@civilization/deepseek-harness-skill-mcp 0.1.6 → 0.1.8

package/README.md

@@ -2,7 +2,7 @@
 
 为 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) Web 界面提供 Skill 路径和 MCP 服务器管理。
 
-安装后，“设置”中会出现 **Skill 管理** 和 **MCP 管理** 两个页面，同时向 Agent 注册 `extensions_*` 管理工具。插件使用 Harness 自带的 Skill filesystem provider 与 MCP client，配置写入当前 `web` profile 的 `cordis.patch.yml`。
+安装后，“设置”中会出现 **Skill 管理** 和 **MCP 管理** 两个页面，同时向 Agent 注册 `extensions_*` 管理工具。插件使用 Harness 自带的 Skill filesystem provider 与 MCP client，并为旧版 HTTP+SSE 服务提供兼容客户端；配置写入当前 `web` profile 的 `cordis.patch.yml`。
 
 ## 通过 dsh 安装
 
@@ -71,10 +71,11 @@ Skill 页面支持：
 
 ## MCP 管理
 
-支持两种 MCP 配置类型：
+支持三种 MCP 配置类型：
 
 - `stdio`：执行本地命令并通过标准输入输出通信
-- `HTTP`：连接 Streamable HTTP MCP 地址
+- `streamable-http`：连接推荐的 Streamable HTTP MCP 地址
+- `sse`：兼容使用独立 `/sse` 与 `/messages` 端点的旧版 MCP 服务
 
