dsh-mcp 1.7.0 → 1.8.0

package/CHANGELOG.en.md

@@ -7,6 +7,25 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [1.8.0] - 2026-08-27
+
+### Added
+
+- **OAuth authorization UX**: mounts no longer open the browser (they fail with guidance when authorization is needed; only Test connection auto-opens the browser); tool calls with a missing/expired token return a **clickable authorization link** (a background callback listener on the stable port completes the flow; concurrent calls reuse the same pending flow); a global authorization queue keeps at most one flow active at a time
+- **Mount failure now carries an authorization link**: when a mount needs OAuth authorization, the failure message includes a **clickable authorization link**; once the user opens it, the tokens are stored automatically — no manual trip to the settings page
+- **New `allowBrowserOnMount` config**: `false` by default (mounts never pop the browser); set it to `true` to restore the legacy behavior (mounts open the browser for authorization). Configure it under the dsh-mcp entry in the profile's `cordis.patch.yml`
+- **stdio form argument input**: arguments now parse shell-style (space/newline separated, with quote, escape, and explicit empty-argument support) so a command line pastes directly; the args box shows a live parsed-argument preview so split mistakes surface before saving
+
+### Fixed
+
+- **OAuth authorization link was dropped from the mount failure message**: the underlying connect error (including the authorization link) used to be folded into `cause`, while the mount failure view only showed the message; the detail is now folded into the message
+- **Tools did not register automatically after OAuth authorization**: saving tokens now remounts every enabled server of that name by serverName, so tools appear without a manual refresh or restart (the listener previously subscribed to a credential event name the service never dispatches, so the remount never ran; fixed)
+- **Callback-port conflict crashed the Host**: all authorization flows now share one deduplicated per-server loopback listener and every listen has an error handler — an `EADDRINUSE` can no longer crash the DSH process
+- **Wrong `resource` parameter in the authorization link**: the link used to serialize `resource=undefined`, which the authorization server rejects; it now passes a URL object (preferring the protected-resource metadata's resource)
+- **stdio working-directory pitfall**: the form now explains that an empty cwd inherits the Host working directory and that a pnpm workspace there can make npx and similar commands resolve the wrong local package; the hint carries no concrete path, leaving the value to the user
+
 ## [1.7.0] - 2026-08-21
 
 ### Added

package/CHANGELOG.md

@@ -7,6 +7,25 @@
 格式基于 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## [Unreleased]
+
+## [1.8.0] - 2026-08-27
+
+### 新增
+
+- **OAuth 授权交互改进**：启动挂载不再自动弹浏览器（需授权时失败并提示，仅测试连接自动弹浏览器）；工具调用发现 token 缺失/过期时返回**可点击的授权链接**（后台回调监听器在稳定端口完成授权，并发请求复用同一流程）；全局授权队列保证同一时间最多一个授权流程
+- **挂载失败直接附授权链接**：挂载需要授权时，失败信息直接附带**可点击的授权链接**，打开链接完成授权后 token 自动保存，无需再手动去设置页操作
+- **新增 `allowBrowserOnMount` 配置**：默认 `false`（挂载不自动弹浏览器）；设为 `true` 可恢复旧行为（挂载时自动打开浏览器授权）。在 profile 的 `cordis.patch.yml` 中 dsh-mcp 条目下配置
+- **stdio 表单参数输入改进**：参数支持 shell 风格解析（空格/换行分隔，支持引号、转义与显式空参数），命令行可直接粘贴即用；参数框下方实时预览解析结果，保存前即可发现参数拆分问题
+
+### 修复
+
+- **OAuth 授权链接未在挂载失败信息中展示**：底层连接错误（含授权链接）此前被塞进 `cause`，挂载失败视图只显示通用文案；现已将详情并入 message
+- **OAuth 授权完成后工具不自动注册**：授权保存 token 后按 serverName 自动重挂载对应服务器，工具立即注册，无需手动刷新或重启（此前监听的事件名与凭据服务实际发出的事件不一致，自动重挂载一直未生效，现已修正）
+- **授权回调端口冲突导致进程崩溃**：统一按服务器共享回调监听器（同服务器去重），并为所有 listen 增加错误处理——`EADDRINUSE` 不再导致 DSH 进程崩溃
+- **授权链接 resource 参数错误**：链接中 `resource=undefined` 会导致授权服务器校验失败；改为传 URL 对象（优先使用 protected-resource 元数据的 resource）
+- **stdio 工作目录留空时易踩坑**：表单为 cwd 补充说明——留空会继承 Host 工作目录，若该目录是 pnpm workspace，npx 等命令可能解析到错误的本地包；提示不含具体路径，由使用者自行填写
+
 ## [1.7.0] - 2026-08-21
 
 ### 新增

package/README.en.md

@@ -153,7 +153,7 @@ Check in order:
    the `web` profile (`dsh plugin --profile web add dsh-mcp` +
    `$DSH_HOME/profiles/web/cordis.patch.yml`); other profiles have their own settings pages.
 5. **Is it the latest version?** npm metadata caching can pin an old version; force the version
-   with `dsh plugin --profile web add dsh-mcp@latest` (or `@1.7.0`).
+   with `dsh plugin --profile web add dsh-mcp@latest` (or `@1.8.0`).
 
 **Q2: "MCP" is visible but the server list is empty or errors?**
 

package/README.md

@@ -136,7 +136,7 @@ dsh plugin --profile web add link:<本仓库绝对路径>
    （`dsh plugin --profile web add dsh-mcp` + `$DSH_HOME/profiles/web/cordis.patch.yml`）；
    装到其他 profile 则在其他 profile 的设置页查看。
 5. **是否为最新版本**：npm 元数据缓存可能导致装到旧版，可强制指定版本
-   `dsh plugin --profile web add dsh-mcp@latest`（或 `@1.7.0`）。
+   `dsh plugin --profile web add dsh-mcp@latest`（或 `@1.8.0`）。
 
 **Q2：设置页能看到「MCP」，但服务器列表为空/报错？**