dsh-mcp 1.3.0 → 1.4.0

package/lib/index.js

@@ -81,8 +81,16 @@ const mcpServersDomainSpec = defineDomain({
 			});
 			envNames.add(entry.name);
 		});
-	})) }
-});
+	})) ,
+	// Process-level environment variables: shared by every server's header
+	// substitution. Plain values live here; secret values are stored in the
+	// credentials document under DSH_MCP_ENV_<name>.
+	global_env: domainTable(z$1.object({
+		name: envVarNameSchema,
+		secret: z$1.boolean(),
+		value: z$1.string().default("")
+	}))
+} });
 /** Thrown by {@link validateServerInput}; the service maps it to `MCP_INVALID_SPEC`. */
 var McpServerValidationError = class extends Error {
 	/** Discriminates validation failures from internal errors at the Remote boundary. */
@@ -159,6 +167,49 @@ function toServerRow(id, server, env) {
 		failOnStartupError: server.failOnStartupError
 	};
 }
+/**
+* Normalize a JSON-editor header value into the wire header-array shape.
+* Accepts `{ "Name": "value" }` or `[{name, value}]`; anything else yields
+* an empty header set.
+* @param headers - The submitted headers.
+* @returns The wire header array.
+*/
+function normalizeHeaders(headers) {
+	if (Array.isArray(headers)) return headers.map((header) => ({
+		name: String(header?.name ?? ""),
+		value: String(header?.value ?? "")
+	}));
+	if (headers !== null && typeof headers === "object") return Object.entries(headers).map(([name, value]) => ({
+		name,
+		value: String(value ?? "")
+	}));
+	return [];
+}
+/**
+* Substitute `${NAME}` placeholders and bare variable names in one header
+* value. Resolution order per variable: the server's resolved env (including
+* secrets), then the process-level env table, then the process environment.
+* A bare value that exactly matches a configured variable name is treated as
+* a reference to that variable. Unresolved placeholders stay literal so a
+* missing variable never silently empties a header.
+* @param value - The stored header value (may contain `${NAME}` tokens or be a bare variable name).
+* @param env - The server's resolved environment variables.
+* @param globalEnv - The process-level environment variables.
+* @returns The header value with known variables substituted.
+*/
+function interpolateEnv(value, env, globalEnv) {
+	const text = String(value);
+	const substituted = text.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (match, name) => {
+		if (env !== null && typeof env === "object" && env[name] !== void 0 && env[name] !== "") return env[name];
+		if (globalEnv !== null && typeof globalEnv === "object" && globalEnv[name] !== void 0 && globalEnv[name] !== "") return globalEnv[name];
+		if (process.env[name] !== void 0 && process.env[name] !== "") return process.env[name];
+		return match;
+	});
+	const trimmed = substituted.trim();
+	if (env !== null && typeof env === "object" && env[trimmed] !== void 0 && env[trimmed] !== "") return env[trimmed];
+	if (globalEnv !== null && typeof globalEnv === "object" && globalEnv[trimmed] !== void 0 && globalEnv[trimmed] !== "") return globalEnv[trimmed];
+	return substituted;
+}
 //#endregion
 //#region lib/types/index.js
 /**
@@ -213,6 +264,8 @@ var __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializ
 };
 /** Credential reference namespace prefix for secret env values. */
 const SECRET_REF_PREFIX = "DSH_MCP_";
+/** Credential reference namespace prefix for process-level secret env values. */
+const GLOBAL_ENV_REF_PREFIX = "DSH_MCP_ENV_";
 const Config = z.object({ probeTimeoutMs: z.number().min(1).default(15e3) });
 /** The mcp-client plugin as a Cordis object plugin, mounted per server. */
 const MCP_CLIENT_PLUGIN = {
@@ -242,6 +295,10 @@ function managedServerId(ref) {
 function secretRef(id, name) {
 	return credentialRef(`${SECRET_REF_PREFIX}${id}_${name}`);
 }
+/** Credential reference holding one process-level secret env value. */
+function globalEnvRef(name) {
+	return credentialRef(`${GLOBAL_ENV_REF_PREFIX}${name}`);
+}
 /** Brand a fresh random server id at the minting boundary. */
 function mintServerId(existing) {
 	for (let attempt = 0; attempt < 10; attempt += 1) {
@@ -259,21 +316,27 @@ let McpManagerService = (() => {
