dsh-mcp-connector 0.2.76 → 0.2.78

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -2,6 +2,26 @@
2
2
 
3
3
  本项目遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/);首个公开版本从 `0.1.0` 开始。
4
4
 
5
+ ## [0.2.78] - 2026-10-22
6
+
7
+ ### Fixed
8
+
9
+ - 将版本检查 API 的 401、403、404、5xx 和异常 JSON 响应区分为可操作的提示,避免把所有失败笼统显示为插件 API 不可用;不向界面回显代理正文或敏感响应信息。
10
+ - 补充 NAS / 反向代理诊断指引和回归测试,保留 Host/Origin 安全边界。
11
+
12
+ ### Scope
13
+
14
+ - 本版本改进 #172 的诊断,不宣称已修复或实机验证飞牛 NAS 的部署路由问题;该 Issue 保持开放。
15
+ - 不包含暂缓的国际化 PR #174 或待验收的启动加固 PR #168。
16
+
17
+ ## [0.2.77] - 2026-10-22
18
+
19
+ ### Security
20
+
21
+ - 从 PR #174 独立提取内联事件参数转义修复:先编码 JavaScript 字符串,再编码 HTML 属性,防止目录/连接标识中的特殊字符形成脚本注入。感谢 Marek Vrbka 的报告与修复。
22
+ - 回归测试直接读取生产 UI 的转义函数;隔离真实浏览器通过 28 个事件/载荷组合,并复现旧转义方式的对照问题。验证不访问真实 DSH API、凭据或用户连接。
23
+ - 本次不包含 #174 的国际化改造;既有 Windows Desktop 等验收待办保持开放。
24
+
5
25
  ## [0.2.76] - 2026-10-20
6
26
 
7
27
  ### Added / Fixed
package/README.en.md CHANGED
@@ -225,7 +225,7 @@ npm run dev:ui
225
225
 
226
226
  Every Registry merge regenerates `catalog-stats.json`; an hourly workflow in this repository synchronizes the Chinese and English product copy plus a local stats snapshot. The static npm README updates with package releases, while the live badges above read the Registry directly and therefore stay current without another npm release.
227
227
 
228
- The current public version is [`dsh-mcp-connector@0.2.76`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.76](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.76).
228
+ The current public version is [`dsh-mcp-connector@0.2.78`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.78](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.78).
229
229
 
230
230
  See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
231
231
 
package/README.md CHANGED
@@ -220,7 +220,7 @@ npm run dev:ui
220
220
 
221
221
  公共 Registry 每次合并后会生成 `catalog-stats.json`;本仓库的定时工作流每小时同步中英文介绍和统计快照。npm 页面中的静态正文随版本发布更新,上方动态统计徽标则直接读取 Registry,可在不发布新 npm 版本时保持实时数量一致。
222
222
 
223
- 当前公开版本为 [`dsh-mcp-connector@0.2.76`](https://www.npmjs.com/package/dsh-mcp-connector),对应 [GitHub Release v0.2.76](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.76)。
223
+ 当前公开版本为 [`dsh-mcp-connector@0.2.78`](https://www.npmjs.com/package/dsh-mcp-connector),对应 [GitHub Release v0.2.78](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.78)。
224
224
 
225
225
  版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
226
226
  Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。
@@ -384,6 +384,18 @@ Windows 下 `.cmd` / `.bat` 是脚本包装器,不等同于可直接启动的
384
384
 
385
385
  修正后重新启动 DSH(如变更了进程环境),在连接详情点击“重新检查”,确认工具发现结果。反馈时只提交版本、脱敏后的诊断代码、退出码和必要日志;不要上传 Token、API Key、完整环境变量或个人路径。
386
386
 
387
+ ### NAS / 反向代理下版本检查 API 不可用
388
+
389
+ 顶部版本检查失败不等于全部连接器失效,也不等于 npm 故障。先检查浏览器开发者工具中同源 `POST /mcp-connector/api`(`method: versionStatus`)的 HTTP 状态:
390
+
391
+ - **401**:确认 DSH 登录会话有效,重新登录后重试。
392
+ - **403**:核对宿主声明的可信访问地址(含端口)及代理转发的 Host/Origin;不要关闭校验、信任任意来源或自动放行整个局域网。
393
+ - **404**:检查插件路由是否挂载,反向代理是否正确转发 `/mcp-connector/api`。
394
+ - **5xx**:查看 DSH 和代理服务日志。
395
+ - **200 但不是正确 JSON**:可能返回了登录页或代理兜底页面,检查路由和登录状态。
396
+
397
+ 上述状态只能缩小排查范围,不能单独证明根因。反馈时提供 DSH/插件版本、Docker 或原生部署、IP/域名/反向代理访问方式、HTTP 状态和响应内容类型;保持脱敏后 Host/Origin 的协议与端口关系。不要公开 Token、Cookie、完整 HAR、完整响应正文或个人网络地址。
398
+
387
399
  ### 为什么显示“状态未知”
388
400
 
