name,
             serverName: record.serverName,
             ok: true,
-            tools: tools.map((t) => ({
+            tools: listed.tools.map((t) => ({
               name: t.name,
               title: t.title || t.name,
               description: t.description || '',
             })),
           });
         } catch (error) {
+          if (error instanceof McpHttpError) {
+            servers.push({
+              serverKey: record.serverKey || record.name,
+              serverName: record.serverName,
+              ok: false,
+              error: error.message,
+              errorKind: error.kind,
+              tools: [],
+            });
+            continue;
+          }
           const classified = classifyConnectionError(error);
           servers.push({ serverKey: record.serverKey || record.name, serverName: record.serverName, ok: false, error: classified.message, errorKind: classified.kind, tools: [] });
         }

package/lib/mcp-http.js

@@ -0,0 +1,173 @@
+/**
+ * Streamable HTTP MCP 会话客户端。
+ *
+ * 详情页不能直接向有状态的 MCP Server 发送 tools/list：必须先
+ * initialize，保留响应的 Mcp-Session-Id，发送 notifications/initialized，
+ * 再在后续每个请求中携带会话头和凭据。
+ */
+import { MCP_PROTOCOL_VERSION } from './constants.js';
+import { authHeaders } from './mcp-provision.js';
+
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+
+export class McpHttpError extends Error {
+  constructor(message, { kind = 'protocol', status } = {}) {
+    super(message);
+    this.name = 'McpHttpError';
+    this.kind = kind;
+    this.status = status;
+  }
+}
+
+async function readLimitedText(response, maxBytes = MAX_RESPONSE_BYTES) {
+  const declared = Number(response.headers.get('content-length'));
+  if (Number.isFinite(declared) && declared > maxBytes) throw new McpHttpError('MCP 响应过大');
+  if (!response.body) return '';
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel().catch(() => {});
+      throw new McpHttpError('MCP 响应过大');
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(bytes);
+}
+
+function parseMcpPayload(text, contentType = '') {
+  if (contentType.includes('text/event-stream')) {
+    for (const line of text.split(/\r?\n/)) {
+      if (!line.startsWith('data:')) continue;
+      try { return JSON.parse(line.slice(5).trim()); } catch {}
+    }
+    return undefined;
+  }
+  try { return JSON.parse(text); } catch { return undefined; }
+}
+
+function responseError(response, payload, text) {
+  const rawMessage = String(payload?.error?.message ?? text ?? '').replace(/\s+/g, ' ').trim().slice(0, 180);
+  if (response.status === 401 || response.status === 403) {
+    return new McpHttpError(`凭据无效、已过期或权限不足（HTTP ${response.status}）`, { kind: 'auth', status: response.status });
+  }
+  if (response.status === 429) {
+    return new McpHttpError('服务请求过于频繁（HTTP 429），请稍后重试', { kind: 'rate-limit', status: response.status });
+  }
+  const suffix = rawMessage ? `：${rawMessage}` : '';
+  return new McpHttpError(`MCP 请求失败（HTTP ${response.status}）${suffix}`, { kind: 'http', status: response.status });
+}
+
+function payloadError(payload) {
+  if (!payload?.error) return null;
+  const rawMessage = String(payload.error.message ?? '').replace(/\s+/g, ' ').slice(0, 180);
+  const kind = /unauthori[sz]ed|forbidden|invalid.?token|invalid.?key|credential|access.?denied|未授权|无权|密钥|令牌/i.test(rawMessage)
+    ? 'auth'
+    : 'protocol';
+  return new McpHttpError(`MCP 返回错误${rawMessage ? `：${rawMessage}` : ''}`, { kind });
+}
+
+function requestHeaders(record, grants, { sessionId, protocolVersion } = {}) {
+  return {
+    'Content-Type': 'application/json',
+    Accept: 'application/json, text/event-stream',
+    ...authHeaders(record, grants),
+    ...(sessionId ? { 'Mcp-Session-Id': sessionId } : {}),
+    ...(protocolVersion ? { 'MCP-Protocol-Version': protocolVersion } : {}),
+  };
+}
+
+async function post(record, payload, { grants, sessionId, protocolVersion, signal, fetchImpl }) {
+  const response = await fetchImpl(record.url, {
+    method: 'POST',
+    headers: requestHeaders(record, grants, { sessionId, protocolVersion }),
+    body: JSON.stringify(payload),
+    signal,
+    redirect: 'follow',
+  });
+  const text = await readLimitedText(response);
+  const parsed = parseMcpPayload(text, response.headers.get('content-type') ?? '');
+  return { response, text, payload: parsed };
+}
+
+async function closeSession(record, { grants, sessionId, protocolVersion, fetchImpl }) {
+  if (!sessionId) return;
+  try {
+    const response = await fetchImpl(record.url, {
+      method: 'DELETE',
+      headers: requestHeaders(record, grants, { sessionId, protocolVersion }),
+      redirect: 'follow',
+      signal: AbortSignal.timeout(3_000),
+    });
+    await response.body?.cancel().catch(() => {});
+  } catch {}
+}
+
+export async function listMcpTools(record, {
+  timeoutMs = 15_000,