 	let _instanceExtraInitializers = [];
 	let _list_decorators;
 	let _upsert_decorators;
+	let _upsertJson_decorators;
 	let _delete_decorators;
 	let _test_decorators;
 	let _toolsList_decorators;
 	let _toolsSet_decorators;
 	let _toolsMode_decorators;
+	let _envList_decorators;
+	let _envSet_decorators;
 	return class McpManagerService extends _classSuper {
 		static {
 			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
 			_list_decorators = [Remote("list")];
 			_upsert_decorators = [Remote("upsert")];
+			_upsertJson_decorators = [Remote("upsertJson")];
 			_delete_decorators = [Remote("delete")];
 			_test_decorators = [Remote("test")];
 			_toolsList_decorators = [Remote("toolsList")];
 			_toolsSet_decorators = [Remote("toolsSet")];
 			_toolsMode_decorators = [Remote("toolsMode")];
+			_envList_decorators = [Remote("envList")];
+			_envSet_decorators = [Remote("envSet")];
 			__esDecorate(this, null, _list_decorators, {
 				kind: "method",
 				name: "list",
@@ -307,6 +370,17 @@ let McpManagerService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _upsertJson_decorators, {
+				kind: "method",
+				name: "upsertJson",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "upsertJson" in obj,
+					get: (obj) => obj.upsertJson
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _test_decorators, {
 				kind: "method",
 				name: "test",
@@ -351,6 +425,28 @@ let McpManagerService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _envList_decorators, {
+				kind: "method",
+				name: "envList",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "envList" in obj,
+					get: (obj) => obj.envList
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _envSet_decorators, {
+				kind: "method",
+				name: "envSet",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "envSet" in obj,
+					get: (obj) => obj.envSet
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			if (_metadata) Object.defineProperty(this, Symbol.metadata, {
 				enumerable: true,
 				configurable: true,
@@ -396,6 +492,7 @@ let McpManagerService = (() => {
 				await domain.close();
 			}, "mcp-manager.domainClose");
 			this.table = domain.table("servers");
+			this.envTable = domain.table("global_env");
 			for (const [id, row] of this.table.entries()) if (row.enabled) this.mount(id, row);
 			this.installToolControl();
 			this.ctx.on("credentials/updated", (ref) => {
@@ -417,6 +514,11 @@ let McpManagerService = (() => {
 			if (this.table === void 0) throw new Error("mcp-manager: storage domain is not open");
 			return this.table;
 		}
+		/** Resolve the process-level env table after the domain is open. */
+		requireEnvTable() {
+			if (this.envTable === void 0) throw new Error("mcp-manager: storage domain is not open");
+			return this.envTable;
+		}
 		/** Resolve the full env map for one row: plain values plus credentials. */
 		async resolveEnv(row) {
 			const env = {};
@@ -426,8 +528,17 @@ let McpManagerService = (() => {
 			} else if (entry.value !== void 0) env[entry.name] = entry.value;
 			return env;
 		}
+		/** Resolve the process-level env map: plain table values plus credentials. */
+		async resolveGlobalEnv() {
+			const env = {};
+			for (const [name, row] of this.requireEnvTable().entries()) if (row.secret) {
+				const hit = await this.ctx.credentials.resolve(globalEnvRef(name));
+				if (hit !== void 0) env[name] = hit.value;
+			} else if (row.value !== void 0) env[name] = row.value;
+			return env;
+		}
 		/** Map a server spec + resolved env to the mcp-client plugin config. */
-		toClientConfig(spec, env) {
+		toClientConfig(spec, env, globalEnv) {
 			if (spec.transport === "stdio") return {
 				transport: "stdio",
 				serverName: spec.serverName,
@@ -442,7 +553,10 @@ let McpManagerService = (() => {
 				transport: "streamable-http",
 				serverName: spec.serverName,
 				url: spec.url,
-				headers: Object.fromEntries(spec.headers.map((header) => [header.name, header.value])),
+				// Header values support `${ENV}` placeholders and bare variable
+				// names resolved from the server's env (including secrets), the
+				// process-level env table, or the process environment.
