dsh-mcp 1.3.0 → 1.5.0

package/lib/oauth.js

@@ -22,6 +22,9 @@ import { credentialRef } from "@deepseek-ai/dsh-credentials";
 /** Credential reference namespace prefix for per-server OAuth tokens. */
 const OAUTH_REF_PREFIX = "DSH_MCP_OAUTH_";
 
+/** Credential reference namespace prefix for per-server OAuth client info. */
+const OAUTH_CLIENT_REF_PREFIX = "DSH_MCP_OAUTH_CLIENT_";
+
 /** Short stable hash so sanitized server ids cannot collide. */
 function shortHash(value) {
   let hash = 0;
@@ -32,16 +35,24 @@ function shortHash(value) {
 }
 
 /**
- * One server's OAuth token credential reference.
- *
  * Credential ref names must match /^[A-Za-z_][A-Za-z0-9_]*$/, but managed
  * server ids may contain hyphens, slashes, spaces, etc.; sanitize the id and
  * append a short stable hash of the original so distinct ids cannot collide
  * (e.g. "a-b" and "a_b").
  */
-function oauthTokenRef(serverId) {
+function oauthRef(prefix, serverId) {
   const safe = serverId.replace(/[^A-Za-z0-9_]/g, "_");
-  return credentialRef(`${OAUTH_REF_PREFIX}${safe}_${shortHash(serverId)}`);
+  return credentialRef(`${prefix}${safe}_${shortHash(serverId)}`);
+}
+
+/** One server's OAuth token credential reference. */
+function oauthTokenRef(serverId) {
+  return oauthRef(OAUTH_REF_PREFIX, serverId);
+}
+
+/** One server's registered OAuth client credential reference. */
+function oauthClientRef(serverId) {
+  return oauthRef(OAUTH_CLIENT_REF_PREFIX, serverId);
 }
 
 /** Open the system browser to one URL, best effort. */
@@ -55,6 +66,54 @@ function openBrowser(url) {
   child.unref();
 }
 