389
401
  这表示插件没有足够证据确认健康或失败,常见于 DSH 刚重启、尚未执行健康检查,或当前 Host 无法读取 stdio 工具注册状态。先点击“刷新连接器目录”;若仍为未知,在该连接(或详情页)点“重新连接”重建 Host 侧条目——Host 的 mcp-client 在连续重连失败后会注销工具且不再自发重试,只有重建条目才能恢复。若重建后依旧未知,再根据诊断的 `code` 和建议查看 Host 日志或升级 Host。不要把“状态未知”理解为“已连接”。
package/lib/client.js CHANGED
@@ -463,15 +463,28 @@ window.__ModuleLoader__.load({
463
463
  return mount;
464
464
  }
465
465
 
466
+ function versionApiFailureMessage(status) {
467
+ const prefix = "插件版本检查 API 不可用";
468
+ if (status === 401) return `${prefix}(HTTP 401):请重新登录 DSH 后重试`;
469
+ if (status === 403) return `${prefix}(HTTP 403):请检查 DSH 可信访问地址及反向代理 Host/Origin 配置,不要关闭安全校验`;
470
+ if (status === 404) return `${prefix}(HTTP 404):请检查插件路由是否加载,以及反向代理是否转发 /mcp-connector/api`;
471
+ if (Number.isInteger(status) && status >= 400 && status <= 599) return `${prefix}(HTTP ${status}):请检查 DSH 服务和反向代理日志`;
472
+ return `${prefix}:响应格式不正确,请检查登录状态、反向代理和插件版本兼容性`;
473
+ }
474
+
466
475
  async function fetchVersionStatus(force = false) {
467
476
  const response = await window.fetch("/mcp-connector/api", {
468
477
  method: "POST",
469
478
  headers: { "content-type": "application/json" },
470
479
  body: JSON.stringify({ method: "versionStatus", params: { force } })
471
480
  });
472
- const result = await response.json();
473
- if (!response.ok || result.ok !== true || result.detail === void 0) {
474
- throw new Error(result.message ?? `HTTP ${response.status}`);
481
+ // Classify HTTP errors before parsing: a proxy may return an HTML login/error page.
482
+ if (!response.ok) throw new Error(versionApiFailureMessage(response.status));
483
+ let result;
484
+ try { result = await response.json(); }
485
+ catch { throw new Error(versionApiFailureMessage()); }
486
+ if (result?.ok !== true || !result.detail || typeof result.detail !== "object" || Array.isArray(result.detail)) {
487
+ throw new Error(versionApiFailureMessage());
475
488
  }
476
489
  return result.detail;
477
490
  }
@@ -1207,7 +1220,9 @@ window.__ModuleLoader__.load({
1207
1220
  console.warn("[mcp-connector] plugin update check failed:", error);
1208
1221
  if (!disposed) {
1209
1222
  setVersionCheckBusy(false);
1210
- setVersionCheckFailed("api");
1223
+ // Only expose our fixed diagnostic text; never echo proxy bodies or URLs/tokens.
1224
+ setVersionCheckFailed(error instanceof Error && error.message.startsWith("插件版本检查 API 不可用")
1225
+ ? error.message : "插件版本检查 API 请求失败:请检查网络、DSH 服务和反向代理连接");
1211
1226
  schedule(VERSION_CHECK_RETRY_MS);
1212
1227
  }
1213
1228
  });
@@ -1668,7 +1683,7 @@ window.__ModuleLoader__.load({
1668
1683
  versionCheckFailed && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
1669
1684
  className: "mcpConnectorUpdateStatus",
1670
1685
  "data-tone": "error",
1671
- children: versionCheckFailed === "api" ? "插件 API 不可用,请检查 DSH 宿主兼容性或服务日志" : "暂时无法确认 npm 最新版本,请重试"
1686
+ children: typeof versionCheckFailed === "string" && versionCheckFailed !== "npm" ? versionCheckFailed : "暂时无法确认 npm 最新版本,请重试"
1672
1687
  }),
1673
1688
  versionStatus?.releasePending && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
1674
1689
  className: "mcpConnectorVersion",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "dsh-mcp-connector",
3
- "version": "0.2.76",
3
+ "version": "0.2.78",
4
4
  "description": "DeepSeek Harness MCP Connector: connect servers, search tools across active connections, and troubleshoot discovery. Includes a continuously updated catalog; supports OAuth 2.0 PKCE, API keys, Streamable HTTP/stdio, and mcpServers JSON import.",
5
5
  "type": "module",
6
6
  "main": "lib/index.js",
package/ui/index.html CHANGED
@@ -736,6 +736,15 @@
736
736
  return String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
737
737
  }
738
738
 