 stdio 示例：
 
@@ -96,13 +97,22 @@ HTTP 示例：
 }
 ```
 
+旧版 SSE 示例：
+
+```json
+{
+  "transport": "sse",
+  "url": "http://127.0.0.1:9000/sse"
+}
+```
+
 服务器卡片使用状态灯显示禁用、等待发现工具或工具可用，并可展开查看实际注册的工具列表。MCP 配置可以编辑或删除，编辑时保留服务器 id 与启用状态。新服务器默认禁用；启用 stdio 服务器会在 Agent 沙箱之外执行所配置的程序。
 
 MCP 工具是提供给模型的工具 schema，不是用户 `/` 命令，因此不会出现在 Skill 斜杠菜单中；它们的动态状态以 MCP 页面中的“工具列表”和 `extensions_inspect` 为准。
 
 当前版本不接受 `env`、认证 header、带凭据或 token 查询参数的 URL。请勿把密钥放进工具参数、MCP 地址或提交到仓库。
 
-MCP 对端离线、命令启动失败或首次工具发现失败不会阻止 DSH 启动。默认重连策略会在后台重试；设置页在连接恢复并发现工具后更新状态。插件加载时也会把旧版本写入的严格启动配置迁移为非致命启动策略。
+MCP 对端离线、命令启动失败或首次工具发现失败不会阻止 DSH 启动。stdio 与 Streamable HTTP 使用 Harness MCP client 的后台重连策略；旧版 SSE 当前依赖连接自身，在断线后可通过刷新配置重新加载。设置页在连接恢复并发现工具后更新状态。插件加载时也会把旧版本写入的严格启动配置迁移为非致命启动策略。
 
 ## Agent 工具
 
@@ -110,7 +120,7 @@ MCP 对端离线、命令启动失败或首次工具发现失败不会阻止 DSH
 |---|---|
 | `extensions_list` | 查看受管 Skill 路径与 MCP 配置 |
 | `extensions_add_skill` | 添加 Skill 路径；Agent 调用时显式指定内部 id |
-| `extensions_add_mcp` | 添加 stdio 或 HTTP MCP 配置 |
+| `extensions_add_mcp` | 添加 stdio、Streamable HTTP 或旧版 SSE MCP 配置 |
 | `extensions_set_enabled` | 启用或禁用受管配置 |
 | `extensions_update_skill` | 修改 Skill 来源路径 |
 | `extensions_update_mcp` | 替换 MCP 连接配置并保留 id 与启用状态 |
@@ -143,9 +153,9 @@ pnpm run web
 
 ## 验证
 
-自动测试覆盖配置持久化、Skill 多路径、编辑和删除、单技能内容编辑与删除、用户分组、并发 revision、Skill 创建与调用权限、MCP 工具发现和卸载、轮询状态以及中英文词典一致性。测试不需要模型 API key。
+自动测试覆盖配置持久化、Skill 多路径、编辑和删除、单技能内容编辑与删除、用户分组、并发 revision、Skill 创建与调用权限、MCP 工具发现和卸载、轮询状态、中英文词典一致性，以及 DSH `webServer` 前缀路由、OPTIONS 预检和 RPC 信封协议桥接。测试不需要模型 API key。
 
-浏览器端 `/` 候选缓存失效兼容逻辑会使用公开的 `connection/reset` 客户端事件；自动测试验证 Host/RPC 和浏览器 bundle 构建，但没有在本仓库内启动完整 Harness Web 做端到端菜单点击验证。外部文件改动仍依赖 filesystem provider 先完成 watcher 失效，必要时可在变更后点击管理页“刷新”。
+浏览器端 `/` 候选缓存失效兼容逻辑会使用公开的 `connection/reset` 客户端事件；服务端通过注入 `webServer` 与 `connection` 双重挂载 `/extensions` 路由并由 Cordis effect 托管生命周期，防止动态请求掉入前端静态资源的 405 fallback。自动测试验证 Host/RPC、HTTP 桥接和浏览器 bundle 构建，但没有在本仓库内启动完整 Harness Web 做端到端菜单点击验证。外部文件改动仍依赖 filesystem provider 先完成 watcher 失效，必要时可在变更后点击管理页“刷新”。
 
 ## 发布
 

package/lib/client.js

@@ -110,7 +110,8 @@ var zh = {
   directory: "Skill \u8DEF\u5F84",
   transport: "\u914D\u7F6E\u7C7B\u578B",
   stdio: "stdio",
-  http: "HTTP",
+  http: "Streamable HTTP",
+  sse: "SSE\uFF08\u65E7\u7248\u517C\u5BB9\uFF09",
   command: "\u547D\u4EE4",
   args: "\u53C2\u6570\uFF08\u6BCF\u884C\u4E00\u4E2A\uFF09",
   cwd: "\u5DE5\u4F5C\u76EE\u5F55\uFF08\u53EF\u9009\uFF09",
@@ -139,7 +140,7 @@ var zh = {
   failed: "\u64CD\u4F5C\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u8F93\u5165\u3001\u8FDE\u63A5\u6216\u670D\u52A1\u7AEF\u65E5\u5FD7\u540E\u91CD\u8BD5\u3002",
   conflict: "\u914D\u7F6E\u5DF2\u88AB\u4FEE\u6539\uFF0C\u8BF7\u5237\u65B0\u540E\u91CD\u8BD5\u3002\u672A\u63D0\u4EA4\u7684\u8868\u5355\u5185\u5BB9\u5DF2\u4FDD\u7559\u3002",
   skillFootnote: "\u65B0\u8DEF\u5F84\u9ED8\u8BA4\u7981\u7528\u3002\u542F\u7528\u540E\uFF0CSkill provider \u4F1A\u626B\u63CF\u8BE5\u8DEF\u5F84\u4E0B\u7684\u6240\u6709\u6280\u80FD\u3002\u914D\u7F6E\u53D8\u66F4\u4F1A\u81EA\u52A8\u751F\u6548\u3002",
-  mcpFootnote: "\u65B0\u670D\u52A1\u5668\u9ED8\u8BA4\u7981\u7528\u3002\u542F\u7528\u540E\u4F1A\u6267\u884C\u6240\u586B\u547D\u4EE4\u6216\u8FDE\u63A5\u6240\u586B\u5730\u5740\u3002\u914D\u7F6E\u53D8\u66F4\u4F1A\u81EA\u52A8\u751F\u6548\u3002",
+  mcpFootnote: "\u65B0\u670D\u52A1\u5668\u9ED8\u8BA4\u7981\u7528\u3002\u65B0\u670D\u52A1\u63A8\u8350 Streamable HTTP\uFF1BSSE \u4EC5\u7528\u4E8E\u517C\u5BB9\u65E7\u7248 /sse + /messages \u670D\u52A1\u3002\u914D\u7F6E\u53D8\u66F4\u4F1A\u81EA\u52A8\u751F\u6548\u3002",
   secret: "\u8BF7\u52FF\u586B\u5199\u5BC6\u94A5\u6216\u5E26\u4EE4\u724C\u7684\u5730\u5740\u3002\u6B64\u7248\u672C\u6682\u4E0D\u652F\u6301\u8BA4\u8BC1\u53C2\u6570\u3002",
   tools: "\u5DE5\u5177\u5217\u8868",
   status_available: "\u5DE5\u5177\u53EF\u7528",
@@ -220,7 +221,8 @@ var en = {
   directory: "Skill path",
   transport: "Type",
   stdio: "stdio",
-  http: "HTTP",
+  http: "Streamable HTTP",
+  sse: "SSE (legacy)",
   command: "Command",
   args: "Arguments (one per line)",
   cwd: "Working directory (optional)",
@@ -249,7 +251,7 @@ var en = {
   failed: "Operation failed. Check input, connection or server logs and retry.",
   conflict: "Configuration changed. Refresh and retry; your draft has been retained.",
