dsh-mcp-connector 0.2.9 → 0.2.11

package/CHANGELOG.md

@@ -4,6 +4,28 @@
 
 ## [Unreleased]
 
+## [0.2.11] - 2026-08-23
+
+### Added
+
+- 新增八爪鱼云采集第三方市场卡片：通过标准 OAuth 2.1 Authorization Code + PKCE 和动态客户端注册完成一键授权，无需复制 API Key；精选 Prompt 覆盖模板搜索、任务进度、数据预览/导出，并在启动或停止云任务前要求用户确认。
+
+### Changed
+
+- OAuth 发现按 RFC 8414 元数据优先、OIDC Discovery 补充的方式合并端点，兼容动态客户端注册与撤销端点分散发布的服务。
+- 将 OAuth 撤销端点视为可选能力：服务未发布该端点时仍可授权、刷新和断开，断开时删除 DSH 本机授权记录。
+
+### Verification
+
+- 75 项自动测试与 lint 通过；新增 OAuth/OIDC 元数据合并及无撤销端点兼容回归。
+- 八爪鱼公开 MCP 端点、Protected Resource Metadata、Authorization Server Metadata、OIDC Discovery、PKCE S256 与动态客户端注册端点探针通过；真实账户授权和工具调用留待 Desktop 用户登录验收。
+
+## [0.2.10] - 2026-08-22
+
+### Fixed
+
+- 工具发现遇到瞬时网络断开或 MCP 5xx 时自动重试一次；鉴权、协议、4xx 和超时仍直接返回，减少 QVeris 等远程服务偶发 TLS reset 导致的连接状态误报。
+
 ## [0.2.9] - 2026-08-22
 
 ### Added
@@ -194,7 +216,9 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.9...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.11...HEAD
+[0.2.11]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.10...v0.2.11
+[0.2.10]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.9...v0.2.10
 [0.2.9]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.8...v0.2.9
 [0.2.8]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.7...v0.2.8
 [0.2.7]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.6...v0.2.7

package/README.en.md

@@ -26,7 +26,7 @@ Browse and install MCP connectors from different providers in DeepSeek Harness D
 - A standalone remote Registry, allowing new marketplace cards to appear after refresh without publishing a new npm version.
 - Explicit, non-destructive migration of authorization from the two earlier Qichacha OAuth plugins.
 
-The first four bundled cards are Qichacha connectors, followed by PKULaw and Wind. After a remote Registry refresh, Yingmi and QVeris are also available, for eight published marketplace cards in total; the architecture is provider-neutral.
+The first four bundled cards are Qichacha connectors, followed by PKULaw and Wind. After a remote Registry refresh, Yingmi, QVeris, and Bazhuayu Cloud Collection are also available, for nine published marketplace cards in total. Bazhuayu is the first third-party example to exercise the complete OAuth 2.1 + PKCE dynamic-registration flow; the architecture remains provider-neutral.
 
 ## Interface and demo
 
@@ -100,7 +100,7 @@ npm run dev:ui
 
 `npm run check` performs syntax checks, automated tests, and an npm package allowlist/sensitive-content audit. `npm run market:check` tracks the external DSH marketplace PR and live directory. Tags matching `v*` trigger GitHub Actions; the tag must match `package.json`. npm releases use Trusted Publishing through GitHub OIDC and do not require a long-lived `NPM_TOKEN`.
 
-The current public version is [`dsh-mcp-connector@0.2.7`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.7](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.7).
+The current public version is [`dsh-mcp-connector@0.2.11`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.11](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.11).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -28,7 +28,7 @@
 - 平滑迁移：显式扫描并复制两个旧企查查 OAuth 插件授权；不删除原插件或原凭据。
 - 对话工具：`mcp_connector_catalog`、`connect`、`configure`、`import_json`、`install_from_url`、`status`、`health_check`、`set_enabled`、`disconnect`、`refresh_catalog`、`publish`、`tools_list`。
 
-随包目录前 4 张为企查查连接器，另含“北大法宝·法律检索”和“Wind·股票数据”。远程 Registry 刷新后还会加入“盈米·基金投顾”和“QVerisMCP”，当前共 8 张已发布市场卡片；插件架构不限定厂商。
+随包目录前 4 张为企查查连接器，另含“北大法宝·法律检索”和“Wind·股票数据”。远程 Registry 刷新后还会加入“盈米·基金投顾”、“QVerisMCP”和“八爪鱼·云采集”，当前共 9 张已发布市场卡片；其中八爪鱼是首个完整跑通标准 OAuth 2.1 + PKCE 动态注册链路的第三方示例，插件架构不限定厂商。
 
 ## 界面与演示
 
@@ -96,7 +96,7 @@ npm run dev:ui
 
 `check` 执行语法检查、自动测试和 npm 发布包白名单校验；`market:check` 检查外部 DSH 市场 PR 与线上目录；`dev:ui` 启动不含真实凭据的本地 mock 市场。CI 使用 `--legacy-peer-deps` 安装显式测试依赖，DSH 运行期 peer 仍由 Host 提供。`v*` Tag 会触发 GitHub Actions；Tag 必须与 `package.json` 版本一致。Release 通过 npm Trusted Publishing (GitHub OIDC) 发布，不依赖长期 `NPM_TOKEN`。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.7`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.7](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.7)。
+当前公开版本为 [`dsh-mcp-connector@0.2.11`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.11](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.11)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/docs/MARKET-REGISTRATION.md

