dsh-oauth-mcp 0.0.3 → 0.0.5

package/README.md

@@ -79,7 +79,7 @@ dsh plugin list | grep oauth                  # 确认装上了
 
 1. 打开 设置 →「OAuth 授权管理」，点「添加服务器」。
 
-2. 在厂商下拉里选一家。内置 40 家实测过的远程 MCP 服务器，选中之后服务器地址、ID、名称、默认权限范围、授权服务器地址自动填好。
+2. 在厂商下拉里选一家。内置 41 家实测过的远程 MCP 服务器，选中之后服务器地址、ID、名称、默认权限范围、授权服务器地址自动填好。
 
 3. 勾选权限范围，保存。
 
@@ -215,7 +215,7 @@ GitHub、Zendesk、Slack、PagerDuty、MongoDB Atlas、Render、Shopify、Atlass
    pnpm test               # 等价于 node --test "test/**/*.test.js"
    ```
 
-   仓库记录的最近一次全量运行是 **660 例**，全绿。用例分单元、协议契约、端到端、宿主集成、冒烟五类，外加发布清单与仓库卫生两条守卫。端到端有两种：`test/e2e/full-flow.test.js` 走协议层，`test/e2e/host-flow.test.js` 走完整链路。
+   仓库记录的最近一次全量运行是 **667 例**，全绿。用例分单元、协议契约、端到端、宿主集成、冒烟五类，外加发布清单与仓库卫生两条守卫。端到端有两种：`test/e2e/full-flow.test.js` 走协议层，`test/e2e/host-flow.test.js` 走完整链路。
 
    `node --test test/` 在 Node v24 上不可用：`--test` 的位置参数按 glob 解析，`test/` 会被当成模块去加载。
 
@@ -248,7 +248,7 @@ npm 发布那一步需要 GitHub 仓库里配一个 `NPM_TOKEN` secret。
 | 文档 | 内容 |
 | --- | --- |
 | [docs/usage.md](docs/usage.md) | 字段表、命令与工具参考、回调模式、令牌存储、错误码、故障排查 |
-| [docs/vendors.md](docs/vendors.md) | 40 家远程 MCP 服务器的 OAuth 元数据实测表 |
+| [docs/vendors.md](docs/vendors.md) | 41 家远程 MCP 服务器的 OAuth 元数据实测表 |
 | [docs/verification.md](docs/verification.md) | 12 步手工验收清单 |
 | [docs/contract.md](docs/contract.md) | 模块级接口契约 |
 | [docs/review-2026-11-07.md](docs/review-2026-11-07.md) | 六个方面的评审记录：已改的问题与剩下的清单 |

package/client/index.js

@@ -1509,6 +1509,15 @@ function createCommandView(React, options = {}) {
         defaultScopes: Object.freeze(['data.records:read', 'schema.bases:read', 'workspacesAndBases:read']),
         needsClientId: false,
       },
+      {
+        id: 'todoist',
+        label: 'Todoist MCP',
+        endpoint: 'https://ai.todoist.net/mcp',
+        authorizationServerUrl: 'https://todoist.com',
+        scopes: Object.freeze(['data:read_write']),
+        defaultScopes: Object.freeze(['data:read_write']),
+        needsClientId: false,
+      },
       {
         id: 'cloudbase',
         label: '腾讯云 CloudBase MCP',

package/lib/build-info.js

@@ -12,13 +12,13 @@ import { createTranslator } from './i18n/index.js'
 export const PLUGIN_ID = 'dsh-oauth-mcp'
 
 /** The version of the plugin. It is reported to every server it talks to. */
-export const PLUGIN_VERSION = '0.0.3'
+export const PLUGIN_VERSION = '0.0.5'
 
 /**
  * Short marker of the current source revision. Bump it whenever the behaviour
  * of the user facing surfaces (commands, tools, panel, callback pages) changes.
  */
-export const BUILD_STAMP = '2026-11-08-lazy-tools'
+export const BUILD_STAMP = '2026-11-09-todoist-vendor'
 
 /**
  * One line that names the version and the build of the running code.

