dsh-mcp-connector 0.2.74 → 0.2.75

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 本项目遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)；首个公开版本从 `0.1.0` 开始。
 
+## [0.2.75] - 2026-10-17
+
+### Added
+
+- 可选 `compactManagementTools` 精简管理工具模式（#161）：开启后将 25 个管理工具收敛为只读发现与原有会话管理两个入口；图形界面功能不变。默认关闭以兼容旧工具名，修改后需重载插件。
+- 统一发现入口仅允许目录、状态、缓存搜索与详情四种操作，保留工作区参数与原有渲染，不提供通用工具调用、凭据变更或授权代理。业务工具可见性、会话确认和 Host 审批沿用原机制。
+- 教程相对 inline Markdown 链接与图片检查（#159 / #156），覆盖 Windows 路径、代码片段排除、标题与括号文件名、越界及不存在的目标；纳入 `npm run check`。不宣称覆盖引用式链接、HTML 或完整 CommonMark。
+
+### Verification scope
+
+- 本地完整 `npm run check`：408 项通过、4 项条件跳过、0 失败；88 个发布文件通过白名单与凭据/本机路径扫描。跳过项不计作通过。
+- 新增工具数量、schema 大小、严格分派、结果渲染、参数拒绝、会话上下文、卸载清理和图形 API 集成回归。#163 与 #159 已通过 Node 20/22/24、Windows 和 Zod 4.1.8 CI。真实 DSH Web/Desktop 开关重载及模型调用验收仍需单独完成；#161 保留打开，精简模式默认关闭。
+- #146 本地参数覆盖、#105 Schema 变化提醒、#83 钉钉授权等开发草案不包含在本次发布中；旧企查查凭据不做自动迁移。
+
 ## [0.2.74] - 2026-10-16
 
 ### Added

package/README.en.md

@@ -167,6 +167,7 @@ The default bundle configuration is in `cordis.patch.yml`:
     refreshSkewMs: 300000
     openBrowser: true
     showSidebarEntry: true
+    compactManagementTools: false
     frameAncestors: ['self']
 ```
 
@@ -178,6 +179,15 @@ The proxy variables must be present in the running DSH process. After changing t
 
 `showSidebarEntry` defaults to `true`. Users can override it from the DSH plugin configuration page; turning it off hides only the shortcut and does not disable the connector, connected MCP servers, or tools.
 
+`compactManagementTools` defaults to `false` for backward compatibility. Set it to `true` in the plugin configuration and reload the plugin (or restart DSH) to expose only two management tools at the next inference boundary:
+
+- `mcp_connector_discover`: fixed read-only actions `catalog`, `status`, `search` (requires `query`), and `detail` (requires `toolName`). Example: `{"action":"search","query":"weather","limit":5}`.
+- `mcp_connector_session_tools`: unchanged session activation, confirmation and TTL behavior.
+
+Use the connector UI for connection setup, authorization, import, editing, snapshots and migration. There is no arbitrary execution proxy or automatic management-tool loading. Keep this option `false` for conversation-only deployments or workflows that depend on legacy tool names. Set it back to `false` and reload to restore those names; do not run duplicate plugin instances.
+
+This setting does not hide downstream business tools, disable connections, migrate credentials, change workspace/governance rules or bypass Host approval. Use the existing session injection mode for downstream tool visibility. Reduced tool count/schema size is not a measured token or cost saving.
+
 `frameAncestors` defaults to `['self']`: the CSP of the panel page (`/mcp-connector/ui/`) only allows same-origin embedding, which is the existing behaviour and is not relaxed by default. When a desktop shell (Tauri/Electron) embeds the panel, the ancestor origin differs from the panel origin, so the browser blocks it with `Framing '...' violates the following Content Security Policy directive: "frame-ancestors 'self'"` and the panel renders blank. Deployers must opt in explicitly:
 
 ```yaml
@@ -215,7 +225,7 @@ npm run dev:ui
 
 Every Registry merge regenerates `catalog-stats.json`; an hourly workflow in this repository synchronizes the Chinese and English product copy plus a local stats snapshot. The static npm README updates with package releases, while the live badges above read the Registry directly and therefore stay current without another npm release.
 