+				headers: Object.fromEntries(spec.headers.map((header) => [header.name, interpolateEnv(header.value, env, globalEnv)])),
 				toolCallTimeoutMs: spec.toolCallTimeoutMs,
 				failOnStartupError: spec.failOnStartupError
 			};
@@ -465,13 +579,14 @@ let McpManagerService = (() => {
 				let handle;
 				try {
 					const env = await this.resolveEnv(row);
+					const globalEnv = await this.resolveGlobalEnv();
 					// Every server gets an OAuth provider: servers that require
 					// OAuth (authorization-code flow) trigger browser auth on
 					// connect; servers that do not are unaffected. Tokens are
 					// keyed by serverName so a test-connection authorization is
 					// reused by the mount.
 					const authProvider = createOAuthProvider(row.serverName, this.ctx);
-					handle = this.ctx.plugin(MCP_CLIENT_PLUGIN, { ...this.toClientConfig(row, env), authProvider });
+					handle = this.ctx.plugin(MCP_CLIENT_PLUGIN, { ...this.toClientConfig(row, env, globalEnv), authProvider });
 				} catch (error) {
 					entry.phase = "failed";
 					entry.error = errorText(error);
@@ -522,7 +637,10 @@ let McpManagerService = (() => {
 				env.push({
 					name: entry.name,
 					secret: entry.secret,
-					configured
+					configured,
+					// Non-secret values round-trip through the JSON editor; secret
+					// values stay in the credentials document (blank keeps them).
+					...entry.secret ? {} : { value: entry.value ?? "" }
 				});
 			}
 			return {
@@ -578,7 +696,7 @@ let McpManagerService = (() => {
 		async upsert(request) {
 			const table = this.requireTable();
 			try {
-				validateServerInput(request.server, request.env);
+				validateServerInput(request.server, request.env ?? []);
 			} catch (error) {
 				if (error instanceof McpServerValidationError) return {
 					ok: false,
@@ -602,8 +720,14 @@ let McpManagerService = (() => {
 				}
 			};
 			const previous = table.get(id);
-			await this.applyEnv(id, previous, request.env);
-			const row = toServerRow(id, request.server, request.env);
+			// The settings form no longer edits env (process-level env vars are
+			// managed separately); when env is not submitted, keep the stored
+			// env untouched. The JSON editor still submits env to replace it.
+			const envInputs = request.env === void 0
+				? (previous?.env ?? []).map((entry) => ({ ...entry }))
+				: request.env;
+			await this.applyEnv(id, previous, envInputs);
+			const row = toServerRow(id, request.server, envInputs);
 			await table.put(id, row);
 			await this.serialize(id, () => this.reconcileMount(id));
 			return {
@@ -655,6 +779,190 @@ let McpManagerService = (() => {
 			return { ok: true };
 		}
 		/**
+		* Replace the whole server list from one JSON document (JSON editor
+		* path). Entries are matched by serverName: listed ones are created or
+		* updated, existing servers absent from the document are removed.
+		* Secret env values are never submitted back — a blank value keeps the
+		* stored one (same semantics as a single upsert).
+		* @param request - The full desired server list.
+		* @returns change counts plus the refreshed server list, or a failure.