package/lib/profiles/known-profiles.js

@@ -832,6 +832,24 @@ export const KNOWN_PROFILES = Object.freeze([
     note: 'AS 在 `airtable.com/oauth2/v1`；scope 按记录/表/评论读写成对',
     verifiedOn: '2026-11-07',
   }),
+  Object.freeze({
+    id: 'todoist',
+    label: 'Todoist MCP',
+    endpoint: 'https://ai.todoist.net/mcp',
+    resource: 'https://ai.todoist.net/mcp',
+    authorizationServerUrl: 'https://todoist.com',
+    registrationEndpoint: 'https://todoist.com/oauth/register',
+    defaultScopes: Object.freeze(['data:read_write']),
+    scopesSupported: Object.freeze([
+      'data:read_write',
+    ]),
+    tokenEndpointAuthMethods: Object.freeze(['client_secret_basic', 'client_secret_post', 'none']),
+    pkce: 'S256',
+    requiresClientId: false,
+    notes: 'Todoist hosts the MCP server on ai.todoist.net and runs the authorization server on todoist.com, so the resource and the issuer are two different domains. The endpoint is ai.todoist.net/mcp; mcp.todoist.com does not exist. The server publishes both the protected-resource metadata and the RFC 8414 authorization-server metadata, and it offers dynamic client registration, so the plugin registers itself and the user only has to approve the request in the browser. The protected-resource metadata publishes a single scope, data:read_write, which covers reading and changing tasks and projects; the many further scopes of the Todoist API are not usable on the MCP server.',
+    note: '资源在 `ai.todoist.net`、AS 在 `todoist.com`，两个域；只有 `data:read_write` 一个 scope',
+    verifiedOn: '2026-11-09',
+  }),
   Object.freeze({
     id: 'cloudbase',
     label: '腾讯云 CloudBase MCP',

package/lib/tools/reveal.js

@@ -11,6 +11,10 @@
  * description has to carry that job on its own: the model sees this tool and
  * nothing else.
  *
+ * The shape follows the host's contract: `execute` resolves with the data (one
+ * row per server), and `output.render` turns that data into the content
+ * blocks the model reads. The schema describes the data.
+ *
  * @module dsh-oauth-mcp/tools/reveal
  */
 
@@ -21,7 +25,7 @@ export { REVEAL_TOOL_NAME }
 /** JSON Schema of the value the tool resolves with. */
 const REVEAL_OUTPUT_SCHEMA = Object.freeze({
   type: 'array',
-  description: 'The servers whose tools were revealed, and the tools they expose.',
+  description: 'The servers that were revealed, and the tools they expose.',
   items: {
     type: 'object',
     properties: {
@@ -29,6 +33,7 @@ const REVEAL_OUTPUT_SCHEMA = Object.freeze({
       label: { type: 'string', description: 'The human readable label of the server.' },
       authorized: { type: 'boolean', description: 'Whether the server has a usable grant.' },
       connected: { type: 'boolean', description: 'Whether the MCP session is established.' },
+      revealed: { type: 'boolean', description: 'Whether the tools of this server are callable now.' },
       tools: {
         type: 'array',
         items: { type: 'string' },
@@ -36,7 +41,7 @@ const REVEAL_OUTPUT_SCHEMA = Object.freeze({
           'The public names of the tools of this server, for example "mcp_oauth__notion__search". They are callable from the next step on.',
       },
     },
-    required: ['serverId', 'label', 'authorized', 'connected', 'tools'],
+    required: ['serverId', 'label', 'authorized', 'connected', 'revealed', 'tools'],
   },
 })
 
@@ -55,7 +60,7 @@ function buildDescription() {
     'so that every step does not carry their schemas. ' +
     'Call it with {"server":"<serverId>"} to reveal one server, ' +
     'or without arguments to list the authorized servers. ' +
-    'The answer lists the server and the names of its tools; those names are callable from the next step on.'
+    'The answer lists the servers and the names of their tools; those names are callable from the next step on.'
   )
 }
 