@@ -45,9 +45,11 @@ Bearer/API Key 型连接器可在卡片上点「配置」，一次填写凭据
 - OAuth Authorization Code + PKCE S256；
 - MCP Protected Resource Metadata（RFC 9728）；
 - Authorization Server Metadata（RFC 8414）；
-- `authorization_endpoint`、`token_endpoint`、`registration_endpoint`、`revocation_endpoint`；
+- `authorization_endpoint`、`token_endpoint`、`registration_endpoint`；`revocation_endpoint` 建议提供，但按标准属于可选能力；
 - Dynamic Client Registration，且支持 loopback callback URI；
-- Refresh Token 和撤销。
+- Refresh Token；如提供撤销端点，插件会在断开/清理授权时撤销 Refresh Token，否则只删除 DSH 本机授权记录。
+
+插件优先读取 RFC 8414 Authorization Server Metadata；若动态注册或撤销端点缺失，会再读取 OIDC Discovery 并仅补齐缺失字段。OAuth 元数据中的授权、Token 等标准端点始终优先。
 
 符合上述条件的最小描述：
 
@@ -153,3 +155,25 @@ QVeris Hosted MCP 提供单一 Streamable HTTP 端点 `https://mcp.qveris.ai/mcp
 - https://qveris.ai/pricing
 - https://qveris.ai/privacy
 - https://qveris.ai/terms
+
+## 9. 八爪鱼云采集 OAuth 适配结论
+
+八爪鱼公开 MCP 服务 `https://mcp.bazhuayu.com/` 已验证支持标准远程 MCP OAuth 发现链路：
+
+- Protected Resource Metadata 指向 `https://identity.bazhuayu.com`；
+- Authorization Code + PKCE S256；
+- Dynamic Client Registration，公共客户端使用 `token_endpoint_auth_method: none`；
+- Scope：`openid profile offline_access`；
+- OAuth Metadata 发布授权与 Token 端点，OIDC Discovery 补充动态注册和撤销端点。
+
+因此可以作为本市场首个完整的第三方 OAuth 一键授权示例。连接器不复用 WorkBuddy 的 `client_id` 或私有回调协议，而是由 DSH 插件为本机 loopback callback 动态注册独立公共客户端；授权结果只保存在 DSH storage domain。
+
+市场卡片使用八爪鱼官网 favicon 的像素副本并由 Registry 自托管；能力描述与 10 个工具快照以官方 MCP 文档为准。涉及启动/停止云任务的 Prompt 必须先征求用户确认，实际云采集配额、费用、平台范围与数据使用责任以用户账户和八爪鱼官方规则为准。
+
+参考：
+
+- https://www.bazhuayu.com/ai-open-platform
+- https://www.bazhuayu.com/docs/zh/mcp
+- https://mcp.bazhuayu.com/.well-known/oauth-protected-resource
+- https://identity.bazhuayu.com/.well-known/oauth-authorization-server
+- https://identity.bazhuayu.com/.well-known/openid-configuration

package/lib/index.js

@@ -201,11 +201,13 @@ export async function apply(ctx, config) {
     if (revoke && entry.grant.refreshToken) {
       try {
         const metadata = await discoverServerMetadata(entry.grant.issuer, config.requestTimeoutMs);
-        await revokeRefreshToken(metadata.revocationEndpoint, {
-          clientId: entry.grant.clientId,
-          refreshToken: entry.grant.refreshToken,
-          timeoutMs: config.requestTimeoutMs,
-        });
+        if (metadata.revocationEndpoint) {
+          await revokeRefreshToken(metadata.revocationEndpoint, {
+            clientId: entry.grant.clientId,
+            refreshToken: entry.grant.refreshToken,
+            timeoutMs: config.requestTimeoutMs,
+          });
+        }
       } catch (error) {
         logger.warn(`retire unused grant ${grantKey}: revoke failed, removing local copy: ${error.message}`);
       }
@@ -716,11 +718,13 @@ export async function apply(ctx, config) {
           if (g?.grant.refreshToken) {
             try {
               const metadata = await discoverServerMetadata(g.grant.issuer, config.requestTimeoutMs);
-              await revokeRefreshToken(metadata.revocationEndpoint, {
-                clientId: g.grant.clientId,
-                refreshToken: g.grant.refreshToken,
-                timeoutMs: config.requestTimeoutMs,
-              });
+              if (metadata.revocationEndpoint) {
+                await revokeRefreshToken(metadata.revocationEndpoint, {
+                  clientId: g.grant.clientId,
+                  refreshToken: g.grant.refreshToken,
+                  timeoutMs: config.requestTimeoutMs,
+                });
+              }
             } catch (error) {
               logger.warn(`revoke failed (continuing disconnect): ${error.message}`);
             }

package/lib/mcp-http.js

@@ -115,7 +115,7 @@ async function closeSession(record, { grants, sessionId, protocolVersion, fetchI
   } catch {}
 }
 