+  fetchImpl = fetch,
+  grants = new Map(),
+} = {}) {
+  if (record.transport && record.transport !== 'streamable-http') {
+    throw new McpHttpError(`动态工具加载暂不支持 ${record.transport} 传输`, { kind: 'protocol' });
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new Error('timeout')), timeoutMs);
+  let sessionId = '';
+  let protocolVersion = MCP_PROTOCOL_VERSION;
+  try {
+    const initialized = await post(record, {
+      jsonrpc: '2.0',
+      id: 1,
+      method: 'initialize',
+      params: {
+        protocolVersion: MCP_PROTOCOL_VERSION,
+        capabilities: {},
+        clientInfo: { name: 'dsh-mcp-connector', version: '1.0' },
+      },
+    }, { grants, signal: controller.signal, fetchImpl });
+    if (!initialized.response.ok) throw responseError(initialized.response, initialized.payload, initialized.text);
+    const initPayloadError = payloadError(initialized.payload);
+    if (initPayloadError) throw initPayloadError;
+    if (!initialized.payload?.result || typeof initialized.payload.result !== 'object') {
+      throw new McpHttpError('MCP Server 未返回有效的 initialize 结果');
+    }
+    protocolVersion = initialized.payload.result.protocolVersion || MCP_PROTOCOL_VERSION;
+    sessionId = initialized.response.headers.get('mcp-session-id') ?? '';
+
+    const notification = await post(record, {
+      jsonrpc: '2.0',
+      method: 'notifications/initialized',
+      params: {},
+    }, { grants, sessionId, protocolVersion, signal: controller.signal, fetchImpl });
+    if (notification.response.status === 401 || notification.response.status === 403) {
+      throw responseError(notification.response, notification.payload, notification.text);
+    }
+
+    const listed = await post(record, {
+      jsonrpc: '2.0',
+      id: 2,
+      method: 'tools/list',
+      params: {},
+    }, { grants, sessionId, protocolVersion, signal: controller.signal, fetchImpl });
+    if (!listed.response.ok) throw responseError(listed.response, listed.payload, listed.text);
+    const listPayloadError = payloadError(listed.payload);
+    if (listPayloadError) throw listPayloadError;
+    const tools = listed.payload?.result?.tools;
+    if (!Array.isArray(tools)) throw new McpHttpError('MCP tools/list 未返回工具数组');
+    return { tools, protocolVersion, sessionful: Boolean(sessionId) };
+  } finally {
+    clearTimeout(timer);
+    await closeSession(record, { grants, sessionId, protocolVersion, fetchImpl });
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "General-purpose MCP connector, connection manager, plugin extension, and integration marketplace for DeepSeek Harness, initiated and maintained by Qichacha/QCC.",
   "type": "module",
   "main": "lib/index.js",
@@ -31,10 +31,11 @@
   ],
   "scripts": {
     "test": "node --test",
-    "lint": "node --check lib/index.js && node --check lib/web.js && node --check lib/client.js && node --check lib/schema.js && node --check lib/catalog.js && node --check lib/prompts.js && node --check lib/probe.js && node --check lib/mcp-validation.js && node --check lib/migration.js && node --check lib/stores.js && node --check lib/oauth.js && node --check lib/callback-server.js && node --check lib/mcp-provision.js && node --check lib/util.js && node --check lib/constants.js && node --check lib/tools.js && node --check lib/connectors/oauth-connector.js && node --check lib/connectors/manual-connector.js && node --check lib/connectors/json-connector.js && node --check scripts/probe-connector.mjs && node --check scripts/build-registry.mjs && node --check scripts/ui-harness.mjs",
+    "lint": "node --check lib/index.js && node --check lib/web.js && node --check lib/client.js && node --check lib/schema.js && node --check lib/catalog.js && node --check lib/prompts.js && node --check lib/probe.js && node --check lib/mcp-validation.js && node --check lib/mcp-http.js && node --check lib/migration.js && node --check lib/stores.js && node --check lib/oauth.js && node --check lib/callback-server.js && node --check lib/mcp-provision.js && node --check lib/util.js && node --check lib/constants.js && node --check lib/tools.js && node --check lib/connectors/oauth-connector.js && node --check lib/connectors/manual-connector.js && node --check lib/connectors/json-connector.js && node --check scripts/probe-connector.mjs && node --check scripts/build-registry.mjs && node --check scripts/ui-harness.mjs && node --check scripts/check-market-registration.mjs",
     "registry:build": "node scripts/build-registry.mjs",
     "registry:validate": "node scripts/probe-connector.mjs catalog/catalog.json --validate-only",
     "dev:ui": "node scripts/ui-harness.mjs",
+    "market:check": "node scripts/check-market-registration.mjs",
     "verify-pack": "node scripts/verify-pack.mjs",
     "check": "npm run lint && npm test && npm run verify-pack",
     "prepublishOnly": "npm run check"