@@ -65,10 +70,44 @@ function buildDescription() {
  * @param {object} options The options.
  * @param {import('../mcp/reveal.js').RevealState} options.reveal The reveal state.
  * @param {{ status: (serverId?: string) => Promise<object[]>, listToolNames: (serverId: string) => string[] }} options.service The plugin service.
- * @param {() => string} [options.locale] The current locale.
  * @returns {object} The tool definition.
  */
-export function createRevealTool({ reveal, service, locale }) {
+export function createRevealTool({ reveal, service }) {
+  /**
+   * Render the rows into the text the model reads.
+   *
+   * @param {object} args The arguments the tool was called with.
+   * @param {object[]} value The rows.
+   * @returns {{ type: 'text', text: string }[]} The content blocks.
+   */
+  function render(args, value) {
+    void args
+    const rows = Array.isArray(value) ? value : []
+    if (rows.length === 0) {
+      return [
+        {
+          type: 'text',
+          text: 'No MCP server is configured in this profile. Add one in the settings, then authorize it.',
+        },
+      ]
+    }
+    const lines = []
+    for (const row of rows) {
+      const state = row.authorized ? 'authorized' : 'not authorized yet'
+      const connection = row.connected ? 'connected' : 'not connected'
+      const callable = row.revealed ? 'tools callable now' : 'tools not revealed'
+      const tools = row.tools.length > 0 ? row.tools.join(', ') : 'no tools yet'
+      lines.push(`${row.serverId} (${row.label}) — ${state} — ${connection} — ${callable}`)
+      if (row.tools.length > 0) lines.push(`  ${tools}`)
+    }
+    const revealed = rows.filter((row) => row.revealed).length
+    if (revealed > 0) {
+      lines.push('')
+      lines.push(`The tools of ${revealed} server(s) are callable from the next step on.`)
+    }
+    return [{ type: 'text', text: lines.join('\n') }]
+  }
+
   return {
     name: REVEAL_TOOL_NAME,
     description: buildDescription(),
@@ -81,57 +120,33 @@ export function createRevealTool({ reveal, service, locale }) {
             'The id of the MCP server to reveal, for example "notion". Leave it out to list the authorized servers.',
         },
       },
+      required: [],
+      additionalProperties: false,
     },
-    output: { schema: REVEAL_OUTPUT_SCHEMA, render: (value) => value },
+    output: { schema: REVEAL_OUTPUT_SCHEMA, render },
     execute: async (args, exec) => {
       const agent = exec?.agent
       const requested = typeof args?.server === 'string' ? args.server.trim() : ''
 
       const rows = await service.status(requested || undefined)
-      if (rows.length === 0) {
-        return [
-          {
-            type: 'text',
-            text: requested
-              ? `No MCP server with the id "${requested}" is configured in this profile.`
-              : 'No MCP server is configured in this profile. Add one in the settings, then authorize it.',
-          },
-        ]
-      }
+      const target = Array.isArray(rows) ? rows : []
 
       // Reveal what the model asked for. Without a server id every authorized
       // server is revealed: the model asked what is there, and the answer is
       // more useful than another round trip.
-      const wanted = rows.filter((row) => row.authorized).map((row) => row.serverId)
-      const target = requested ? rows.filter((row) => row.serverId === requested) : rows
       const revealIds = target.filter((row) => row.authorized).map((row) => row.serverId)
       reveal.reveal(agent, revealIds)
 
-      const lines = []
-      for (const row of target) {
-        const tools = service.listToolNames(row.serverId)
-        lines.push(
-          [
-            `${row.serverId}: ${row.label}`,
-            row.authorized ? 'authorized' : 'not authorized yet',
-            row.connected ? 'connected' : 'not connected',
-            tools.length > 0 ? `tools: ${tools.join(', ')}` : 'no tools yet',
-          ].join(' — '),
-        )
-      }
-      if (requested && revealIds.length === 0) {
-        lines.push(`The server "${requested}" is not authorized yet, so its tools were not revealed.`)
-      }
-      if (wanted.length === 0 && !requested) {
-        lines.push('No server is authorized yet. Use the oauth-mcp command to authorize one.')
-      }
-
-      return [
-        {
-          type: 'text',
-          text: lines.join('\n'),
-        },
-      ]
+      return target.map((row) => ({
+        serverId: String(row.serverId ?? ''),
+        label: String(row.label ?? row.serverId ?? ''),
+        authorized: row.authorized === true,
+        connected: row.connected === true,
+        revealed: revealIds.includes(String(row.serverId ?? '')),
+        tools: Array.isArray(row.tools) ? row.tools.map((name) => String(name)) : [],
+      }))
     },
+    timeoutMs: 30_000,
+    isConcurrencySafe: true,
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-oauth-mcp",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "OAuth 2.1 client and MCP bridge for DSH: discover and authorize remote MCP servers, keep tokens fresh, and expose their tools",
   "keywords": [
     "dsh",