@auggieteo/dsh-mcp-adapter 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to this project are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v0.2.2] - 2026-09-06
+
+### Added
+
+- `skillInstall` Config field (`file` by default, `runtime`, or `off`) controlling how the bundled `mcp-adapter` agent skill is installed. `file` copies `skills/mcp-adapter/SKILL.md` verbatim to `$DSH_HOME/skills/mcp-adapter/SKILL.md` at startup (atomic temp-file-then-rename write, never a symlink), so the DSH filesystem skill provider lists it under Settings > Skills > DSH skills. `runtime` keeps the previous in-memory registration; `off` installs nothing. The mode is read once at Adapter startup.
+
+### Changed
+
+- The bundled agent skill now installs as a real file by default instead of registering only in memory. The installed file is never overwritten: an identical file is left untouched, and a file edited by a human wins with one Host warning naming the installed path and the package version — delete `$DSH_HOME/skills/mcp-adapter/` and restart DSH to refresh it from the package. A failed file install (for example a read-only `$DSH_HOME`) falls back to the runtime registration with a warning; the skill stays a convenience and never throws.
+
+## [v0.2.1] - 2026-09-06
+
+### Added
+
+- `scripts/patch-dsh-settings-nav-icon.mjs`: patches the installed DSH settings shell so the `mcp` nav row in Settings shows a connection icon (`IconLinkOutline16`) instead of the generic settings-gear fallback. The icon mapping is DSH shell chrome that this plugin cannot reach through the `settings.section` slot (it accepts only `id`, `order`, `label`). The insert is idempotent and marked `// dsh-mcp-adapter`; `--revert` restores the original bytes. A DSH upgrade replaces the patched file, so re-run the script afterwards, then restart `dsh web` and refresh the page.
+
+### Changed
+
+- Settings > MCP has a single Add Server entry point: the dialog now offers an Input fields mode for one Server and a Paste JSON mode for a standard `mcpServers` object (existing names are replaced), replacing the separate Import JSON button and dialog in both the toolbar and the empty state.
+
+### Fixed
+
+- The plugin failed to load on DSH 0.1.2-rc.1 with `failed to apply loader entry … cannot get property "remote.settings" without inject`: the runner mounts the settings namespace as the traced dotted service `remote.settings`, so the plain `ctx.remote?.settings` read is governed and throws for plugins that do not declare it — while declaring it would park the plugin forever on 0.1.1-rc.2, where the namespace is never mounted. The write face is now resolved through the inject-free `ctx.get('remote.settings')`, which works on both generations ([ADR 0009](docs/adr/0009-dual-generation-settings-api.md)).
+- The Add Server and Import JSON dialogs follow the host dialog theme again: the modal card now surfaces on `bg-layer-2` with the shared `--dsw-elevation-prominent` treatment and the overlay mask blurs like the host Modal primitive, instead of the off-palette `bg-overlay` fill and a hardcoded drop shadow.
+
 ## [v0.2.0] - 2026-09-05
 
 Everything from v0.1.2 through this release: the six deferred v1 features (#8–#12, #14), the dual-generation DSH compatibility fix, and the standard-readme documentation pass.
@@ -41,5 +66,6 @@ Everything from v0.1.2 through this release: the six deferred v1 features (#8–
 
 Initial releases of the Adapter through v1 issues #1–#7: proxy-first tool surface, Config in the DSH settings namespace, promotion registry, lazy lifecycle, output guard, settings page, and the `/mcp-adapter` RPC channel. See [docs/verification/v1-e2e.md](docs/verification/v1-e2e.md).
