dsh-mcp 1.2.0 → 1.4.0

package/CHANGELOG.en.md

@@ -7,6 +7,35 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.0] - 2026-08-16
+
+### Added
+
+- **Process-level environment variables**: a new "Process env vars" section on Settings → MCP holds a global key-value list shared by every server (expanded by default, with batch-add and a load-failure retry); secret values are stored in the credentials document, a blank value keeps the stored one
+- **Header env substitution**: `streamable-http` header values support `${ENV}` placeholders and bare variable names, resolved at connect time from the server's configured env (including secrets from the credentials document), the process-level env table, or the process environment (e.g. `Authorization: Bearer ${TOKEN}`); unmatched placeholders stay literal so a missing variable never silently empties a header
+- **JSON editor for the whole MCP server list**: a new "JSON config editor" panel on Settings → MCP views and edits every server definition as one JSON array (serverName / transport / enabled / url / command / args / cwd / headers / timeout / failOnStartupError / env); applying replaces the whole list — listed servers are created or updated, existing servers absent from the document are removed (new host `upsertJson` batch method; Apply saves directly), and the server list and tool list refresh automatically afterwards
+- **Page layout**: injection mode on top → env-vars module (expanded by default) → MCP config module; the add/edit server form renders inline above the list or below the edited row (the list stays visible); opening the JSON config panel hides the UI list and applying it restores the list
+- **The server form no longer edits env vars** (managed by the process-level module): saving submits no env and leaves existing server env untouched (the JSON config editor can still replace env wholesale, including stdio child injection)
+- The server list (`list`) now returns non-secret env values with each server so they round-trip through the JSON editor; secret values still live only in the credentials document (exported as a `configured` flag; a blank value keeps the stored one)
+
+### Fixed
+
+- **OAuth no longer re-authorizes after a token refresh fails** (after a JSON save / restart, OAuth servers failed to connect without opening the browser): the OAuth client (client_id) was never persisted — every process re-registered a fresh client, so token refresh was rejected by the server with `client_id mismatch`, and the SDK-required `invalidateCredentials` was missing so the stale token could not be cleared and the retry kept failing. Fixed by persisting the client info alongside the tokens (credentials document) and implementing `invalidateCredentials`, so an unrecoverable failure now starts a fresh browser authorization flow
+- **Form save/test failed with "env is not iterable" when no env was submitted**: the host now guards every `request.env` iteration with `?? []` (omitted env keeps the stored one)
+- **List state did not refresh after applying JSON**: mounting is asynchronous, so the apply now refreshes immediately and again at 2s/6s, settling "Connecting" into "Connected"
+
+## [1.3.0] - 2026-08-16
+
+### Added
+
+- **Windows working-directory support**: stdio servers now accept drive-letter absolute paths for `cwd` (e.g. `C:\Users\...`, `C:/...`), consistent with POSIX `/` and UNC `\\` paths (PR #2, thanks @coding-chong)
+
+### Fixed
+
+- Form operations now surface the real error: save / delete / test-connection failures show `code: message` (e.g. `MCP_SERVER_NAME_CONFLICT: serverName "x" is already used...`) instead of a generic message, making failures diagnosable
+- Refresh is decoupled from save/delete: a `refresh()` failure no longer misreports the save/delete outcome — the editor stays open and shows the refresh failure reason (`refresh()` keeps its try/catch and returns a result)
+- Removed the now-unused `failureLocaleKey` dead code (error display shows `code: message` directly)
+
 ## [1.2.0] - 2026-08-16
 
