dsh-mcp-connector 0.2.8 → 0.2.9

package/CHANGELOG.md

@@ -4,6 +4,13 @@
 
 ## [Unreleased]
 
+## [0.2.9] - 2026-08-22
+
+### Added
+
+- `tools/list` 现在在同一 MCP 会话内自动跟随 `nextCursor` 加载全部分页，并对重复游标、超过 100 页或 10,000 个工具的异常目录执行安全阻断。
+- 工具详情统一使用中文服务计数；自动识别服务商返回的 deprecated 描述，将弃用别名排到末尾并标注“已弃用”。
+
 ## [0.2.8] - 2026-08-22
 
 ### Fixed
@@ -187,7 +194,8 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.8...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.9...HEAD
+[0.2.9]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.8...v0.2.9
 [0.2.8]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.7...v0.2.8
 [0.2.7]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.6...v0.2.7
 [0.2.6]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.5...v0.2.6

package/README.en.md

@@ -110,7 +110,7 @@ See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](d
 - Failed API key/token validation is not persisted; authentication, timeout, DNS, and TLS/network errors are reported separately.
 - External URLs must use HTTPS; HTTP is allowed only for loopback development.
 - Remote descriptors and catalogs are limited to 2 MiB, Web API requests to 1 MiB, and imported JSON is scanned for credential fields before normalization.
-- Streamable HTTP is the primary transport with SSE compatibility. stdio entries are explicitly skipped.
+- Streamable HTTP is the primary transport. Legacy SSE entries can still be provisioned to the DSH Host, while live health checks, tool discovery, and pagination in the connector UI target Streamable HTTP. stdio entries are explicitly skipped.
 - The primary sidebar placement uses the stable DSH `data-slot` marker and falls back to the footer if that marker is removed.
 
 ## License

package/README.md

@@ -108,7 +108,7 @@ Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。
 - 市场 Key/Token 校验失败时不写入 storage domain；鉴权、超时、DNS、TLS/网络错误会分类提示。
 - 外部 URL 仅允许 HTTPS，HTTP 仅允许回环地址；导入配置会校验 URL 与 Header。
 - 远程目录/描述响应限制 2 MiB，Web API 请求限制 1 MiB；原始 JSON 在归一化前扫描凭据字段。
-- 当前以 streamable-http 为主并兼容 SSE；stdio 配置会被明确跳过。
+- 当前以 Streamable HTTP 为主；可把旧 SSE 条目交给 DSH Host 兼容运行，但详情页的实时健康检查、工具枚举和分页仅面向 Streamable HTTP。stdio 配置会被明确跳过。
 - 顶部入口通过 DSH 稳定 `data-slot` 定位并使用 React Portal；DSH 若移除该标记，入口会回退到底部，不影响连接器功能。
 - 旧授权迁移必须显式确认，只复制不删除；确认新连接可用后再手动停用旧插件。
 

package/lib/mcp-http.js

@@ -9,6 +9,8 @@ import { MCP_PROTOCOL_VERSION } from './constants.js';
 import { authHeaders } from './mcp-provision.js';
 
 const MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+const MAX_TOOL_PAGES = 100;
+const MAX_TOOLS = 10_000;
 
 export class McpHttpError extends Error {
   constructor(message, { kind = 'protocol', status } = {}) {
@@ -150,22 +152,41 @@ export async function listMcpTools(record, {
       method: 'notifications/initialized',
       params: {},
     }, { grants, sessionId, protocolVersion, signal: controller.signal, fetchImpl });
-    if (notification.response.status === 401 || notification.response.status === 403) {
+    if (!notification.response.ok) {
       throw responseError(notification.response, notification.payload, notification.text);
     }
 