 
+[v0.2.2]: https://github.com/auggie246/dsh-mcp-adapter/compare/v0.2.1...v0.2.2
 [v0.2.0]: https://github.com/auggie246/dsh-mcp-adapter/compare/v0.1.2...v0.2.0
 [v0.1.2]: https://github.com/auggie246/dsh-mcp-adapter/releases/tag/v0.1.2

package/README.md

@@ -130,10 +130,13 @@ mcp:
       url: https://mcp.example.com/other
       auth: oauth
       scopes: [repo, read:org]
+  skillInstall: file
 ```
 
 Each Server configures exactly one Transport: `command` for stdio, or `url` for streamable HTTP with SSE fallback. Adapter extension fields are `auth` (`headers` by default, or `oauth` for HTTP Servers), `scopes` (OAuth scopes, requires `auth: oauth`), `disabled`, `autoAllow`, `lifecycle` (`lazy`, `eager`, `keep-alive`, or `lazy-keep-alive`; default `lazy`), `idleTimeoutMinutes` (default `10`), and `promotedTools`.
 
+The one top-level Adapter field is `skillInstall` (`file` by default, `runtime`, or `off`); see [Agent skill](#agent-skill).
+
 The schema rejects unknown fields and invalid transport combinations before they reach `$DSH_HOME/settings.yaml`. Each `env` and `headers` value has the DSH `secret` schema role. Wire views retain each key and redact its value.
 
 #### Workspace Config layer
@@ -211,7 +214,13 @@ The SDK transports refresh expired access tokens through the stored refresh toke
 
 ### Agent skill
 
-The package bundles a model-facing skill in `skills/mcp-adapter/SKILL.md`. When the DSH `skills` service is present, the Adapter registers it at startup as a runtime skill named `mcp-adapter`, so agents learn the search → describe → call workflow, how to read failure messages (including the OAuth sign-in hint), and which commands belong to the human. The frontmatter drives routing; edit the file to change the guidance, and a DSH restart picks the edit up.
+The package bundles a model-facing skill in `skills/mcp-adapter/SKILL.md`, so agents learn the search → describe → call workflow, how to read failure messages (including the OAuth sign-in hint), and which commands belong to the human. The top-level `skillInstall` Config field controls how the Adapter installs it; the mode is read once at Adapter startup, so a change takes effect on the next DSH restart.
+
+- `file` (default): on startup the Adapter copies the bundled `SKILL.md` verbatim to `$DSH_HOME/skills/mcp-adapter/SKILL.md` (an atomic temp-file-then-rename write, never a symlink). The DSH filesystem skill provider discovers the file, so the skill shows under **Settings > Skills > DSH skills** and joins the session catalog without a restart of an already-running session. When the file install fails, the Adapter falls back to the runtime registration below and logs one warning.
+- `runtime`: the Adapter registers the skill in memory on the DSH `skills` service only. It reaches agents but never appears on the Settings > Skills page.
+- `off`: the Adapter installs no skill.
+
+The installed file is never overwritten. If `$DSH_HOME/skills/mcp-adapter/SKILL.md` already exists, your edit wins: an identical file is left untouched, and a differing file gets one Host warning naming the installed path and the package version. To refresh the installed copy from the package, delete `$DSH_HOME/skills/mcp-adapter/` and restart DSH. Editing the installed file changes what the session catalog serves; the edit survives plugin restarts.
 
 ## Architecture
 

package/docs/adr/0009-dual-generation-settings-api.md

@@ -4,6 +4,8 @@ The Adapter's client bundle once read `ctx.connection.api.settings` directly. DS
 
 We resolve the write face at apply time (`src/client/settings-api.js`) and prefer `ctx.remote.settings` when it exists; otherwise we fall back to the 0.1.1-rc.2 `ctx.connection.api.settings` face. Both normalize to the controller's existing contract — `update`/`mutate` take one request object and answer `{ result: { ok, value | error } }` — so `McpSettingsController` and the host stay generation-agnostic. The client declares `remote` in its `inject` (the service exists in both generations; `remote.settings` does not exist on 0.1.1-rc.2 and stays undeclared, so the runner never parks waiting for it), and `package.json` adds `@deepseek-ai/dsh-api-remotes` to `dsh.client.inject` so the typed settings namespace mounts before consumers apply. On the host, `MCP_SETTINGS_NAMESPACE` becomes the plain `'mcp'` string: branding was type-only on 0.1.1-rc.2, and 0.1.2-rc.1 accepts the validated raw string. The peer dependency widens to `^0.1.1-rc.2 || ^0.1.2-rc.1`.