+		*/
+		async upsertJson(request) {
+			const items = request?.servers;
+			if (!Array.isArray(items) || items.length === 0) {
+				return {
+					ok: false,
+					error: {
+						code: "MCP_INVALID_SPEC",
+						message: "servers must be a non-empty array of { server, env } entries"
+					}
+				};
+			}
+			const table = this.requireTable();
+			// Normalize and validate every entry up front so a bad document
+			// never partially applies.
+			const normalized = [];
+			const seen = /* @__PURE__ */ new Set();
+			for (const item of items) {
+				if (item === null || typeof item !== "object" || item.server === null || typeof item.server !== "object") {
+					return {
+						ok: false,
+						error: {
+							code: "MCP_INVALID_SPEC",
+							message: "each entry must be an object with a server definition"
+						}
+					};
+				}
+				const env = Array.isArray(item.env) ? item.env : [];
+				const spec = {
+					serverName: item.server.serverName,
+					transport: item.server.transport,
+					enabled: item.server.enabled !== false,
+					command: typeof item.server.command === "string" ? item.server.command : "",
+					args: Array.isArray(item.server.args) ? item.server.args : [],
+					cwd: typeof item.server.cwd === "string" ? item.server.cwd : "",
+					url: typeof item.server.url === "string" ? item.server.url : "",
+					headers: normalizeHeaders(item.server.headers),
+					toolCallTimeoutMs: Number.isInteger(item.server.toolCallTimeoutMs) ? item.server.toolCallTimeoutMs : 60e3,
+					failOnStartupError: item.server.failOnStartupError !== false
+				};
+				try {
+					validateServerInput(spec, env);
+				} catch (error) {
+					if (error instanceof McpServerValidationError) return {
+						ok: false,
+						error: {
+							code: "MCP_INVALID_SPEC",
+							message: `${spec.serverName}: ${error.message}`
+						}
+					};
+					throw error;
+				}
+				if (seen.has(spec.serverName)) return {
+					ok: false,
+					error: {
+						code: "MCP_SERVER_NAME_CONFLICT",
+						message: `duplicate serverName "${spec.serverName}" in the JSON document`
+					}
+				};
+				seen.add(spec.serverName);
+				normalized.push({ server: spec, env });
+			}
+			const byName = /* @__PURE__ */ new Map();
+			for (const [id, row] of table.entries()) byName.set(row.serverName, { id, row });
+			let added = 0;
+			let updated = 0;
+			for (const { server, env } of normalized) {
+				const existing = byName.get(server.serverName);
+				const id = existing?.id ?? mintServerId(new Set(table.keys()));
+				await this.applyEnv(id, existing?.row, env);
+				const row = toServerRow(id, server, env);
+				await table.put(id, row);
+				await this.serialize(id, () => this.reconcileMount(id));
+				if (existing === void 0) added += 1;
+				else updated += 1;
+			}
+			let removed = 0;
+			for (const [id, row] of table.entries()) {
+				if (seen.has(row.serverName)) continue;
+				await this.serialize(id, async () => {
+					await this.disposeMount(id);
+					await table.delete(id);
+				});
+				for (const entry of row.env) if (entry.secret) await this.ctx.credentials.unset(secretRef(id, entry.name));
+				removed += 1;
+			}
+			const listed = await this.list();
+			return {
+				ok: true,
+				added,
+				updated,
+				removed,
+				servers: listed.servers
+			};
+		}
+		/**
+		* Read the process-level environment variables (plain values from the env
+		* table, secret flags and configured state from the credentials document).
+		* Used as the header-substitution source for every server.
+		* @returns the current process-level env rows.
+		*/
+		async envList() {
+			const table = this.requireEnvTable();
+			const vars = [];
+			for (const [name, row] of table.entries()) {
+				const configured = row.secret ? (await this.ctx.credentials.describe(globalEnvRef(name))).configured : (row.value ?? "").length > 0;
+				vars.push({
+					name,
+					secret: row.secret,
+					configured,
+					...row.secret ? {} : { value: row.value ?? "" }
+				});
+			}
+			return { ok: true, vars };
+		}
+		/**
+		* Replace the whole process-level env table from one submission. Secret
+		* values go to the credentials document; a blank secret value keeps the
+		* stored one.
