pi-dynamic-help 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.2.2
+
+### 安全修复
+- **MCP 信息泄漏**: 移除 `/help` 输出中暴露的完整 MCP 服务器 URL 和命令路径，改为显示 "HTTP 服务器" 或 "stdio 服务器"
+- **内置命令重复**: 修复 `/model`、`/help` 等内置命令在列表中显示两次的问题，添加去重逻辑
+- **保存失败提示**: `pin`/`unpin`/`refresh` 命令现在检查保存结果，失败时回滚状态并显示错误信息，不再谎报成功
+
+### 测试增强
+- 添加 MCP URL 消毒测试
+- 添加内置命令去重测试  
+- 添加 pin/unpin 保存失败回滚测试
+
 ## 0.2.1
 
 - 移除 `/help` 输出中硬编码的 MCP 用法示例（包含特定服务器名 chrome-devtools/screenshot）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-dynamic-help",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Dynamic /help dashboard for Pi commands, tools, MCP servers, and packages.",
   "type": "module",
   "keywords": [

package/src/extension.ts

@@ -84,9 +84,10 @@ export function registerHelpExtension(pi: ExtensionAPI): void {
     return index;
   }
 
-  function persist(ctx: ExtensionContext): void {
+  function persist(ctx: ExtensionContext): { ok: boolean; warning?: string } {
     const result = saveState(paths, state);
     notifySaveWarning(ctx, result.warning);
+    return result;
   }
 
   pi.registerCommand("help", {
@@ -101,8 +102,12 @@ export function registerHelpExtension(pi: ExtensionAPI): void {
 
       if (subcommand === "refresh") {
         rebuildIndex(ctx);
-        persist(ctx);
-        ctx.ui.notify("帮助索引已刷新", "info");
+        const result = persist(ctx);
+        if (result.ok) {
+          ctx.ui.notify("帮助索引已刷新", "info");
+        } else {
+          ctx.ui.notify(`帮助索引刷新失败：${result.warning ?? "保存状态失败"}`, "error");
+        }
         return;
       }
 
@@ -116,10 +121,16 @@ export function registerHelpExtension(pi: ExtensionAPI): void {
         }
 
         const target = matches[0];
+        const wasPinned = target.pinned;
         target.pinned = subcommand === "pin";
         target.lastSeenAt = Date.now();
-        persist(ctx);
-        ctx.ui.notify(`${subcommand === "pin" ? "已固定" : "已取消固定"}：${target.displayName ?? target.name} (${target.kind} · ${target.sourceLabel})`, "info");
+        const result = persist(ctx);
+        if (result.ok) {
+          ctx.ui.notify(`${subcommand === "pin" ? "已固定" : "已取消固定"}：${target.displayName ?? target.name} (${target.kind} · ${target.sourceLabel})`, "info");
+        } else {
+          target.pinned = wasPinned; // rollback
+          ctx.ui.notify(`${subcommand === "pin" ? "固定" : "取消固定"}失败：${result.warning ?? "保存状态失败"}`, "error");
+        }
         return;
       }
 

package/src/resources/index.ts

@@ -103,22 +103,26 @@ export function buildResourceIndex(input: ResourceRuntimeInput): ResourceIndex {
   for (const server of input.mcpServers) mergedMcp.set(server.name, server);
 
   const commandItems: IndexedItem[] = [];
+  const seenCommandKeys = new Set<string>();
   for (const command of commands) {
     const sourceRef = compactSourceRef(command.sourceInfo.source ?? command.sourceInfo.origin ?? command.sourceInfo.scope);
     const base = itemBase("command", command.name, sourceRef);
-    commandItems.push(upsertItem(state, {
+    const item = upsertItem(state, {
       ...base,
       description: command.description,
       sourceLabel: sourceLabelForCommand(command.sourceInfo),
       scope: command.sourceInfo.scope,
       packageName: command.sourceInfo.source,
       lastSeenAt: now,
-    }));
+    });
+    commandItems.push(item);
+    seenCommandKeys.add(item.key);
   }
 
   for (const builtin of BUILTIN_COMMANDS) {
     const sourceRef = "builtin";
     const base = itemBase("command", builtin.name, sourceRef);
+    if (seenCommandKeys.has(base.key)) continue;
     commandItems.push(upsertItem(state, {
       ...base,
       description: builtin.description,
@@ -172,10 +176,10 @@ export function buildResourceIndex(input: ResourceRuntimeInput): ResourceIndex {
     const base = itemBase("mcp", server.name, sourceRef);
     mcpItems.push(upsertItem(state, {
       ...base,
-      description: server.url ? server.url : server.command ? server.command : "MCP 服务器",
+      description: server.mode === "http" ? "HTTP 服务器" : "stdio 服务器",
       sourceLabel: sourceLabelForMcp(server),
       scope: "user",
-      packageName: server.command ?? server.url,
+      packageName: undefined,
       lastSeenAt: now,
     }));
   }