 
+*Correction:* the original resolution read the rc.1 face as `ctx.remote?.settings`, assuming a plain property. The rc.1 runner instead mounts the namespace as the traced dotted service `remote.settings`: reading through `ctx.remote` composes that key, and cordis throws `cannot get property "remote.settings" without inject` for any plugin that did not declare the dotted service — which crashed this plugin at apply with a failed loader entry. Declaring it is not an option either: a declared-but-never-mounted service keeps the fiber from ever applying, which is exactly the 0.1.1-rc.2 case. The face is therefore resolved through cordis's inject-free `ctx.get('remote.settings')`, which answers the mounted namespace on 0.1.2-rc.1 via the root isolate and undefined on 0.1.1-rc.2, keeping the fallback reachable on both generations; the plain-property read remains as a legacy fallback for runners that expose the face as a plain property.
+
 Considered options: shipping a 0.1.2-only release and telling 0.1.1-rc.2 users to upgrade was rejected because the harness is in flux and plugin releases should not force harness moves; probing `ctx.remote.$host` or version strings was rejected because face presence is the actual capability signal and survives future renames better. A hard failure with upgrade guidance is kept for a hypothetical third shape, so a future break surfaces as one clear message instead of an `undefined` read.
 
 Consequences: the `apply`-level test suite (`test/client-apply.test.js`) compiles the real client entry and drives both fake generations, locking the fallback contract. When DSH drops 0.1.1-rc.2 support, the fallback branch, the legacy fake, and the README note are the removal surface — the controller and host need no changes.

package/lib/client.js

@@ -647,6 +647,7 @@ function useEscapeClose(onClose) {
   }, [onClose]);
 }
 function AddServerDialog({ controller, busy, onClose }) {
+  const [mode, setMode] = (0, import_react.useState)("form");
   const [name, setName] = (0, import_react.useState)("");
   const [transport, setTransport] = (0, import_react.useState)("stdio");
   const [command, setCommand] = (0, import_react.useState)("");
@@ -654,11 +655,28 @@ function AddServerDialog({ controller, busy, onClose }) {
   const [argsText, setArgsText] = (0, import_react.useState)("[]");
   const [auth, setAuth] = (0, import_react.useState)("headers");
   const [scopesText, setScopesText] = (0, import_react.useState)("");
+  const [jsonText, setJsonText] = (0, import_react.useState)('{\n  "mcpServers": {\n    \n  }\n}');
   const [error, setError] = (0, import_react.useState)();
   useEscapeClose(onClose);
+  const switchMode = (next) => {
+    setMode(next);
+    setError(void 0);
+  };
   const submit = async (event) => {
     event.preventDefault();
     setError(void 0);
+    if (mode === "json") {
+      try {
+        parseMcpImport(jsonText);
+      } catch (nextError) {
+        setError(nextError instanceof Error ? nextError.message : String(nextError));
+        return;
+      }
+      const result = await controller.importJson(jsonText);
+      if (result) onClose();
+      else setError("The Host rejected this import. Review the page error and retry.");
+      return;
+    }
     let config;
     try {
       config = normalizeServerConfig(
@@ -677,170 +695,165 @@ function AddServerDialog({ controller, busy, onClose }) {
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "mcp-card-head", children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { className: "mcp-modal-title", children: "Add Server" }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "mcp-muted", children: "Configure one stdio command or one HTTP URL." })
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "mcp-muted", children: "Fill in the fields for one Server, or paste an mcpServers JSON." })
       ] }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", className: "mcp-button", onClick: onClose, children: "Close" })
     ] }),
-    error !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "mcp-error", role: "alert", children: error }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "Name" }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "mcp-dialog-tabs", role: "tablist", "aria-label": "Add Server input mode", children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-        "input",
+        "button",
         {
-          autoFocus: true,
-          className: "mcp-input",
-          value: name,
+          type: "button",
+          role: "tab",
+          "aria-selected": mode === "form",
+          className: mode === "form" ? "mcp-dialog-tab mcp-dialog-tab-active" : "mcp-dialog-tab",
           disabled: busy,
-          onChange: (event) => setName(event.target.value),
-          placeholder: "github"
+          onClick: () => switchMode("form"),
+          children: "Input fields"
+        }
+      ),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        "button",
+        {
+          type: "button",
+          role: "tab",
+          "aria-selected": mode === "json",
+          className: mode === "json" ? "mcp-dialog-tab mcp-dialog-tab-active" : "mcp-dialog-tab",
+          disabled: busy,
+          onClick: () => switchMode("json"),
+          children: "Paste JSON"
         }
       )
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "Transport" }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(