+		* @param request - The full desired process-level env rows.
+		* @returns the refreshed env list, or a failure.
+		*/
+		async envSet(request) {
+			const inputs = request?.vars;
+			if (!Array.isArray(inputs)) {
+				return {
+					ok: false,
+					error: {
+						code: "MCP_INVALID_SPEC",
+						message: "vars must be an array of { name, secret, value? }"
+					}
+				};
+			}
+			const table = this.requireEnvTable();
+			const names = /* @__PURE__ */ new Set();
+			for (const entry of inputs) {
+				if (!envVarNameSchema.safeParse(entry?.name).success) {
+					return {
+						ok: false,
+						error: {
+							code: "MCP_INVALID_SPEC",
+							message: `environment variable name '${String(entry?.name ?? "")}' must be a POSIX identifier`
+						}
+					};
+				}
+				if (names.has(entry.name)) {
+					return {
+						ok: false,
+						error: {
+							code: "MCP_INVALID_SPEC",
+							message: `duplicate environment variable '${entry.name}'`
+						}
+					};
+				}
+				names.add(entry.name);
+			}
+			// Unset secrets no longer present.
+			for (const [name, row] of table.entries()) if (row.secret && !names.has(name)) await this.ctx.credentials.unset(globalEnvRef(name));
+			// Rewrite the table and secrets.
+			for (const name of [...table.entries()].map(([key]) => key)) await table.delete(name);
+			for (const entry of inputs) {
+				if (entry.secret === true && entry.value !== void 0 && entry.value.length > 0) {
+					await this.ctx.credentials.set(globalEnvRef(entry.name), entry.value);
+				}
+				await table.put(entry.name, {
+					name: entry.name,
+					secret: entry.secret === true,
+					value: entry.secret === true ? "" : String(entry.value ?? "")
+				});
+			}
+			const listed = await this.envList();
+			return {
+				ok: true,
+				vars: listed.vars
+			};
+		}
+		/**
 		* Probe one server configuration without persisting or mounting anything.
 		* Secret env values resolve from the submitted values, or from the stored
 		* credentials when the request carries an existing server id.
@@ -664,7 +972,7 @@ let McpManagerService = (() => {
 		*/
 		async test(request) {
 			try {
-				validateServerInput(request.server, request.env);
+				validateServerInput(request.server, request.env ?? []);
 			} catch (error) {
 				if (error instanceof McpServerValidationError) return {
 					ok: true,
@@ -677,7 +985,7 @@ let McpManagerService = (() => {
 				throw error;
 			}
 			const env = {};
-			for (const entry of request.env) if (entry.secret) {
+			for (const entry of request.env ?? []) if (entry.secret) {
 				if (entry.value !== void 0 && entry.value.length > 0) env[entry.name] = entry.value;
 				else if (request.id !== void 0) {
 					const hit = await this.ctx.credentials.resolve(secretRef(request.id, entry.name));
@@ -688,7 +996,8 @@ let McpManagerService = (() => {
 			// Test connection also supports OAuth: an OAuth-protected server
 			// opens the browser for authorization and the probe continues after
 			// tokens are stored (keyed by serverName, matching the mount path).