739
+ // 内联事件属性里的字符串实参必须是「JS 字符串字面量」再按 HTML 属性转义:
740
+ // HTML 解析器会先把 &#39; 解回 ',所以只做 HTML 转义会让单引号逃逸出字符串,
741
+ // 形成 stored XSS(例如 id 为 x');alert(1)// 的目录条目)。
742
+ // JSON.stringify 负责 JS 层转义(引号、反斜杠、控制字符),esc 负责属性层转义,
743
+ // 两层配合后无论值里有什么,浏览器解析出来都只是一个普通字符串字面量。
744
+ function jsString(value) {
745
+ return esc(JSON.stringify(String(value ?? '')));
746
+ }
747
+
739
748
  function isImageIcon(value) {
740
749
  return typeof value === 'string' && /^(?:https?:|data:image\/|\/)/.test(value);
741
750
  }
@@ -1399,7 +1408,7 @@
1399
1408
  const probe = d.probeStatus && d.probeStatus !== 'unverified' ? `<span class="badge ${esc(d.probeStatus)}">${d.probeStatus}</span>` : '';
1400
1409
  const runtimeLabel = d.id === 'dingtalk' ? '本地 CLI' : (d.servers || []).some((s) => s.transport === 'stdio') ? '本地运行' : '';
1401
1410
  const runtimeTag = runtimeLabel ? `<span class="runtime-tag" title="包含运行于 DSH 主机的服务;授权和权限要求请查看详情">${runtimeLabel}</span>` : '';
1402
- return `<div class="card ${d.featured ? 'featured' : ''}" data-id="${esc(d.id)}" role="button" tabindex="0" aria-label="查看 ${esc(d.name)} 详情" onclick="window.__mcp.showDetail('${esc(d.id)}')" onkeydown="if(event.key==='Enter'||event.key===' '){event.preventDefault();window.__mcp.showDetail('${esc(d.id)}')}">
1411
+ return `<div class="card ${d.featured ? 'featured' : ''}" data-id="${esc(d.id)}" role="button" tabindex="0" aria-label="查看 ${esc(d.name)} 详情" onclick="window.__mcp.showDetail(${jsString(d.id)})" onkeydown="if(event.key==='Enter'||event.key===' '){event.preventDefault();window.__mcp.showDetail(${jsString(d.id)})}">
1403
1412
  <div class="icon">${icon}</div>
1404
1413
  <div class="content">
1405
1414
  <div class="name">${esc(d.name)} ${probe} ${runtimeTag}</div>
@@ -1411,36 +1420,37 @@
1411
1420
 