-        "select",
+    error !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "mcp-error", role: "alert", children: error }),
+    mode === "json" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "MCP Config JSON" }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        "textarea",
         {
-          className: "mcp-select",
-          value: transport,
+          autoFocus: true,
+          className: "mcp-textarea",
+          style: { minHeight: 280 },
+          value: jsonText,
           disabled: busy,
-          onChange: (event) => setTransport(event.target.value),
-          children: [
-            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "stdio", children: "stdio" }),
-            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "http", children: "Streamable HTTP" })
-          ]
+          spellCheck: false,
+          onChange: (event) => setJsonText(event.target.value)
         }
-      )
+      ),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-muted", children: "One or more Servers. A name that already exists is replaced." })
     ] }),
-    transport === "stdio" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+    mode === "form" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "Command" }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "Name" }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
           "input",
           {
+            autoFocus: true,
             className: "mcp-input",
-            value: command,
+            value: name,
             disabled: busy,
-            onChange: (event) => setCommand(event.target.value),
-            placeholder: "npx"
+            onChange: (event) => setName(event.target.value),
+            placeholder: "github"
           }
         )
       ] }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "Args as a JSON array" }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-          "textarea",
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "Transport" }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(
+          "select",
           {
-            className: "mcp-textarea",
-            value: argsText,
+            className: "mcp-select",
+            value: transport,
             disabled: busy,
-            placeholder: '["-y", "@modelcontextprotocol/server-github"]',
-            onChange: (event) => setArgsText(event.target.value),
-            spellCheck: false
-          }
-        )
-      ] })
-    ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "URL" }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-          "input",
-          {
-            className: "mcp-input",
-            value: url,
-            disabled: busy,
-            onChange: (event) => setUrl(event.target.value),
-            placeholder: "https://example.com/mcp"
+            onChange: (event) => setTransport(event.target.value),
+            children: [
+              /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "stdio", children: "stdio" }),
+              /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "http", children: "Streamable HTTP" })
+            ]
           }
         )
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "mcp-field-row", children: [
+      transport === "stdio" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
-          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "HTTP authentication" }),
-          /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(
-            "select",
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "Command" }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            "input",
             {
-              className: "mcp-select",
-              value: auth,
+              className: "mcp-input",
+              value: command,
               disabled: busy,
-              title: "Static headers send fixed values on every request. OAuth 2.0 with PKCE signs in through the provider in your browser.",
-              onChange: (event) => setAuth(event.target.value),
-              children: [
-                /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "headers", children: "Static headers" }),
-                /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "oauth", children: "OAuth 2.0 with PKCE" })
-              ]
+              onChange: (event) => setCommand(event.target.value),
+              placeholder: "npx"
             }
           )
         ] }),
-        auth === "oauth" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
-          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "OAuth scopes (optional, comma-separated)" }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "Args as a JSON array" }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            "textarea",
+            {
+              className: "mcp-textarea",
+              value: argsText,
+              disabled: busy,
+              placeholder: '["-y", "@modelcontextprotocol/server-github"]',
+              onChange: (event) => setArgsText(event.target.value),
+              spellCheck: false
+            }
+          )
+        ] })
+      ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "URL" }),
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
             "input",
             {
               className: "mcp-input",