-    const listed = await post(record, {
-      jsonrpc: '2.0',
-      id: 2,
-      method: 'tools/list',
-      params: {},
-    }, { grants, sessionId, protocolVersion, signal: controller.signal, fetchImpl });
-    if (!listed.response.ok) throw responseError(listed.response, listed.payload, listed.text);
-    const listPayloadError = payloadError(listed.payload);
-    if (listPayloadError) throw listPayloadError;
-    const tools = listed.payload?.result?.tools;
-    if (!Array.isArray(tools)) throw new McpHttpError('MCP tools/list 未返回工具数组');
-    return { tools, protocolVersion, sessionful: Boolean(sessionId) };
+    const tools = [];
+    const seenCursors = new Set();
+    let cursor;
+    for (let page = 0; page < MAX_TOOL_PAGES; page += 1) {
+      const listed = await post(record, {
+        jsonrpc: '2.0',
+        id: page + 2,
+        method: 'tools/list',
+        params: cursor ? { cursor } : {},
+      }, { grants, sessionId, protocolVersion, signal: controller.signal, fetchImpl });
+      if (!listed.response.ok) throw responseError(listed.response, listed.payload, listed.text);
+      const listPayloadError = payloadError(listed.payload);
+      if (listPayloadError) throw listPayloadError;
+      const pageTools = listed.payload?.result?.tools;
+      if (!Array.isArray(pageTools)) throw new McpHttpError('MCP tools/list 未返回工具数组');
+      tools.push(...pageTools);
+      if (tools.length > MAX_TOOLS) {
+        throw new McpHttpError(`MCP 工具数量超过安全上限（${MAX_TOOLS}）`);
+      }
+
+      const nextCursor = listed.payload?.result?.nextCursor;
+      if (typeof nextCursor !== 'string' || nextCursor.length === 0) {
+        return { tools, protocolVersion, sessionful: Boolean(sessionId), pages: page + 1 };
+      }
+      if (seenCursors.has(nextCursor)) {
+        throw new McpHttpError('MCP tools/list 返回了重复分页游标');
+      }
+      seenCursors.add(nextCursor);
+      cursor = nextCursor;
+    }
+    throw new McpHttpError(`MCP tools/list 分页超过安全上限（${MAX_TOOL_PAGES} 页）`);
   } finally {
     clearTimeout(timer);
     await closeSession(record, { grants, sessionId, protocolVersion, fetchImpl });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "General-purpose MCP connector, connection manager, plugin extension, and integration marketplace for DeepSeek Harness, initiated and maintained by Qichacha/QCC.",
   "type": "module",
   "main": "lib/index.js",

package/ui/index.html

@@ -290,7 +290,9 @@
   .tool-item { padding: 10px 12px; border-top: 1px solid #f0f1f3; }
   .tool-item:first-child { border-top: 0; }
   .tool-item:hover { background: var(--accent-light); }
+  .tool-name-row { display: flex; align-items: center; gap: 7px; }
   .tool-name { color: var(--text); font: 600 12px/1.45 ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace; overflow-wrap: anywhere; }
+  .tool-deprecated { color: var(--warn); background: var(--warn-bg); border-radius: 999px; padding: 1px 6px; font-size: 10px; line-height: 1.5; flex: 0 0 auto; }
   .tool-description { color: var(--text-2); font-size: 12px; line-height: 1.55; margin-top: 4px; white-space: pre-wrap; overflow-wrap: anywhere; }
   .tool-description.empty { color: var(--muted); font-style: italic; }
   .tools-loading, .tools-error { font-size: 13px; color: var(--muted); padding: 8px; }
@@ -617,12 +619,16 @@
 
   function updateToolsSummary() {
     const totalTools = detailToolServers.reduce((sum, server) => sum + (server.tools?.length || 0), 0);
-    $('#tools-summary').textContent = `${detailToolServers.length} SERVER · ${totalTools} 个工具`;
+    $('#tools-summary').textContent = `${detailToolServers.length} 个服务 · ${totalTools} 个工具`;
     $('#tools-search').placeholder = totalTools > 0
       ? `搜索 ${totalTools} 个工具的名称或描述…`
       : '搜索工具名称或描述…';
   }
 
+  function isDeprecatedTool(tool) {
+    return /(?:\bdeprecated\b|已弃用|已废弃|不再推荐)/i.test(`${tool?.title || ''}\n${tool?.description || ''}`);
+  }
+
   function renderTools() {
     const query = $('#tools-search').value.trim().toLowerCase();
     if (detailToolServers.length === 0) {
@@ -642,7 +648,7 @@
       const matched = (server.tools || []).filter((tool) => {
         if (!query) return true;
         return `${tool.name || ''}\n${tool.title || ''}\n${tool.description || ''}`.toLowerCase().includes(query);
-      });
+      }).sort((left, right) => Number(isDeprecatedTool(left)) - Number(isDeprecatedTool(right)));
       if (query && matched.length === 0) return '';
       matchedTools += matched.length;
       const tools = matched.slice(0, Math.max(0, remaining));
@@ -652,7 +658,8 @@
       const items = tools.length > 0
         ? tools.map((tool) => {
           const description = tool.description || (tool.title && tool.title !== tool.name ? tool.title : '');
-          return `<div class="tool-item"><div class="tool-name">${esc(tool.name || tool.title || '未命名工具')}</div><div class="tool-description${description ? '' : ' empty'}">${esc(description || '暂无描述')}</div></div>`;
+          const deprecated = isDeprecatedTool(tool);
+          return `<div class="tool-item"><div class="tool-name-row"><div class="tool-name">${esc(tool.name || tool.title || '未命名工具')}</div>${deprecated ? '<span class="tool-deprecated">已弃用</span>' : ''}</div><div class="tool-description${description ? '' : ' empty'}">${esc(description || '暂无描述')}</div></div>`;
         }).join('')
         : '<div class="tools-loading">暂无工具</div>';
       return `<div class="tools-server"><div class="tools-server-header">${esc(label)} <span class="count">· 显示 ${tools.length} / ${matched.length} 个</span></div>${items}</div>`;