-The current public version is [`dsh-mcp-connector@0.2.74`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.74](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.74).
+The current public version is [`dsh-mcp-connector@0.2.75`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.75](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.75).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -162,6 +162,7 @@ Bundle 默认配置位于 `cordis.patch.yml`：
     refreshSkewMs: 300000
     openBrowser: true
     showSidebarEntry: true
+    compactManagementTools: false
     frameAncestors: ['self']
 ```
 
@@ -173,6 +174,14 @@ Bundle 默认配置位于 `cordis.patch.yml`：
 
 `showSidebarEntry` 默认为 `true`。用户可在 DSH 插件配置页覆盖该值；关闭后只隐藏侧边栏快捷入口，不停用连接器、已连接 MCP Server 或工具。
 
+`compactManagementTools` 默认为 `false`，兼容原有对话管理工具。希望降低管理工具上下文开销时，可在插件配置中设为 `true` 并重载插件（必要时重启 DSH），下一次推理使用新工具集：
+
+- 只注册 `mcp_connector_discover`（市场、连接状态、缓存工具搜索/详情）和 `mcp_connector_session_tools`（原有会话工具可见性管理）两个入口。
+- 连接、授权、编辑、导入、快照、迁移等管理操作使用 **MCP连接器界面**；精简模式没有任意工具执行代理，也不自动加载全部管理工具。纯对话部署或依赖旧工具名的自动化应保持 `false`。
+- 此开关不减少已连接服务的业务工具数量，不停用连接、不迁移凭据、不修改作用域/治理规则。业务工具需要按需可见时，仍使用原有“按会话启用”。会话确认、TTL 与 Host 审批保持不变。
+- 例如发现入口可用 `{"action":"search","query":"天气","limit":5}`；查询连接状态可用 `{"action":"status"}`。详情使用 `action=detail` 和必填 `toolName`，市场搜索使用 `action=catalog` 与可选 `keyword`。
+- 设回 `false` 并重载插件可恢复旧管理工具名；不要同时运行两份插件。工具数量和 schema 大小的减少不等于实测 token 或费用节省。
+
 `frameAncestors` 默认为 `['self']`，即面板页面（`/mcp-connector/ui/`）的 CSP 只允许同源页面内嵌，是既有行为，不做任何放宽。在桌面壳（Tauri/Electron）里把面板嵌进壳窗口时，祖先源与面板自身不同源，浏览器会以 `Framing '...' violates the following Content Security Policy directive: "frame-ancestors 'self'"` 拦截并导致面板白屏；此时需要由部署方/用户显式追加外壳源：
 
 ```yaml
@@ -210,7 +219,7 @@ npm run dev:ui
 
 公共 Registry 每次合并后会生成 `catalog-stats.json`；本仓库的定时工作流每小时同步中英文介绍和统计快照。npm 页面中的静态正文随版本发布更新，上方动态统计徽标则直接读取 Registry，可在不发布新 npm 版本时保持实时数量一致。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.74`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.74](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.74)。
+当前公开版本为 [`dsh-mcp-connector@0.2.75`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.75](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.75)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/cordis.patch.yml

@@ -11,6 +11,9 @@
         refreshSkewMs: 300000
         openBrowser: true
         showSidebarEntry: true
+        # true：仅注册发现与会话两个管理入口；完整连接配置仍在界面操作。
+        # 保持 false 兼容已有对话/自动化；更改后重载插件。
+        compactManagementTools: false
         # 面板 CSP frame-ancestors 白名单：默认仅同源可嵌入。
         # 桌面壳（Tauri/Electron）内嵌面板时需显式追加外壳源，
         # 例如 ['self', 'http://tauri.localhost', 'tauri://localhost']。

package/lib/index.js

@@ -125,6 +125,8 @@ export const Config = z.object({
   account: z.string().default(DEFAULT_ACCOUNT),
   /** 是否在 DSH 主侧边栏显示 MCP连接器快捷入口 */
   showSidebarEntry: z.boolean().default(true),
+  /** 精简对话管理工具为发现入口 + 会话入口；旧配置默认保留全量工具。修改后重载插件。 */
+  compactManagementTools: z.boolean().default(false),
   /**
    * 图形化市场面板（/mcp-connector/ui/）的 CSP `frame-ancestors` 白名单。
    *
@@ -3442,7 +3444,7 @@ export async function apply(ctx, config) {
     if (statusEvents.clients.size > 0) scheduleDiscovery();
   }, 30_000);
   discoveryInterval.unref?.();
-  const disposeTools = registerTools(ctx, observableApi);
+  const disposeTools = registerTools(ctx, observableApi, { compact: config.compactManagementTools === true });
 
   /* ───────────────────────── web 半区（图形化市场）──────────────────────── */
   // webServer + 新版 webStartup 或旧版 webRuntime；纯对话部署不挂载 HTTP 路由。

package/lib/tools.js

@@ -169,14 +169,14 @@ export function toLossless(value, seen = new Set()) {
   return output;
 }
 