+/**
+ * Extract the `exp` claim from a JWT access token, when it is a JWT.
+ * @param accessToken - The access token string.
+ * @returns the expiry epoch seconds, or undefined when not a JWT / no exp.
+ */
+function jwtExp(accessToken) {
+  try {
+    const payload = JSON.parse(
+      Buffer.from(String(accessToken).split(".")[1] ?? "", "base64url").toString("utf8")
+    );
+    return typeof payload.exp === "number" ? payload.exp : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Derive a stable loopback port from the server id. The redirect URI must
+ * stay identical across processes because the registered OAuth client's
+ * redirect_uris are fixed at registration time; a random port per process
+ * would make the authorization server reject the redirect with
+ * `redirect_uri_mismatch`.
+ * @param serverId - Managed server id.
+ * @returns a stable port in [3100, 23099].
+ */
+function stablePort(serverId) {
+  let hash = 0;
+  for (let i = 0; i < serverId.length; i += 1) {
+    hash = (hash * 31 + serverId.charCodeAt(i)) >>> 0;
+  }
+  return 3100 + (hash % 20000);
+}
+
+/**
+ * Serialize authorization flows per server: the loopback port is stable per
+ * server, so two concurrent flows (e.g. mount and a test connection) would
+ * both try to listen on the same port and one fails with EADDRINUSE. Queue
+ * them so only one browser authorization runs at a time per server.
+ */
+const authLocks = /* @__PURE__ */ new Map();
+
+function withAuthLock(serverId, fn) {
+  const previous = authLocks.get(serverId) ?? Promise.resolve();
+  const run = previous.then(fn, fn);
+  authLocks.set(serverId, run.then(() => {}, () => {}));
+  return run;
+}
+
 /**
  * Build one OAuthClientProvider for a managed server.
  * @param serverId - Managed server id; keys the stored token.
@@ -64,7 +123,7 @@ function openBrowser(url) {
 export function createOAuthProvider(serverId, ctx) {
   let codeVerifierValue = null;
   let savedClientInfo = null;
-  const port = 3100 + Math.floor(Math.random() * 20000);
+  const port = stablePort(serverId);
   const redirectUrl = `http://127.0.0.1:${port}/callback`;
   const log = ctx?.logger ?? console;
   const tag = `mcp-oauth(${serverId})`;
@@ -78,19 +137,70 @@ export function createOAuthProvider(serverId, ctx) {
       redirect_uris: [redirectUrl],
     },
     async clientInformation() {
-      return savedClientInfo;
+      if (savedClientInfo !== null) return savedClientInfo;
+      const hit = await ctx.credentials.resolve(oauthClientRef(serverId));
+      if (hit === undefined) return undefined;
+      try {
+        const info = JSON.parse(hit.value);
+        // The persisted client's registered redirect_uris must cover this
+        // loopback URI; otherwise the authorization server rejects the
+        // redirect with `redirect_uri_mismatch`. Drop it so the SDK
+        // re-registers a client for the current (stable) redirect URI.
+        if (!Array.isArray(info.redirect_uris) || !info.redirect_uris.includes(redirectUrl)) {
+          log.info(`${tag}: persisted client redirect_uris mismatch, re-registering`);
+          return undefined;
+        }
+        return info;
+      } catch {
+        return undefined;
+      }
     },
     async saveClientInformation(info) {
       savedClientInfo = info;
+      // Persist the registered client (client_id) with the tokens so a later
+      // token refresh uses the same client. Without this, every process
+      // re-registers a fresh client and the server rejects refresh with
+      // "client_id mismatch".
+      if (info === undefined || info === null) {
+        await ctx.credentials.unset(oauthClientRef(serverId));
+      } else {
+        await ctx.credentials.set(oauthClientRef(serverId), JSON.stringify(info));
+      }
+    },
+    async invalidateCredentials(credentialType) {
+      // The SDK calls this when a refresh/registration fails with an
+      // unrecoverable error (InvalidClient / UnauthorizedClient / InvalidGrant)
+      // so the next attempt starts a fresh authorization flow. Clearing the
+      // stored tokens is what lets that flow actually open the browser again.
+      if (credentialType === undefined || credentialType === "all" || credentialType === "tokens") {
+        await ctx.credentials.unset(oauthTokenRef(serverId));
+      }
+      if (credentialType === undefined || credentialType === "all") {
+        savedClientInfo = null;
+        await ctx.credentials.unset(oauthClientRef(serverId));
+      }
+      log.info(`${tag}: credentials invalidated (${String(credentialType)})`);
     },
     async tokens() {
       const hit = await ctx.credentials.resolve(oauthTokenRef(serverId));
       if (hit === undefined) return undefined;
+      let tokens;
       try {
-        return JSON.parse(hit.value);
+        tokens = JSON.parse(hit.value);
       } catch {
         return undefined;
       }
+      // An expired access token makes the SDK try refresh; if the refresh
+      // token is also dead (short-lived servers), the SDK throws
+      // InvalidTokenError and never re-authorizes. Pre-expire it here so the
+      // SDK falls through to a fresh browser authorization flow instead.
+      const exp = jwtExp(tokens.access_token);
+      if (exp !== undefined && Date.now() / 1000 >= exp) {
+        log.info(`${tag}: stored access token expired, clearing for re-authorization`);
+        await ctx.credentials.unset(oauthTokenRef(serverId));