-              value: scopesText,
+              value: url,
               disabled: busy,
-              placeholder: "read write",
-              title: "Optional. Leave empty when the provider defines no scopes \u2014 for example Context7. Request only scopes the provider grants.",
-              onChange: (event) => setScopesText(event.target.value)
+              onChange: (event) => setUrl(event.target.value),
+              placeholder: "https://example.com/mcp"
             }
-          ),
-          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-muted", children: "Leave empty unless the provider requires scopes." })
-        ] })
-      ] }),
-      auth === "oauth" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "mcp-muted", children: "OAuth signs in through your browser. The Sign in button appears on the Server panel after you save." })
-    ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "mcp-actions", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "submit", className: "mcp-button mcp-button-primary", disabled: busy, children: busy ? "Adding\u2026" : "Add Server" }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", className: "mcp-button", disabled: busy, onClick: onClose, children: "Cancel" })
-    ] })
-  ] }) });
-}
-function ImportDialog({ controller, busy, onClose }) {
-  const [text, setText] = (0, import_react.useState)('{\n  "mcpServers": {\n    \n  }\n}');
-  const [error, setError] = (0, import_react.useState)();
-  useEscapeClose(onClose);
-  const submit = async (event) => {
-    event.preventDefault();
-    setError(void 0);
-    try {
-      parseMcpImport(text);
-    } catch (nextError) {
-      setError(nextError instanceof Error ? nextError.message : String(nextError));
-      return;
-    }
-    const result = await controller.importJson(text);
-    if (result) onClose();
-    else setError("The Host rejected this import. Review the page error and retry.");
-  };
-  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "mcp-overlay", role: "presentation", onMouseDown: (event) => {
-    if (event.target === event.currentTarget) onClose();
-  }, children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: "mcp-modal-card", "aria-label": "Import MCP Servers", onSubmit: submit, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "mcp-card-head", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { className: "mcp-modal-title", children: "Import JSON" }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "mcp-muted", children: "Paste a standard object with an mcpServers property." })
-      ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", className: "mcp-button", onClick: onClose, children: "Close" })
-    ] }),
-    error !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "mcp-error", role: "alert", children: error }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "MCP Config JSON" }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-        "textarea",
-        {
-          autoFocus: true,
-          className: "mcp-textarea",
-          style: { minHeight: 280 },
-          value: text,
-          disabled: busy,
-          spellCheck: false,
-          onChange: (event) => setText(event.target.value)
-        }
-      )
+          )
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "mcp-field-row", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "HTTP authentication" }),
+            /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(
+              "select",
+              {
+                className: "mcp-select",
+                value: auth,
+                disabled: busy,
+                title: "Static headers send fixed values on every request. OAuth 2.0 with PKCE signs in through the provider in your browser.",
+                onChange: (event) => setAuth(event.target.value),
+                children: [
+                  /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "headers", children: "Static headers" }),
+                  /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "oauth", children: "OAuth 2.0 with PKCE" })
+                ]
+              }
+            )
+          ] }),
+          auth === "oauth" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "mcp-field", children: [
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-label", children: "OAuth scopes (optional, comma-separated)" }),
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+              "input",
+              {
+                className: "mcp-input",
+                value: scopesText,
+                disabled: busy,
+                placeholder: "read write",
+                title: "Optional. Leave empty when the provider defines no scopes \u2014 for example Context7. Request only scopes the provider grants.",
+                onChange: (event) => setScopesText(event.target.value)
+              }
+            ),
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "mcp-muted", children: "Leave empty unless the provider requires scopes." })
+          ] })
+        ] }),
+        auth === "oauth" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "mcp-muted", children: "OAuth signs in through your browser. The Sign in button appears on the Server panel after you save." })
+      ] })