-export function registerTools(ctx, api) {
-  const disposers = [];
-  const reg = (def) => disposers.push(ctx.tools.register({
+export function registerTools(ctx, api, { compact = false } = {}) {
+  const definitions = [];
+  const reg = (def) => definitions.push({
     ...def,
     async execute(args, exec) {
       return toLossless(await def.execute(args, exec));
     },
-  }));
+  });
 
   reg({
     name: 'mcp_connector_catalog',
@@ -758,7 +758,76 @@ export function registerTools(ctx, api) {
     },
   });
 
+  // Keep the original definitions intact: no generic executor, direct API
+  // bypass, or change to Host dispatch/approval for downstream MCP tools.
+  const selected = compact === true
+    ? [createDiscoveryTool(definitions), definitions.find((def) => def.name === 'mcp_connector_session_tools')]
+    : definitions;
+  const disposers = [];
+  try {
+    for (const def of selected) disposers.push(ctx.tools.register(def));
+  } catch (error) {
+    for (const dispose of disposers.reverse()) dispose();
+    throw error;
+  }
   return () => {
     for (const dispose of disposers) dispose();
   };
 }
+
+/** Fixed read-only routes, never an arbitrary tool name or API method. */
+function createDiscoveryTool(definitions) {
+  const routes = Object.fromEntries([
+    ['catalog', 'mcp_connector_catalog'],
+    ['status', 'mcp_connector_status'],
+    ['search', 'mcp_connector_tool_search'],
+    ['detail', 'mcp_connector_tool_detail'],
+  ].map(([action, name]) => [action, definitions.find((def) => def.name === name)]));
+  const failure = (message) => ({ ok: false, message });
+  return {
+    name: 'mcp_connector_discover',
+    description: 'MCP连接器只读发现：catalog 查市场，status 查连接状态，search 搜索已连接服务的缓存工具，detail 查缓存参数。' +
+      '不会连接、配置或执行业务工具。连接/授权/编辑/迁移请使用「MCP连接器」界面；' +
+      '按会话启用的业务工具使用 mcp_connector_session_tools。其他业务调用仍走 Host 原生工具及审批。',
+    parameters: {
+      type: 'object',
+      properties: {
+        action: { type: 'string', enum: Object.keys(routes), description: 'catalog 使用 keyword/category；status 可选 workspaceId；search 必填 query；detail 必填 toolName。仅传当前操作支持的参数。' },
+        ...Object.assign({}, ...Object.values(routes).map((def) => def.parameters.properties)),
+      },
+      required: ['action'],
+      additionalProperties: false,
+    },
+    output: {
+      schema: RESULT_SCHEMA,
+      render(args, value) {
+        const route = Object.hasOwn(routes, value.discoveryAction) ? routes[value.discoveryAction] : null;
+        return route ? route.output.render(args, value) : resultOutput.render(args, value);
+      },
+    },
+    async execute(input) {
+      if (!input || typeof input !== 'object' || Array.isArray(input) ||
+          typeof input.action !== 'string' || !Object.hasOwn(routes, input.action)) {
+        return failure('action 必须是 catalog、status、search 或 detail');
+      }
+      const { action, ...args } = input;
+      const route = routes[action];
+      // The union-shaped public object cannot express action-specific required
+      // fields without provider-incompatible top-level unions. Check them here
+      // before invoking any route; do not reflect arbitrary input or secrets.
+      for (const key of route.parameters.required ?? []) {
+        if (typeof args[key] !== 'string' || !args[key].trim()) return failure(`${action} 缺少必填参数 ${key}`);
+      }
+      for (const [key, value] of Object.entries(args)) {
+        if (!Object.hasOwn(route.parameters.properties, key)) return failure('包含当前 action 不支持的参数');
+        const schema = route.parameters.properties[key];
+        if (typeof value !== schema.type || (schema.type === 'number' &&
+            (!Number.isFinite(value) || value < schema.minimum || value > schema.maximum))) {
+          return failure(`${action} 参数 ${key} 类型或范围不正确`);
+        }
+      }
+      const result = await route.execute(args);
+      return toLossless({ ...result, discoveryAction: action });
+    },
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.74",
+  "version": "0.2.75",
   "description": "DeepSeek Harness MCP Connector: connect servers, search tools across active connections, and troubleshoot discovery. Includes a continuously updated catalog; supports OAuth 2.0 PKCE, API keys, Streamable HTTP/stdio, and mcpServers JSON import.",
   "type": "module",
   "main": "lib/index.js",
@@ -46,7 +46,7 @@
   ],
   "scripts": {
     "test": "node --test",