1412
1421
  function actionHtml(d) {
1413
1422
  const id = esc(d.id);
1423
+ const idJs = jsString(d.id);
1414
1424
  const configured = d.connected?.length > 0;
1415
1425
  const incomplete = configured && d.connectionComplete === false;
1416
1426
  const state = d.connectionState || (configured ? 'configured' : 'disconnected');
1417
1427
  if (incomplete && ['bearer', 'api-key'].includes(d.authMode)) {
1418
- return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.openConfig('${id}')">${t('completeSetup')}</button>`;
1428
+ return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.openConfig(${idJs})">${t('completeSetup')}</button>`;
1419
1429
  }
1420
1430
  if (incomplete && d.authMode === 'oauth2-pkce') {
1421
- return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.connect('${id}')">${t('upgradeOauth')}</button>`;
1431
+ return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.connect(${idJs})">${t('upgradeOauth')}</button>`;
1422
1432
  }
1423
1433
  if (configured) {
1424
- if (state === 'healthy') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn ghost" disabled>${t('connected')}</button>`;
1425
- if (state === 'unknown') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('unknown')}</button>`;
1426
- if (state === 'configured') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn ghost" disabled>${t('configured')}</button>`;
1427
- if (state === 'disabled') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn ghost" disabled>${t('disabled')}</button>`;
1434
+ if (state === 'healthy') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn ghost" disabled>${t('connected')}</button>`;
1435
+ if (state === 'unknown') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('unknown')}</button>`;
1436
+ if (state === 'configured') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn ghost" disabled>${t('configured')}</button>`;
1437
+ if (state === 'disabled') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn ghost" disabled>${t('disabled')}</button>`;
1428
1438
  if (state === 'reauth') {
1429
1439
  const credentialAuth = ['bearer', 'api-key'].includes(d.authMode);
1430
- const action = credentialAuth ? `window.__mcp.openConfig('${id}')` : `window.__mcp.showDetail('${id}')`;
1431
- return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();${action}">${credentialAuth ? t('reconfigureCredential') : t('reauthorize')}</button>`;
1440
+ const reauthAction = credentialAuth ? `window.__mcp.openConfig(${idJs})` : `window.__mcp.showDetail(${idJs})`;
1441
+ return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();${reauthAction}">${credentialAuth ? t('reconfigureCredential') : t('reauthorize')}</button>`;
1432
1442
  }
1433
- if (state === 'recovering') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('recovering')}</button>`;
1434
- if (state === 'degraded') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('partialError')}</button>`;
1435
- if (state === 'unavailable') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn status-bad" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('connectionError')}</button>`;
1443
+ if (state === 'recovering') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('recovering')}</button>`;
1444
+ if (state === 'degraded') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn status-warning" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('partialError')}</button>`;
1445
+ if (state === 'unavailable') return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn status-bad" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('connectionError')}</button>`;
1436
1446
  }
1437
1447
  if (d.authMode === 'oauth2-pkce') {
1438
- return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn" type="button" onclick="event.stopPropagation();window.__mcp.connect('${id}')">${t('connect')}</button>`;
1448
+ return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn" type="button" onclick="event.stopPropagation();window.__mcp.connect(${idJs})">${t('connect')}</button>`;
1439
1449
  }
1440
1450
  if (d.authMode === 'none') {
1441
- return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn" type="button" onclick="event.stopPropagation();window.__mcp.connect('${id}')">${t('connect')}</button>`;
1451
+ return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn" type="button" onclick="event.stopPropagation();window.__mcp.connect(${idJs})">${t('connect')}</button>`;
1442
1452
  }
1443
- return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail('${id}')">${t('details')}</button><button class="btn" type="button" onclick="event.stopPropagation();window.__mcp.openConfig('${id}')">${t('configure')}</button>`;
1453
+ return `<button class="btn ghost" type="button" onclick="event.stopPropagation();window.__mcp.showDetail(${idJs})">${t('details')}</button><button class="btn" type="button" onclick="event.stopPropagation();window.__mcp.openConfig(${idJs})">${t('configure')}</button>`;
1444
1454
  }
1445
1455
 
1446
1456
  const EXPLORER_STATUS = { pending: '尚未发现', unknown: 'Host 状态未知', success: '最近发现成功', failed: '最近发现失败' };
@@ -1545,6 +1555,7 @@
1545
1555
 