 ### Added

package/CHANGELOG.md

@@ -7,6 +7,35 @@
 格式基于 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## [1.4.0] - 2026-08-16
+
+### 新增
+
+- **进程级环境变量**：Settings → MCP 页新增「进程环境变量」配置区（全局 KV，跨所有服务器，默认展开，支持批量添加与加载失败重试）；secret 值写入凭据文档，留空保留原值
+- **请求头环境变量替换**：`streamable-http` 服务器的请求头 value 支持 `${ENV}` 占位符与裸变量名，连接时按服务器 env（含 secret）、进程级环境变量、系统环境变量依次替换（如 `Authorization: Bearer ${TOKEN}`）；未匹配的占位符原样保留，避免误清空
+- **JSON 维护服务器配置列表**：Settings → MCP 页新增「JSON 维护配置」面板，以纯 JSON 数组查看/编辑**全部 MCP 服务器配置**（serverName / transport / enabled / url / command / args / cwd / headers / 超时 / failOnStartupError / env）；应用时按列表全量替换——已列出的服务器创建或更新、未列出的删除（host 新增 `upsertJson` 批量方法，点应用直接保存），保存后自动刷新服务器列表与工具列表
+- **页面布局重构**：注入模式置顶 → 环境变量模块（默认展开）→ MCP 配置模块；添加/编辑服务器表单内联展示在列表上方或对应行下方（列表始终可见）；JSON 配置面板展开时隐藏 UI 列表，应用后自动恢复
+- **服务器表单不再编辑环境变量**（由进程级环境变量统一管理）：表单保存不提交 env，已有服务器 env 保持不变；JSON 配置编辑器仍可全量编辑服务器 env（含 stdio 子进程注入）
+- 服务器列表导出（`list`）中的非 secret 环境变量值随配置返回，可随 JSON 往返编辑；secret 值仍只存凭据文档（导出仅 `configured` 标记，留空保留原值）
+
+### 修复
+
+- **OAuth token 刷新失效后不再触发授权**（JSON 保存/重启后 OAuth 服务器连接失败且不弹浏览器）：根因是 OAuth client（client_id）未持久化——每次进程重新动态注册新 client，token 刷新被服务器以 `client_id mismatch` 拒绝，且 SDK 要求的 `invalidateCredentials` 未实现导致 token 无法清除、重试仍失败。修复：client 信息随 token 持久化（凭据文档），并实现 `invalidateCredentials`，失效后自动进入新的浏览器授权流程
+- **表单保存/测试在未提交 env 时误报 "env is not iterable"**：host 对 `request.env` 的所有迭代补 `?? []` 兜底（未提交则保留已有 env）
+- **JSON 应用后列表状态未刷新**：挂载为异步，应用后立即刷新并追加 2s/6s 延迟刷新，「连接中」自动变为「已连接」
+
+## [1.3.0] - 2026-08-16
+
+### 新增
+
+- **Windows 工作目录支持**：stdio 服务器的 cwd 接受 Windows 盘符绝对路径（如 `C:\Users\...`、`C:/...`），与 POSIX `/`、UNC `\\` 路径一致（PR #2，感谢 @coding-chong）
+
+### 修复
+
+- 表单操作失败时展示真实错误信息：保存 / 删除 / 测试连接失败不再只显示笼统文案，直接展示 `code: message`（如 `MCP_SERVER_NAME_CONFLICT: serverName "x" is already used...`），便于定位问题
+- 刷新与保存/删除解耦：`refresh()` 失败不再误报保存结果，停留编辑页并显示刷新失败原因（`refresh()` 保留 try/catch 并返回结果）
+- 清理死代码：移除已无引用的 `failureLocaleKey`（错误展示改为直接显示 `code: message`）
+
 ## [1.2.0] - 2026-08-16
 
 ### 新增

package/README.en.md

@@ -15,10 +15,12 @@
 **Highlights:**
 
 - **Visual management**: server list / create / edit / delete / test connection / enable-disable / refresh, all in the UI
+- **Process-level environment variables**: a global key-value list (expanded by default, batch-add supported); header values can reference a variable by bare name or `${NAME}` and are substituted at connect time (e.g. `Authorization: Bearer ${TOKEN}`)
+- **Whole-list JSON config**: the "JSON config editor" panel views/edits every server as one JSON array; applying saves immediately (create/update/delete)
 - **Fine-grained tool control**: expand each server to see its tools, all checked by default; uncheck to load only what you need
 - **Two injection modes**: `search` (on-demand, token-saving) and `full` (inject everything)
 - **Zero npm dependencies**: plugs into DeepSeek Harness internals, install and go
-- **OAuth authentication**: for `streamable-http` servers using MCP OAuth (authorization-code + PKCE), the browser opens automatically for authorization on connect; tokens are persisted and refreshed automatically by the SDK (auto-renewed while active within 24h)
+- **OAuth authentication**: for `streamable-http` servers using MCP OAuth (authorization-code + PKCE), the browser opens automatically for authorization on connect; tokens and OAuth client info are persisted and refreshed automatically by the SDK (auto-renewed while active within 24h), with automatic re-authorization after expiry
 - **Three install paths**: npm / GitHub git source / local link; bilingual UI and docs
 
 Migrated and merged from uncommitted MCP work in the `deepseek-harness` repository:
@@ -125,20 +127,36 @@ Then **restart `dsh web`** (client roster changes require a restart); afterwards
 
 **Add a server**:
 
-1. Click **Add server**.
+1. Click **Add server** (the form expands inline above the list).
 2. Fill in: server name (`serverName`, determines the tool prefix `mcp__<serverName>__`), transport
    (`streamable-http` → URL / `stdio` → command), headers, tool-call timeout, etc.
 3. Click **Test connection** to verify connectivity and the tool list, then **Save**.
 
+**Process env vars** (below the injection mode, expanded by default):
+
+- Configure global key-value pairs referenced by every server's header substitution;
+  secret values are stored in the credentials document, a blank value keeps the stored one
+- Batch-add (paste one `NAME=value` per line) or add rows one by one
+- A header value can reference a variable by **bare name** or **`${NAME}`** (e.g. `Authorization: Bearer ${GITLAB_TOKEN}`),
+  substituted at connect time (priority: server env > process-level env > system environment)
+
+**JSON config editor** (top-right of the MCP config module):
+
+- View/edit every server definition as one JSON array; applying replaces the whole list
+  (create/update/delete) and refreshes the list and tool list automatically;
+  the UI list is hidden while the JSON panel is open and restored after applying
+- Server-level env (secret flags and stdio child injection) is still maintained through the JSON editor
+
 **OAuth servers** (`streamable-http` using MCP OAuth, e.g. OAuth-protected gateway services):
 