package/ui/index.html

@@ -104,6 +104,25 @@
   .stats { display: flex; align-items: center; gap: 16px; margin-bottom: 20px; }
   .stats .count { font-size: 13px; color: var(--text-2); }
   .stats .count strong { color: var(--text); font-weight: 600; }
+  .market-filters {
+    display: flex; align-items: center; gap: 10px; flex-wrap: wrap;
+    margin-bottom: 14px; padding: 10px 12px;
+    background: var(--card); border: 1px solid var(--line); border-radius: 10px;
+  }
+  .market-filters .filter-label { color: var(--muted); font-size: 12px; flex: 0 0 auto; }
+  .market-filters select {
+    min-width: 150px; height: 34px; border: 1px solid var(--line); border-radius: 8px;
+    background: var(--bg); color: var(--text); padding: 0 30px 0 10px; font: inherit; font-size: 12px;
+  }
+  .market-filters select:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 2px var(--accent-light); }
+  .filter-chips { display: flex; align-items: center; gap: 6px; flex-wrap: wrap; }
+  .filter-chip {
+    border: 1px solid var(--line); background: var(--bg); color: var(--text-2);
+    border-radius: 999px; padding: 5px 10px; cursor: pointer; font: inherit; font-size: 12px;
+  }
+  .filter-chip:hover { border-color: var(--accent); color: var(--accent); }
+  .filter-chip.active { border-color: var(--accent); background: var(--accent-light); color: var(--accent); font-weight: 600; }
+  .filter-reset { margin-left: auto; }
 
   /* Grid - TraeWork 风格：3 列 */
   .grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(300px, 1fr)); gap: 12px; }
@@ -346,6 +365,9 @@
     .card { flex-wrap: wrap; }
     .card .actions { width: 100%; justify-content: flex-end; }
     .form-row { grid-template-columns: 1fr; gap: 0; }
+    .market-filters { align-items: stretch; }
+    .market-filters select { width: 100%; }
+    .filter-reset { margin-left: 0; }
   }
 
   /* Scrollbar */
@@ -447,6 +469,8 @@
   let view = 'market';
   let marketItems = {};
   let searchQuery = '';
+  let marketVendor = '';
+  let marketAuth = '';
   const PROMPT_PAGE_SIZE = 4;
   let detailPrompts = [];
   let promptPage = 0;
@@ -665,6 +689,30 @@
       || (d.tags || []).some(t => t.toLowerCase().includes(q));
   }
 