1546
1556
  function rowHtml(r) {
1547
1557
  const key = esc(r.key);
1558
+ const keyJs = jsString(r.key);
1548
1559
  const canRename = r.canRename === true;
1549
1560
  const canEditConfiguration = r.canEditConfiguration === true;
1550
1561
  const authMode = r.authMode === 'oauth' ? '<span class="badge auth-oauth">OAuth</span>' : `<span class="badge">${esc(r.authMode || 'manual')}</span>`;
@@ -1564,21 +1575,21 @@
1564
1575
  <div class="rmeta">${esc(r.serverName || '')} · ${esc(r.endpoint || r.url || '')}</div>
1565
1576
  ${diagnostic}
1566
1577
  </div>
1567
- <select class="injection-select" aria-label="${esc(r.name)} 工具注入模式" title="按会话模式不会断开连接,只会默认隐藏业务工具 schema" onchange="window.__mcp.changeInjectionMode('${key}', this.value, this)">
1578
+ <select class="injection-select" aria-label="${esc(r.name)} 工具注入模式" title="按会话模式不会断开连接,只会默认隐藏业务工具 schema" onchange="window.__mcp.changeInjectionMode(${keyJs}, this.value, this)">
1568
1579
  <option value="always" ${injectionMode === 'always' ? 'selected' : ''}>始终注入</option>
1569
1580
  <option value="session" ${injectionMode === 'session' ? 'selected' : ''}>按会话启用(实验)</option>
1570
1581
  </select>
1571
1582
  <label class="switch" title="${enabled ? '停用' : '启用'}" aria-label="${enabled ? '停用' : '启用'} ${esc(r.name)}">
1572
- <input type="checkbox" ${enabled ? 'checked' : ''} onchange="window.__mcp.toggle('${key}', this.checked)">
1583
+ <input type="checkbox" ${enabled ? 'checked' : ''} onchange="window.__mcp.toggle(${keyJs}, this.checked)">
1573
1584
  <span class="slider"></span>
1574
1585
  </label>
1575
- ${canEditConfiguration ? `<button class="btn ghost" type="button" onclick="window.__mcp.openEditor('${key}')">编辑配置</button>` : ''}
1576
- ${r.canEditLocalOverrides ? `<button class="btn ghost" type="button" onclick="window.__mcp.openLocalEditor('${key}')">本地参数</button>` : r.hasLocalOverrides ? `<button class="btn ghost" type="button" onclick="window.__mcp.submitLocalOverrides('${key}', true)">清除本地参数</button>` : ''}
1577
- ${canRename ? `<button class="btn ghost" type="button" onclick="window.__mcp.openRename('${key}')">重命名</button>` : ''}
1578
- ${enabled ? `<button class="btn ghost" type="button" onclick="window.__mcp.showConnectionTools('${key}')">工具</button>` : ''}
1579
- ${enabled && r.connectionState !== 'healthy' ? `<button class="btn ghost" type="button" title="重新建立 Host 侧条目并复检:不改配置、凭据、范围或注入模式" onclick="window.__mcp.reconnect('${key}')">重新连接</button>` : ''}
1580
- <button class="btn ghost" type="button" onclick="window.__mcp.openScope('${key}')">范围</button>
1581
- <button class="btn danger" onclick="window.__mcp.disconnect('${key}')">断开</button>
1586
+ ${canEditConfiguration ? `<button class="btn ghost" type="button" onclick="window.__mcp.openEditor(${keyJs})">编辑配置</button>` : ''}
1587
+ ${r.canEditLocalOverrides ? `<button class="btn ghost" type="button" onclick="window.__mcp.openLocalEditor(${keyJs})">本地参数</button>` : r.hasLocalOverrides ? `<button class="btn ghost" type="button" onclick="window.__mcp.submitLocalOverrides(${keyJs}, true)">清除本地参数</button>` : ''}
1588
+ ${canRename ? `<button class="btn ghost" type="button" onclick="window.__mcp.openRename(${keyJs})">重命名</button>` : ''}
1589
+ ${enabled ? `<button class="btn ghost" type="button" onclick="window.__mcp.showConnectionTools(${keyJs})">工具</button>` : ''}
1590
+ ${enabled && r.connectionState !== 'healthy' ? `<button class="btn ghost" type="button" title="重新建立 Host 侧条目并复检:不改配置、凭据、范围或注入模式" onclick="window.__mcp.reconnect(${keyJs})">重新连接</button>` : ''}
1591
+ <button class="btn ghost" type="button" onclick="window.__mcp.openScope(${keyJs})">范围</button>
1592
+ <button class="btn danger" onclick="window.__mcp.disconnect(${keyJs})">断开</button>
1582
1593
  </div>`;
1583
1594
  }
1584
1595
 
@@ -1708,7 +1719,7 @@
1708
1719
  <label for="rename-name">连接显示名(必填)</label><input id="rename-name" value="${esc(item.name)}" maxlength="80" autocomplete="off" />
1709
1720
  <label for="rename-server-name">serverName(工具前缀,不可修改)</label><input id="rename-server-name" value="${esc(item.serverName || '')}" disabled />
1710
1721
  <div class="inline-error" id="modal-error" tabindex="-1"></div>
1711
- <div class="m-actions"><button class="btn ghost" type="button" onclick="window.__mcp.closeModal()">取消</button><button class="btn" type="button" onclick="window.__mcp.submitRename('${esc(key)}')">保存显示名</button></div>`);
1722
+ <div class="m-actions"><button class="btn ghost" type="button" onclick="window.__mcp.closeModal()">取消</button><button class="btn" type="button" onclick="window.__mcp.submitRename(${jsString(key)})">保存显示名</button></div>`);
1712
1723
  }
1713
1724
 