 - Just fill in the URL and test the connection; when the server responds with a 401 + OAuth challenge,
   the plugin **opens the browser automatically** for authorization.
 - Log in / approve in the browser and return to DSH; the test result refreshes automatically
   ("connection succeeded + tool count").
-- Tokens are persisted in the credentials document (scoped by `serverName`) and refreshed automatically
-  by the MCP SDK (auto-renewed while active within 24h); after authorizing once, mounts and later
-  test connections reuse the same token — no repeated authorization.
+- Tokens and the registered OAuth client are persisted in the credentials document (scoped by `serverName`)
+  and refreshed automatically by the MCP SDK (auto-renewed while active within 24h); after authorizing once,
+  mounts and later test connections reuse the same token, and an expired token triggers a fresh
+  browser authorization automatically.
 - The first authorization needs browser interaction, so the test/connect wait budget is relaxed to
   5 minutes; non-OAuth servers are unaffected and fail fast.
 

package/README.md

@@ -17,10 +17,12 @@
 **功能优势：**
 
 - **可视化管理**：服务器列表 / 新建 / 编辑 / 删除 / 测试连接 / 启停 / 刷新，全 UI 操作
+- **进程级环境变量**：全局 KV 配置（默认展开、支持批量添加），服务器请求头 value 写 `变量名` 或 `${变量名}` 即可在连接时自动替换为配置值（如 `Authorization: Bearer ${TOKEN}`）
+- **JSON 全量配置**：「JSON 维护配置」面板以一段 JSON 数组查看/编辑全部服务器配置，应用即保存（新增/更新/删除）
 - **工具级精细控制**：每个服务器展开工具列表，默认全选，可取消勾选只加载需要的部分
 - **双注入模式**：`search`（按需检索，省 token）与 `full`（全量注入）
 - **零 npm 依赖**：直接对接 DeepSeek Harness 内部能力，安装即用
-- **OAuth 认证支持**：`streamable-http` 服务器若走 MCP OAuth（授权码 + PKCE），连接时自动打开浏览器授权；token 持久化、由 SDK 自动刷新（24 小时内活跃自动续期）
+- **OAuth 认证支持**：`streamable-http` 服务器若走 MCP OAuth（授权码 + PKCE），连接时自动打开浏览器授权；token 与 client 信息持久化、由 SDK 自动刷新（24 小时内活跃自动续期），失效后自动重新授权
 - **三种安装方式**：npm / GitHub git 源 / 本地 link；中英文界面与文档
 
 ## 功能
@@ -112,17 +114,30 @@ dsh plugin --profile web add link:<本仓库绝对路径>
 
 **添加服务器**：
 
-1. 点击「添加服务器」
+1. 点击「添加服务器」（表单在列表上方就地展开）
 2. 填写：服务器名称（`serverName`，决定工具前缀 `mcp__<serverName>__`）、传输方式
    （`streamable-http` 填 URL / `stdio` 填命令）、请求头、工具调用超时等
 3. 点「测试连接」确认连通性与工具列表，点「保存」
 
+**进程环境变量**（注入模式下方，默认展开）：
+
+- 配置全局键值对，供所有服务器的请求头替换引用；secret 值写入凭据文档，留空保留原值
+- 支持「批量添加」（粘贴多行 `NAME=value`）与「添加变量」逐行添加
+- 服务器请求头 value 可直接写**变量名**或 **`${变量名}`**（如 `Authorization: Bearer ${GITLAB_TOKEN}`），
+  连接时自动替换（优先级：服务器 env > 进程级 env > 系统环境变量）
+
+**JSON 维护配置**（MCP 配置模块右上角）：
+
+- 以一段 JSON 数组查看/编辑**全部服务器配置**；应用后按列表全量替换（新增/更新/删除），
+  自动刷新列表与工具列表；JSON 面板展开时隐藏 UI 列表，应用后恢复
+- 服务器级 env（含 secret 标记与 stdio 子进程注入）仍通过 JSON 配置维护
+
 **OAuth 服务器**（`streamable-http` 走 MCP OAuth，如受 OAuth 保护的网关服务）：
 
 - 只需正常填写 URL 并测试连接；服务器返回 401 + OAuth 挑战时，插件**自动打开浏览器**完成授权
 - 在浏览器中登录/同意后返回 DSH，测试结果自动刷新（「连接成功 + 工具数」）
-- token 持久化在凭据文档（按 `serverName` 隔离），由 MCP SDK 自动刷新（24 小时内活跃自动续期）；
-  授权一次后，挂载连接与后续测试连接复用同一份 token，无需重复授权
+- token 与 OAuth client 信息持久化在凭据文档（按 `serverName` 隔离），由 MCP SDK 自动刷新
+  （24 小时内活跃自动续期）；失效后自动重新授权，授权一次后挂载与测试复用
 - 首次授权需浏览器交互，测试/连接等待时间放宽至 5 分钟；非 OAuth 服务器不受影响，连接失败即时返回
 
 **日常管理**：