-			const probe = await probeConnection(this.toClientConfig(request.server, env), {
+			const globalEnv = await this.resolveGlobalEnv();
+			const probe = await probeConnection(this.toClientConfig(request.server, env, globalEnv), {
 				timeoutMs: this.probeTimeoutMs,
 				authProvider: createOAuthProvider(request.server.serverName, this.ctx)
 			});

package/lib/oauth.js

@@ -22,6 +22,9 @@ import { credentialRef } from "@deepseek-ai/dsh-credentials";
 /** Credential reference namespace prefix for per-server OAuth tokens. */
 const OAUTH_REF_PREFIX = "DSH_MCP_OAUTH_";
 
+/** Credential reference namespace prefix for per-server OAuth client info. */
+const OAUTH_CLIENT_REF_PREFIX = "DSH_MCP_OAUTH_CLIENT_";
+
 /** Short stable hash so sanitized server ids cannot collide. */
 function shortHash(value) {
   let hash = 0;
@@ -32,16 +35,24 @@ function shortHash(value) {
 }
 
 /**
- * One server's OAuth token credential reference.
- *
  * Credential ref names must match /^[A-Za-z_][A-Za-z0-9_]*$/, but managed
  * server ids may contain hyphens, slashes, spaces, etc.; sanitize the id and
  * append a short stable hash of the original so distinct ids cannot collide
  * (e.g. "a-b" and "a_b").
  */
-function oauthTokenRef(serverId) {
+function oauthRef(prefix, serverId) {
   const safe = serverId.replace(/[^A-Za-z0-9_]/g, "_");
-  return credentialRef(`${OAUTH_REF_PREFIX}${safe}_${shortHash(serverId)}`);
+  return credentialRef(`${prefix}${safe}_${shortHash(serverId)}`);
+}
+
+/** One server's OAuth token credential reference. */
+function oauthTokenRef(serverId) {
+  return oauthRef(OAUTH_REF_PREFIX, serverId);
+}
+
+/** One server's registered OAuth client credential reference. */
+function oauthClientRef(serverId) {
+  return oauthRef(OAUTH_CLIENT_REF_PREFIX, serverId);
 }
 
 /** Open the system browser to one URL, best effort. */
@@ -78,10 +89,40 @@ export function createOAuthProvider(serverId, ctx) {
       redirect_uris: [redirectUrl],
     },
     async clientInformation() {
-      return savedClientInfo;
+      if (savedClientInfo !== null) return savedClientInfo;
+      const hit = await ctx.credentials.resolve(oauthClientRef(serverId));
+      if (hit === undefined) return undefined;
+      try {
+        return JSON.parse(hit.value);
+      } catch {
+        return undefined;
+      }
     },
     async saveClientInformation(info) {
       savedClientInfo = info;
+      // Persist the registered client (client_id) with the tokens so a later
+      // token refresh uses the same client. Without this, every process
+      // re-registers a fresh client and the server rejects refresh with
+      // "client_id mismatch".
+      if (info === undefined || info === null) {
+        await ctx.credentials.unset(oauthClientRef(serverId));
+      } else {
+        await ctx.credentials.set(oauthClientRef(serverId), JSON.stringify(info));
+      }
+    },
+    async invalidateCredentials(credentialType) {
+      // The SDK calls this when a refresh/registration fails with an
+      // unrecoverable error (InvalidClient / UnauthorizedClient / InvalidGrant)
+      // so the next attempt starts a fresh authorization flow. Clearing the
+      // stored tokens is what lets that flow actually open the browser again.
+      if (credentialType === undefined || credentialType === "all" || credentialType === "tokens") {
+        await ctx.credentials.unset(oauthTokenRef(serverId));
+      }
+      if (credentialType === undefined || credentialType === "all") {
+        savedClientInfo = null;
+        await ctx.credentials.unset(oauthClientRef(serverId));
+      }
+      log.info(`${tag}: credentials invalidated (${String(credentialType)})`);
     },
     async tokens() {
       const hit = await ctx.credentials.resolve(oauthTokenRef(serverId));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "MCP 管理界面 + tool search：可视化配置/启停/刷新 MCP 服务器与工具勾选，按需检索（tool search）热注入；工具列表稳定命中缓存、不撑爆上下文。DeepSeek Harness plugin: MCP management UI + tool search — stable tool list, cache-friendly, no context bloat.",
   "type": "module",
   "main": "lib/index.js",