-export async function listMcpTools(record, {
+async function listMcpToolsOnce(record, {
   timeoutMs = 15_000,
   fetchImpl = fetch,
   grants = new Map(),
@@ -192,3 +192,44 @@ export async function listMcpTools(record, {
     await closeSession(record, { grants, sessionId, protocolVersion, fetchImpl });
   }
 }
+
+function errorChain(error) {
+  const parts = [];
+  let current = error;
+  for (let depth = 0; current && depth < 4; depth += 1) {
+    parts.push(current.code, current.name, current.message);
+    current = current.cause;
+  }
+  return parts.filter(Boolean).join(' ');
+}
+
+function isRetryableDiscoveryError(error) {
+  if (error instanceof McpHttpError) {
+    return error.kind === 'http' && Number(error.status) >= 500;
+  }
+  const text = errorChain(error);
+  if (/AbortError|timeout|timed out|ETIMEDOUT/i.test(text)) return false;
+  return /ECONNRESET|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|fetch failed|socket disconnected|connection reset|network error/i.test(text);
+}
+
+/**
+ * 获取完整工具目录。瞬时网络错误或 5xx 最多自动重试一次；鉴权、协议、
+ * 4xx 和超时不会重试，避免掩盖无效凭据或延长确定性失败。
+ */
+export async function listMcpTools(record, options = {}) {
+  const retryCount = Math.max(0, Math.min(Number(options.retryCount ?? 1), 2));
+  const retryDelayMs = Math.max(0, Math.min(Number(options.retryDelayMs ?? 250), 2_000));
+  const requestOptions = { ...options };
+  delete requestOptions.retryCount;
+  delete requestOptions.retryDelayMs;
+
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      const result = await listMcpToolsOnce(record, requestOptions);
+      return { ...result, attempts: attempt + 1 };
+    } catch (error) {
+      if (attempt >= retryCount || !isRetryableDiscoveryError(error)) throw error;
+      if (retryDelayMs > 0) await new Promise((resolve) => setTimeout(resolve, retryDelayMs));
+    }
+  }
+}

package/lib/oauth.js

@@ -142,20 +142,38 @@ export async function discoverProtectedResource(streamUrl, timeoutMs) {
 
 export async function discoverServerMetadata(issuer, timeoutMs) {
   assertSafeUrl(issuer);
-  const url = `${issuer.replace(/\/+$/, '')}/.well-known/oauth-authorization-server`;
-  const body = await fetchJson(url, { method: 'GET' }, timeoutMs);
-  for (const field of ['authorization_endpoint', 'token_endpoint', 'registration_endpoint', 'revocation_endpoint']) {
+  const base = issuer.replace(/\/+$/, '');
+  const oauthUrl = `${base}/.well-known/oauth-authorization-server`;
+  const oauthBody = await fetchJson(oauthUrl, { method: 'GET' }, timeoutMs);
+
+  // 一些兼容 OIDC 的服务会把 DCR / token revoke 端点只发布在
+  // openid-configuration 中。优先使用 RFC 8414 元数据，仅在扩展端点缺失时合并 OIDC 元数据。
+  let oidcBody = {};
+  if (!oauthBody.registration_endpoint || !oauthBody.revocation_endpoint) {
+    try {
+      oidcBody = await fetchJson(`${base}/.well-known/openid-configuration`, { method: 'GET' }, timeoutMs);
+    } catch {
+      // OIDC 发现是可选兼容路径；OAuth-only 服务不应因此失败。
+    }
+  }
+  const body = { ...oidcBody, ...oauthBody };
+
+  // 当前一键 OAuth 流程依赖动态客户端注册；撤销端点则是 RFC 8414 的可选元数据。
+  for (const field of ['authorization_endpoint', 'token_endpoint', 'registration_endpoint']) {
     if (typeof body[field] !== 'string' || body[field].length === 0) {
       throw new OAuthError('invalid_metadata', `oauth server metadata missing ${field}`);
     }
     assertSafeUrl(body[field]);
   }
+  if (typeof body.revocation_endpoint === 'string' && body.revocation_endpoint.length > 0) {
+    assertSafeUrl(body.revocation_endpoint);
+  }
   return {
     issuer: body.issuer ?? issuer,
     authorizationEndpoint: body.authorization_endpoint,
     tokenEndpoint: body.token_endpoint,
     registrationEndpoint: body.registration_endpoint,
-    revocationEndpoint: body.revocation_endpoint,
+    revocationEndpoint: body.revocation_endpoint || undefined,
     responseTypesSupported: body.response_types_supported ?? [],
     grantTypesSupported: body.grant_types_supported ?? [],
     codeChallengeMethodsSupported: body.code_challenge_methods_supported ?? [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "General-purpose MCP connector, connection manager, plugin extension, and integration marketplace for DeepSeek Harness, initiated and maintained by Qichacha/QCC.",
   "type": "module",
   "main": "lib/index.js",