+        return undefined;
+      }
+      return tokens;
     },
     async saveTokens(tokens) {
       await ctx.credentials.set(oauthTokenRef(serverId), JSON.stringify(tokens));
@@ -105,51 +215,61 @@ export function createOAuthProvider(serverId, ctx) {
       return codeVerifierValue;
     },
     async redirectToAuthorization(authorizationUrl) {
-      let resolveResult;
-      const resultPromise = new Promise((resolve) => {
-        resolveResult = resolve;
-      });
-      const server = createServer((req, res) => {
-        const url = new URL(req.url, redirectUrl);
-        const code = url.searchParams.get("code");
-        const error = url.searchParams.get("error");
-        res.setHeader("content-type", "text/html; charset=utf-8");
-        if (error) {
-          res.end(`授权失败：${error}，可关闭此页面并返回 DSH。`);
-          log.error(`${tag}: callback rejected: ${error}`);
-          resolveResult({ error });
-          return;
+      // Serialize per server: the loopback port is stable, so concurrent
+      // flows (mount + test) would collide on the same port. Queue them.
+      return withAuthLock(serverId, async () => {
+        let resolveResult;
+        const resultPromise = new Promise((resolve) => {
+          resolveResult = resolve;
+        });
+        const server = createServer((req, res) => {
+          const url = new URL(req.url, redirectUrl);
+          const code = url.searchParams.get("code");
+          const error = url.searchParams.get("error");
+          res.setHeader("content-type", "text/html; charset=utf-8");
+          if (error) {
+            res.end(`授权失败：${error}，可关闭此页面并返回 DSH。`);
+            log.error(`${tag}: callback rejected: ${error}`);
+            resolveResult({ error });
+            return;
+          }
+          res.end("授权成功，可关闭此页面并返回 DSH。");
+          log.info(`${tag}: authorization callback received (code)`);
+          resolveResult({ code });
+        });
+        await new Promise((resolve) => server.listen(port, "127.0.0.1", resolve));
+        log.info(`${tag}: opening browser for authorization: ${authorizationUrl}`);
+        openBrowser(authorizationUrl.toString());
+        try {
+          const result = await resultPromise;
+          if (result.error) throw new Error(`OAuth 授权失败：${result.error}`);
+          const authServerUrl = new URL(authorizationUrl.origin);
+          log.info(`${tag}: discovering authorization server metadata at ${authServerUrl}`);
+          const metadata = await discoverAuthorizationServerMetadata(authServerUrl);
+          log.info(`${tag}: exchanging authorization code for tokens`);
+          // Use the provider accessors, not the closure fields: when the
+          // client was loaded from persistence the SDK never calls
+          // saveClientInformation, so the closure copy is null and the token
+          // request would lack client_id (CAS: "... are required").
+          const clientInformation = await this.clientInformation();
+          const codeVerifier = await this.codeVerifier();
+          const tokens = await exchangeAuthorization(authServerUrl, {
+            metadata,
+            clientInformation,
+            authorizationCode: result.code,
+            codeVerifier,
+            redirectUri: redirectUrl,
+          });
+          await this.saveTokens(tokens);
+          log.info(`${tag}: tokens saved`);
+        } catch (error) {
+          log.error(`${tag}: OAuth exchange failed: ${error instanceof Error ? error.message : String(error)}`);
+          throw error;
+        } finally {
+          server.close();
+          log.info(`${tag}: callback server closed`);
         }
-        res.end("授权成功，可关闭此页面并返回 DSH。");
-        log.info(`${tag}: authorization callback received (code)`);
-        resolveResult({ code });
       });
-      await new Promise((resolve) => server.listen(port, "127.0.0.1", resolve));
-      log.info(`${tag}: opening browser for authorization: ${authorizationUrl}`);
-      openBrowser(authorizationUrl.toString());
-      try {
-        const result = await resultPromise;
-        if (result.error) throw new Error(`OAuth 授权失败：${result.error}`);
-        const authServerUrl = new URL(authorizationUrl.origin);
-        log.info(`${tag}: discovering authorization server metadata at ${authServerUrl}`);
-        const metadata = await discoverAuthorizationServerMetadata(authServerUrl);
-        log.info(`${tag}: exchanging authorization code for tokens`);
-        const tokens = await exchangeAuthorization(authServerUrl, {
-          metadata,
-          clientInformation: savedClientInfo,
-          authorizationCode: result.code,
-          codeVerifier: codeVerifierValue,
-          redirectUri: redirectUrl,
-        });
-        await this.saveTokens(tokens);
-        log.info(`${tag}: tokens saved`);
-      } catch (error) {
-        log.error(`${tag}: OAuth exchange failed: ${error instanceof Error ? error.message : String(error)}`);
-        throw error;
-      } finally {
-        server.close();
-        log.info(`${tag}: callback server closed`);
-      }
     },
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "MCP 管理界面 + tool search：可视化配置/启停/刷新 MCP 服务器与工具勾选，按需检索（tool search）热注入；工具列表稳定命中缓存、不撑爆上下文。DeepSeek Harness plugin: MCP management UI + tool search — stable tool list, cache-friendly, no context bloat.",
   "type": "module",
   "main": "lib/index.js",