+  const AUTH_FILTERS = [
+    { value: '', label: '全部接入' },
+    { value: 'oauth2-pkce', label: 'OAuth' },
+    { value: 'credential', label: 'Key / Token' },
+    { value: 'none', label: '免密' },
+  ];
+
+  function matchesMarketFilters(d) {
+    if (!matchesSearch(d)) return false;
+    if (marketVendor && d.vendor !== marketVendor) return false;
+    if (marketAuth === 'credential') return ['bearer', 'api-key'].includes(d.authMode);
+    if (marketAuth && d.authMode !== marketAuth) return false;
+    return true;
+  }
+
+  function marketFilterHtml(items) {
+    const vendors = [...new Set(items.map((item) => item.vendor).filter(Boolean))]
+      .sort((a, b) => a.localeCompare(b, 'zh-CN'));
+    const vendorOptions = [`<option value="">全部服务商</option>`, ...vendors.map((vendor) => `<option value="${esc(vendor)}" ${vendor === marketVendor ? 'selected' : ''}>${esc(vendor)}</option>`)].join('');
+    const authButtons = AUTH_FILTERS.map((filter) => `<button class="filter-chip ${filter.value === marketAuth ? 'active' : ''}" type="button" data-auth-filter="${esc(filter.value)}" aria-pressed="${filter.value === marketAuth ? 'true' : 'false'}">${esc(filter.label)}</button>`).join('');
+    const active = Boolean(marketVendor || marketAuth);
+    return `<div class="market-filters" role="group" aria-label="市场筛选"><span class="filter-label">服务商</span><select id="market-vendor-filter" aria-label="按服务商筛选">${vendorOptions}</select><span class="filter-label">接入方式</span><div class="filter-chips" role="group" aria-label="按接入方式筛选">${authButtons}</div><button class="text-btn filter-reset" id="market-filter-reset" type="button" ${active ? '' : 'hidden'}>清除筛选</button></div>`;
+  }
+
   async function loadMarket({ checkHealth = true } = {}) {
     main.innerHTML = '<div class="empty">加载中…</div>';
     const r = await call('catalog', {});
@@ -673,10 +721,15 @@
     if (!items.length) { main.innerHTML = '<div class="empty">暂无已上架的连接器</div>'; return; }
     marketItems = {};
     items.forEach((d) => { marketItems[d.id] = d; });
-    const filtered = items.filter(matchesSearch);
+    const filtered = items.filter(matchesMarketFilters);
     const count = filtered.length;
     const visible = filtered.slice(0, catalogRenderLimit);
-    main.innerHTML = `<div class="stats"><span class="count">共 <strong>${count}</strong> 个连接器${searchQuery ? ` · 搜索「${esc(searchQuery)}」` : ''} · 点击卡片查看能力，点击「连接」完成授权</span></div><div class="grid">${visible.map(cardHtml).join('')}</div>${visible.length < count ? `<button class="tools-more" id="catalog-more" type="button">再显示 ${Math.min(60, count - visible.length)} 个（剩余 ${count - visible.length}）</button>` : ''}`;
+    const authLabel = AUTH_FILTERS.find((filter) => filter.value === marketAuth)?.label;
+    const filterSummary = `${marketVendor ? ` · 服务商「${esc(marketVendor)}」` : ''}${marketAuth ? ` · 接入方式「${esc(authLabel)}」` : ''}`;
+    const resultHtml = visible.length > 0
+      ? `<div class="grid">${visible.map(cardHtml).join('')}</div>${visible.length < count ? `<button class="tools-more" id="catalog-more" type="button">再显示 ${Math.min(60, count - visible.length)} 个（剩余 ${count - visible.length}）</button>` : ''}`
+      : '<div class="empty">没有匹配当前筛选条件的连接器</div>';
+    main.innerHTML = `${marketFilterHtml(items)}<div class="stats"><span class="count">共 <strong>${count}</strong> 个连接器${searchQuery ? ` · 搜索「${esc(searchQuery)}」` : ''}${filterSummary} · 点击卡片查看能力，点击「连接」完成授权</span></div>${resultHtml}`;
     if (checkHealth && !initialHealthCheckStarted && items.some((item) => item.connected?.length > 0)) {
       initialHealthCheckStarted = true;
       call('healthCheck', {}).then(() => {
@@ -1198,9 +1251,30 @@
 
   $('#add-connection').addEventListener('click', () => openAddConnection('json'));
   main.addEventListener('click', (event) => {
-    if (!event.target.closest('#catalog-more')) return;
-    catalogRenderLimit += 60;
-    loadMarket();
+    const authFilter = event.target.closest('[data-auth-filter]');
+    if (authFilter) {
+      marketAuth = authFilter.dataset.authFilter || '';
+      catalogRenderLimit = 60;
+      loadMarket({ checkHealth: false });
+      return;
+    }
+    if (event.target.closest('#market-filter-reset')) {
+      marketVendor = '';
+      marketAuth = '';
+      catalogRenderLimit = 60;
+      loadMarket({ checkHealth: false });
+      return;
+    }
+    if (event.target.closest('#catalog-more')) {
+      catalogRenderLimit += 60;
+      loadMarket({ checkHealth: false });
+    }
+  });
+  main.addEventListener('change', (event) => {
+    if (event.target.id !== 'market-vendor-filter') return;
+    marketVendor = event.target.value;
+    catalogRenderLimit = 60;
+    loadMarket({ checkHealth: false });
   });
 
   $('#refresh').addEventListener('click', async () => {