     ] }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "mcp-actions", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "submit", className: "mcp-button mcp-button-primary", disabled: busy, children: busy ? "Importing\u2026" : "Import Servers" }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "submit", className: "mcp-button mcp-button-primary", disabled: busy, children: busy ? mode === "json" ? "Importing\u2026" : "Adding\u2026" : mode === "json" ? "Import Servers" : "Add Server" }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", className: "mcp-button", disabled: busy, onClick: onClose, children: "Cancel" })
     ] })
   ] }) });
@@ -1303,56 +1316,32 @@ function McpSettingsPage({ controller }) {
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h1", { className: "mcp-title", children: "MCP" }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "mcp-intro", children: "Connect MCP Servers and choose how their tools reach the Agent." })
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "mcp-actions", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-          "button",
-          {
-            type: "button",
-            className: "mcp-button",
-            disabled: snapshot.busy || !settings.writable,
-            onClick: () => setDialog("import"),
-            children: "Import JSON"
-          }
-        ),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-          "button",
-          {
-            type: "button",
-            className: "mcp-button mcp-button-primary",
-            disabled: snapshot.busy || !settings.writable,
-            onClick: () => setDialog("add"),
-            children: "Add Server"
-          }
-        )
-      ] })
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "mcp-actions", children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        "button",
+        {
+          type: "button",
+          className: "mcp-button mcp-button-primary",
+          disabled: snapshot.busy || !settings.writable,
+          onClick: () => setDialog("add"),
+          children: "Add Server"
+        }
+      ) })
     ] }),
     !settings.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "mcp-warning", children: "The active Settings Provider is read-only." }),
     snapshot.error !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "mcp-error", role: "alert", children: snapshot.error }),
     names.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "mcp-empty", children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: "mcp-card-title", children: "No MCP Servers" }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "mcp-muted", children: "Add a Server or import an existing mcpServers Config." }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "mcp-actions", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-          "button",
-          {
-            type: "button",
-            className: "mcp-button mcp-button-primary",
-            disabled: snapshot.busy || !settings.writable,
-            onClick: () => setDialog("add"),
-            children: "Add Server"
-          }
-        ),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-          "button",
-          {
-            type: "button",
-            className: "mcp-button",
-            disabled: snapshot.busy || !settings.writable,
-            onClick: () => setDialog("import"),
-            children: "Import JSON"
-          }
-        )
-      ] })
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "mcp-muted", children: "Add a Server through its input fields, or paste an existing mcpServers JSON." }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "mcp-actions", children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        "button",
+        {
+          type: "button",
+          className: "mcp-button mcp-button-primary",
+          disabled: snapshot.busy || !settings.writable,
+          onClick: () => setDialog("add"),
+          children: "Add Server"
+        }
+      ) })
     ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "mcp-layout", children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("nav", { className: "mcp-sidebar", "aria-label": "MCP Servers", children: names.map((name) => {
         const status = statusFor(snapshot.overview, name);
@@ -1395,14 +1384,13 @@ function McpSettingsPage({ controller }) {
         selected
       )
     ] }),
-    dialog === "add" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AddServerDialog, { controller, busy: snapshot.busy, onClose: () => setDialog() }),
-    dialog === "import" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ImportDialog, { controller, busy: snapshot.busy, onClose: () => setDialog() })
+    dialog === "add" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AddServerDialog, { controller, busy: snapshot.busy, onClose: () => setDialog() })
   ] });
 }
 
 // src/client/settings-api.js
 function createSettingsApi(ctx) {
-  const remoteSettings = ctx.remote?.settings;
+  const remoteSettings = readRemoteSettings(ctx);
   if (remoteSettings !== void 0) return remoteSettingsApi(remoteSettings);
   const connectionSettings = ctx.connection?.api?.settings;
   if (connectionSettings !== void 0) return connectionSettings;
@@ -1410,6 +1398,20 @@ function createSettingsApi(ctx) {
     "No DSH settings write API: expected ctx.remote.settings (DSH 0.1.2+) or ctx.connection.api.settings (DSH 0.1.1-rc.2). Upgrade @auggieteo/dsh-mcp-adapter to a release supporting this harness."