1714
1725
  async function openConnectionEditor(key) {
@@ -1723,7 +1734,7 @@
1723
1734
  <textarea id="edit-connection-json" rows="14" spellcheck="false">${esc(result.detail?.json || '')}</textarea>
1724
1735
  <div class="field-help">提交前会先验证新配置并创建快照。任何校验、启动或保存失败都会保留原连接;连接 key、作用范围与启停状态不变。</div>
1725
1736
  <div class="inline-error" id="modal-error" tabindex="-1"></div>
1726
- <div class="m-actions"><button class="btn ghost" type="button" onclick="window.__mcp.closeModal()">取消</button><button class="btn" type="button" onclick="window.__mcp.submitReconfigure('${esc(key)}')">${action}</button></div>`);
1737
+ <div class="m-actions"><button class="btn ghost" type="button" onclick="window.__mcp.closeModal()">取消</button><button class="btn" type="button" onclick="window.__mcp.submitReconfigure(${jsString(key)})">${action}</button></div>`);
1727
1738
  }
1728
1739
 
1729
1740
  async function openLocalEditor(key) {
@@ -1737,7 +1748,7 @@
1737
1748
  <textarea id="local-overrides-json" rows="12" spellcheck="false">${esc(result.detail?.json || '')}</textarea>
1738
1749
  <div class="field-help"><code>&lt;KEEP_EXISTING&gt;</code> 保留本机已有值;删除字段清除该项覆盖。保存会创建快照并重新加载已启用连接,停用连接保持停用;不代表工具调用已验收。</div>
1739
1750
  <div class="inline-error" id="modal-error" tabindex="-1"></div>
1740
- <div class="m-actions"><button class="btn ghost" type="button" onclick="window.__mcp.closeModal()">取消</button><button class="btn ghost" type="button" onclick="window.__mcp.submitLocalOverrides('${esc(key)}', true)">恢复市场参数</button><button class="btn" type="button" onclick="window.__mcp.submitLocalOverrides('${esc(key)}')">保存本地参数</button></div>`);
1751
+ <div class="m-actions"><button class="btn ghost" type="button" onclick="window.__mcp.closeModal()">取消</button><button class="btn ghost" type="button" onclick="window.__mcp.submitLocalOverrides(${jsString(key)}, true)">恢复市场参数</button><button class="btn" type="button" onclick="window.__mcp.submitLocalOverrides(${jsString(key)})">保存本地参数</button></div>`);
1741
1752
  }
1742
1753
 
1743
1754
  function openAddConnection(mode = 'json', preset = {}) {
@@ -1804,7 +1815,7 @@
1804
1815
  }
1805
1816
  const items = snapshots.detail?.items || [];
1806
1817
  const snapshotHtml = items.length
1807
- ? `<div class="snapshot-list">${items.map((item) => `<div class="snapshot-item"><div class="snapshot-copy"><strong>${esc(item.reason)} · ${esc(new Date(item.createdAt).toLocaleString('zh-CN', { hour12: false }))}</strong>${item.existingCount} 条连接${item.absentCount ? ` · 可移除 ${item.absentCount} 条变更后新增连接` : ''}${item.restorable ? '' : ' · OAuth 需重新授权'}</div><button class="btn ghost" type="button" ${item.restorable ? '' : 'disabled'} onclick="window.__mcp.restoreBackup('${esc(item.id)}')">恢复</button></div>`).join('')}</div>`
1818
+ ? `<div class="snapshot-list">${items.map((item) => `<div class="snapshot-item"><div class="snapshot-copy"><strong>${esc(item.reason)} · ${esc(new Date(item.createdAt).toLocaleString('zh-CN', { hour12: false }))}</strong>${item.existingCount} 条连接${item.absentCount ? ` · 可移除 ${item.absentCount} 条变更后新增连接` : ''}${item.restorable ? '' : ' · OAuth 需重新授权'}</div><button class="btn ghost" type="button" ${item.restorable ? '' : 'disabled'} onclick="window.__mcp.restoreBackup(${jsString(item.id)})">恢复</button></div>`).join('')}</div>`
1808
1819
  : '<div class="field-help">还没有本机配置快照。连接、配置、导入、启停和断开前会自动创建,也可立即手动创建。</div>';
1809
1820
  openModal('配置备份', `
1810
1821
  <div class="form-note"><strong>可携带脱敏导出</strong>Token、API Key、Header/env 值、stdio 参数、本地路径与 OAuth Grant 均不会导出;占位符需在目标本机重填,OAuth 需重新授权。</div>