dsh-oauth-mcp 0.0.4 → 0.0.5

package/README.md

@@ -79,7 +79,7 @@ dsh plugin list | grep oauth                  # 确认装上了
 
 1. 打开 设置 →「OAuth 授权管理」，点「添加服务器」。
 
-2. 在厂商下拉里选一家。内置 40 家实测过的远程 MCP 服务器，选中之后服务器地址、ID、名称、默认权限范围、授权服务器地址自动填好。
+2. 在厂商下拉里选一家。内置 41 家实测过的远程 MCP 服务器，选中之后服务器地址、ID、名称、默认权限范围、授权服务器地址自动填好。
 
 3. 勾选权限范围，保存。
 
@@ -248,7 +248,7 @@ npm 发布那一步需要 GitHub 仓库里配一个 `NPM_TOKEN` secret。
 | 文档 | 内容 |
 | --- | --- |
 | [docs/usage.md](docs/usage.md) | 字段表、命令与工具参考、回调模式、令牌存储、错误码、故障排查 |
-| [docs/vendors.md](docs/vendors.md) | 40 家远程 MCP 服务器的 OAuth 元数据实测表 |
+| [docs/vendors.md](docs/vendors.md) | 41 家远程 MCP 服务器的 OAuth 元数据实测表 |
 | [docs/verification.md](docs/verification.md) | 12 步手工验收清单 |
 | [docs/contract.md](docs/contract.md) | 模块级接口契约 |
 | [docs/review-2026-11-07.md](docs/review-2026-11-07.md) | 六个方面的评审记录：已改的问题与剩下的清单 |

package/client/index.js

@@ -1509,6 +1509,15 @@ function createCommandView(React, options = {}) {
         defaultScopes: Object.freeze(['data.records:read', 'schema.bases:read', 'workspacesAndBases:read']),
         needsClientId: false,
       },
+      {
+        id: 'todoist',
+        label: 'Todoist MCP',
+        endpoint: 'https://ai.todoist.net/mcp',
+        authorizationServerUrl: 'https://todoist.com',
+        scopes: Object.freeze(['data:read_write']),
+        defaultScopes: Object.freeze(['data:read_write']),
+        needsClientId: false,
+      },
       {
         id: 'cloudbase',
         label: '腾讯云 CloudBase MCP',

package/lib/build-info.js

@@ -12,13 +12,13 @@ import { createTranslator } from './i18n/index.js'
 export const PLUGIN_ID = 'dsh-oauth-mcp'
 
 /** The version of the plugin. It is reported to every server it talks to. */
-export const PLUGIN_VERSION = '0.0.4'
+export const PLUGIN_VERSION = '0.0.5'
 
 /**
  * Short marker of the current source revision. Bump it whenever the behaviour
  * of the user facing surfaces (commands, tools, panel, callback pages) changes.
  */
-export const BUILD_STAMP = '2026-11-08-lazy-tools-reveal-fix'
+export const BUILD_STAMP = '2026-11-09-todoist-vendor'
 
 /**
  * One line that names the version and the build of the running code.

package/lib/profiles/known-profiles.js

@@ -832,6 +832,24 @@ export const KNOWN_PROFILES = Object.freeze([
     note: 'AS 在 `airtable.com/oauth2/v1`；scope 按记录/表/评论读写成对',
     verifiedOn: '2026-11-07',
   }),
+  Object.freeze({
+    id: 'todoist',
+    label: 'Todoist MCP',
+    endpoint: 'https://ai.todoist.net/mcp',
+    resource: 'https://ai.todoist.net/mcp',
+    authorizationServerUrl: 'https://todoist.com',
+    registrationEndpoint: 'https://todoist.com/oauth/register',
+    defaultScopes: Object.freeze(['data:read_write']),
+    scopesSupported: Object.freeze([
+      'data:read_write',
+    ]),
+    tokenEndpointAuthMethods: Object.freeze(['client_secret_basic', 'client_secret_post', 'none']),
+    pkce: 'S256',
+    requiresClientId: false,
+    notes: 'Todoist hosts the MCP server on ai.todoist.net and runs the authorization server on todoist.com, so the resource and the issuer are two different domains. The endpoint is ai.todoist.net/mcp; mcp.todoist.com does not exist. The server publishes both the protected-resource metadata and the RFC 8414 authorization-server metadata, and it offers dynamic client registration, so the plugin registers itself and the user only has to approve the request in the browser. The protected-resource metadata publishes a single scope, data:read_write, which covers reading and changing tasks and projects; the many further scopes of the Todoist API are not usable on the MCP server.',
+    note: '资源在 `ai.todoist.net`、AS 在 `todoist.com`，两个域；只有 `data:read_write` 一个 scope',
+    verifiedOn: '2026-11-09',
+  }),
   Object.freeze({
     id: 'cloudbase',
     label: '腾讯云 CloudBase MCP',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-oauth-mcp",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "OAuth 2.1 client and MCP bridge for DSH: discover and authorize remote MCP servers, keep tokens fresh, and expose their tools",
   "keywords": [
     "dsh",