   );
 }
+function readRemoteSettings(ctx) {
+  if (typeof ctx.get === "function") {
+    try {
+      const mounted = ctx.get("remote.settings");
+      if (mounted !== void 0) return mounted;
+    } catch {
+    }
+  }
+  try {
+    return ctx.remote?.settings;
+  } catch {
+  }
+  return void 0;
+}
 function remoteSettingsApi(remote) {
   return {
     async update({ ns, patch, expectedRevision }) {
@@ -1493,11 +1495,17 @@ var MCP_SETTINGS_CSS = `
 .mcp-promotion-name{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px;color:var(--dsw-alias-label-primary);overflow-wrap:anywhere}
 .mcp-promotion-description{display:block;color:var(--dsw-alias-label-tertiary);font-size:11px;line-height:17px}
 .mcp-empty{padding:30px 20px;text-align:center;display:flex;align-items:center;flex-direction:column;gap:10px}
-.mcp-overlay{position:fixed;inset:0;background:var(--dsw-alias-bg-mask-1);display:flex;align-items:center;justify-content:center;padding:20px;z-index:1200;animation:mcp-fade .12s ease}
-.mcp-modal-card{width:min(560px,100%);max-height:min(760px,90vh);overflow:auto;padding:18px;display:flex;flex-direction:column;gap:13px;border:1px solid var(--dsw-alias-border-l1);border-radius:14px;background:var(--dsw-alias-bg-overlay);box-shadow:0 18px 60px rgba(0,0,0,.32);animation:mcp-pop .16s ease}
+.mcp-overlay{position:fixed;inset:0;background:var(--dsw-alias-bg-mask-1);backdrop-filter:var(--dsw-mask-blur);display:flex;align-items:center;justify-content:center;padding:20px;z-index:1200;animation:mcp-fade .12s ease}
+.mcp-modal-card{width:min(560px,100%);max-height:min(760px,90vh);overflow:auto;padding:18px;display:flex;flex-direction:column;gap:13px;border:0;border-radius:14px;background:var(--dsw-alias-bg-layer-2);box-shadow:var(--dsw-elevation-prominent);animation:mcp-pop .16s ease}
 @keyframes mcp-fade{from{opacity:0}to{opacity:1}}
 @keyframes mcp-pop{from{opacity:0;transform:translateY(6px) scale(.98)}to{opacity:1;transform:none}}
 .mcp-modal-title{margin:0;font-size:15px;line-height:22px;font-weight:600}
+.mcp-dialog-tabs{display:inline-flex;gap:2px;align-self:flex-start;border:1px solid var(--dsw-alias-border-l2);border-radius:16px;padding:2px;background:var(--dsw-alias-bg-layer-3)}
+.mcp-dialog-tab{height:26px;border:0;border-radius:14px;background:transparent;color:var(--dsw-alias-label-secondary);padding:0 12px;font:inherit;font-size:12px;cursor:pointer;transition:background .12s ease,color .12s ease}
+.mcp-dialog-tab:hover:not(:disabled):not(.mcp-dialog-tab-active){color:var(--dsw-alias-label-primary)}
+.mcp-dialog-tab:disabled{cursor:not-allowed;opacity:.5}
+.mcp-dialog-tab-active{background:var(--dsw-alias-button-primary-fill);color:var(--dsw-alias-label-primary-foreground)}
+.mcp-dialog-tab:focus-visible{outline:2px solid var(--dsw-alias-state-business-primary);outline-offset:1px}
 .mcp-confirm{border-radius:8px;padding:10px;display:flex;flex-direction:column;gap:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent)}
 @container (max-width:660px){.mcp-layout{grid-template-columns:minmax(0,1fr)}.mcp-sidebar{position:static;flex-direction:row;overflow-x:auto;padding-bottom:2px}.mcp-server-button{width:auto;flex:none;white-space:nowrap}}
 @container (max-width:480px){.mcp-field-row{grid-template-columns:minmax(0,1fr)}.mcp-secret-row{grid-template-columns:minmax(0,1fr) auto}.mcp-secret-row .mcp-input:first-child{grid-column:1 / -1}.mcp-card-head .mcp-actions{margin-left:0;width:100%}.mcp-toolbar{align-items:flex-start}}