-    "lint": "node --check lib/discovery-policy.js && node --check lib/index.js && node --check lib/web.js && node --check lib/client.js && node --check lib/settings.js && node --check lib/version-status.js && node --check lib/schema.js && node --check lib/catalog.js && node --check lib/prompts.js && node --check lib/probe.js && node --check lib/diagnostics.js && node --check lib/connection-backup.js && node --check lib/connection-editor.js && node --check lib/connection-scopes.js && node --check lib/governance.js && node --check lib/session-injection.js && node --check lib/tool-catalog-cache.js && node --check lib/status-events.js && node --check lib/mcp-validation.js && node --check lib/mcp-http.js && node --check lib/migration.js && node --check lib/stores.js && node --check lib/grant-journal.js && node --check lib/oauth.js && node --check lib/grant-lifecycle.js && node --check lib/callback-server.js && node --check lib/mcp-provision.js && node --check lib/stdio-startup-guard.js && node --check lib/cli-providers.js && node --check lib/util.js && node --check lib/constants.js && node --check lib/tools.js && node --check lib/connectors/oauth-connector.js && node --check lib/connectors/manual-connector.js && node --check lib/connectors/json-connector.js && node --check scripts/probe-connector.mjs && node --check scripts/cli-bridge.mjs && node --check scripts/build-registry.mjs && node --check scripts/ui-harness.mjs && node --check scripts/check-market-registration.mjs && node --check scripts/check-distribution-sync.mjs && node --check scripts/check-readme-version.mjs && node --check scripts/check-first-use-docs.mjs && node --check scripts/check-marketing-metadata.mjs && node --check scripts/check-storefront-screenshots.mjs && node --check scripts/sync-registry-stats.mjs && node --check scripts/verify-pack.mjs",
+    "lint": "node --check lib/discovery-policy.js && node --check lib/index.js && node --check lib/web.js && node --check lib/client.js && node --check lib/settings.js && node --check lib/version-status.js && node --check lib/schema.js && node --check lib/catalog.js && node --check lib/prompts.js && node --check lib/probe.js && node --check lib/diagnostics.js && node --check lib/connection-backup.js && node --check lib/connection-editor.js && node --check lib/connection-scopes.js && node --check lib/governance.js && node --check lib/session-injection.js && node --check lib/tool-catalog-cache.js && node --check lib/status-events.js && node --check lib/mcp-validation.js && node --check lib/mcp-http.js && node --check lib/migration.js && node --check lib/stores.js && node --check lib/grant-journal.js && node --check lib/oauth.js && node --check lib/grant-lifecycle.js && node --check lib/callback-server.js && node --check lib/mcp-provision.js && node --check lib/stdio-startup-guard.js && node --check lib/cli-providers.js && node --check lib/util.js && node --check lib/constants.js && node --check lib/tools.js && node --check lib/connectors/oauth-connector.js && node --check lib/connectors/manual-connector.js && node --check lib/connectors/json-connector.js && node --check scripts/probe-connector.mjs && node --check scripts/cli-bridge.mjs && node --check scripts/build-registry.mjs && node --check scripts/ui-harness.mjs && node --check scripts/check-market-registration.mjs && node --check scripts/check-distribution-sync.mjs && node --check scripts/check-readme-version.mjs && node --check scripts/check-first-use-docs.mjs && node --check scripts/check-marketing-metadata.mjs && node --check scripts/check-storefront-screenshots.mjs && node --check scripts/sync-registry-stats.mjs && node --check scripts/verify-pack.mjs && node --check scripts/check-tutorial-links.mjs",
     "registry:build": "node scripts/build-registry.mjs",
     "registry:validate": "node scripts/probe-connector.mjs catalog/catalog.json --validate-only",
     "dev:ui": "node scripts/ui-harness.mjs",
@@ -61,7 +61,8 @@
     "marketing:check:live": "node scripts/check-marketing-metadata.mjs --live",
     "storefront:check": "node scripts/check-storefront-screenshots.mjs",
     "verify-pack": "node scripts/verify-pack.mjs",
-    "check": "npm run lint && npm run docs:check && npm run docs:first-use:check && npm run marketing:check && npm run storefront:check && npm test && npm run verify-pack",
+    "docs:tutorial-links:check": "node scripts/check-tutorial-links.mjs",
+    "check": "npm run lint && npm run docs:check && npm run docs:first-use:check && npm run marketing:check && npm run storefront:check && npm test && npm run verify-pack && npm run docs:tutorial-links:check",
     "prepublishOnly": "npm run check"
   },
   "keywords": [