package/src/client/GlobalEnvEditor.module.css

@@ -0,0 +1,204 @@
+.panel {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 10px;
+  padding: 10px 14px;
+  background: var(--dsw-alias-bg-layer-3);
+}
+
+.hint,
+.muted {
+  margin: 0;
+  font-size: 12px;
+  line-height: 18px;
+  color: var(--dsw-alias-label-tertiary);
+}
+
+.row {
+  display: grid;
+  grid-template-columns: minmax(0, 1.2fr) minmax(0, 1.8fr) auto auto;
+  align-items: center;
+  gap: 8px;
+}
+
+.row input {
+  box-sizing: border-box;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 6px;
+  padding: 5px 8px;
+  outline: none;
+  background: var(--dsw-alias-bg-layer-1);
+  color: var(--dsw-alias-label-primary);
+  font: inherit;
+  font-size: 13px;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+}
+
+.row input:focus-visible {
+  border-color: var(--dsw-alias-brand-primary);
+  box-shadow: 0 0 0 2px color-mix(in srgb, var(--dsw-alias-brand-primary) 18%, transparent);
+}
+
+.name {
+  width: 100%;
+}
+
+.value {
+  width: 100%;
+}
+
+.secretToggle {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  color: var(--dsw-alias-label-secondary);
+  font-size: 12px;
+  line-height: 18px;
+  white-space: nowrap;
+  cursor: pointer;
+  user-select: none;
+}
+
+.secretToggle input {
+  cursor: pointer;
+}
+
+.secretToggle.secretOn {
+  color: var(--dsw-alias-brand-primary);
+  font-weight: 600;
+}
+
+.danger {
+  border: 1px solid transparent !important;
+  background: transparent !important;
+  color: var(--dsw-alias-state-error-primary) !important;
+  cursor: pointer;
+}
+
+.overlay {
+  position: fixed;
+  inset: 0;
+  z-index: 1000;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: rgba(0, 0, 0, 0.4);
+}
+
+.dialog {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  width: min(520px, calc(100vw - 48px));
+  max-height: 80vh;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 12px;
+  padding: 16px;
+  background: var(--dsw-alias-bg-overlay);
+  box-shadow: 0 12px 32px rgba(0, 0, 0, 0.25);
+}
+
+.dialogTitle {
+  margin: 0;
+  font-size: 15px;
+  line-height: 22px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-primary);
+}
+
+.bulkText {
+  width: 100%;
+  box-sizing: border-box;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 8px;
+  padding: 8px 10px;
+  outline: none;
+  background: var(--dsw-alias-bg-layer-1);
+  color: var(--dsw-alias-label-primary);
+  font: inherit;
+  font-size: 12px;
+  line-height: 18px;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  resize: vertical;
+}
+
+.bulkText:focus-visible {
+  border-color: var(--dsw-alias-brand-primary);
+  box-shadow: 0 0 0 2px color-mix(in srgb, var(--dsw-alias-brand-primary) 18%, transparent);
+}
+
+.retryRow {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.retryRow button {
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 6px;
+  padding: 3px 10px;
+  background: transparent;
+  color: var(--dsw-alias-label-primary);
+  font: inherit;
+  font-size: 12px;
+  line-height: 18px;
+  cursor: pointer;
+}
+
+.retryRow button:hover {
+  background: var(--dsw-alias-interactive-bg-hover);
+}
+
+.error {
+  margin: 0;
+  color: var(--dsw-alias-state-error-primary);
+  font-size: 12px;
+  line-height: 18px;
+  word-break: break-all;
+}
+
+.notice {
+  margin: 0;
+  color: var(--dsw-alias-state-success-primary);
+  font-size: 12px;
+  line-height: 18px;
+}
+
+.actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 8px;
+}
+
+.actions button {
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 6px;
+  padding: 5px 12px;
+  background: transparent;
+  color: var(--dsw-alias-label-primary);
+  font: inherit;
+  font-size: 13px;
+  line-height: 20px;
+  cursor: pointer;
+}
+
+.actions button:hover {
+  background: var(--dsw-alias-interactive-bg-hover);
+}
+
+.actions button:disabled {
+  cursor: not-allowed;
+  opacity: 0.55;
+}
+
+.actions .primary {
+  border-color: var(--dsw-alias-button-primary-fill);
+  background: var(--dsw-alias-button-primary-fill);
+  color: var(--dsw-alias-label-primary-foreground);
+}
+
+.actions .primary:hover {
+  background: var(--dsw-alias-button-primary-hover);
+}