   skillFootnote: "New paths are disabled. Once enabled, the Skill provider scans every skill below them.",
-  mcpFootnote: "New servers are disabled. Enabling one runs its command or connects to its endpoint; changes apply automatically.",
+  mcpFootnote: "New servers are disabled. Prefer Streamable HTTP for new servers; SSE only supports legacy /sse + /messages endpoints.",
   secret: "Do not enter secrets or token-bearing URLs. Authentication fields are not supported yet.",
   tools: "Tools",
   status_available: "Tools available",
@@ -945,7 +947,8 @@ function McpForm({ row, t, busy, onSave, onCancel }) {
       t("transport"),
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("select", { id: `${prefix}-transport`, value: transport, onChange: (event) => setTransport(event.target.value), children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "stdio", children: t("stdio") }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "streamable-http", children: t("http") })
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "streamable-http", children: t("http") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "sse", children: t("sse") })
       ] })
     ] }),
     transport === "stdio" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
@@ -982,7 +985,8 @@ function AddForm({ kind, t, busy, onSave, onCancel }) {
         t("transport"),
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("select", { id: `${prefix}-transport`, value: transport, onChange: (event) => setTransport(event.target.value), children: [
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "stdio", children: t("stdio") }),
-          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "streamable-http", children: t("http") })
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "streamable-http", children: t("http") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: "sse", children: t("sse") })
         ] })
       ] }),
       transport === "stdio" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@civilization/deepseek-harness-skill-mcp",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Skill path and MCP server management for DeepSeek Harness Web",
   "license": "Apache-2.0",
   "repository": {
@@ -18,6 +18,7 @@
   "exports": {
     ".": "./src/index.js",
     "./client": "./lib/client.js",
+    "./mcp-sse": "./src/mcp-sse.js",
     "./package.json": "./package.json"
   },
   "files": [
@@ -52,6 +53,7 @@
     "@deepseek-ai/dsh-mcp-client": "0.1.2-rc.1",
     "@deepseek-ai/dsh-skill-filesystem": "0.1.2-rc.1",
     "@deepseek-ai/schemastery": "3.18.2",
+    "@modelcontextprotocol/sdk": "1.29.0",
     "yaml": "^2.9.0"
   },
   "peerDependencies": {
@@ -63,7 +65,6 @@
     "@deepseek-ai/dsh-skill": "0.1.2-rc.1",
     "@deepseek-ai/dsh-system-prompt": "0.1.2-rc.1",
     "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
-    "@modelcontextprotocol/sdk": "1.29.0",
     "esbuild": "^0.28.2",
     "react": "^19.2.8"
   }

package/src/client/index.jsx

@@ -356,7 +356,7 @@ function McpForm({ row, t, busy, onSave, onCancel }) {
     void onSave({ id: row?.id ?? data.id, configuration })
   }}><fieldset disabled={busy}>{!row && field('id')}
     <label htmlFor={`${prefix}-transport`}>{t('transport')}<select id={`${prefix}-transport`} value={transport} onChange={event => setTransport(event.target.value)}>
-      <option value="stdio">{t('stdio')}</option><option value="streamable-http">{t('http')}</option></select></label>
+      <option value="stdio">{t('stdio')}</option><option value="streamable-http">{t('http')}</option><option value="sse">{t('sse')}</option></select></label>
     {transport === 'stdio' ? <>{field('command', true, false, initial.command)}{field('args', false, true, (initial.args ?? []).join('\n'))}{field('cwd', false, false, initial.cwd)}</> : field('url', true, false, initial.url)}
     <p>{t('secret')}</p>
     <div className="dsh-ext-actions"><button type="button" onClick={onCancel}>{t('cancel')}</button><button type="submit">{t(busy ? 'saving' : row ? 'saveChanges' : 'save')}</button></div>
@@ -380,7 +380,7 @@ function AddForm({ kind, t, busy, onSave, onCancel }) {
     void onSave(args)
   }}><fieldset disabled={busy}>{kind === 'skill' ? field('directory') : <>{field('id')}
       <label htmlFor={`${prefix}-transport`}>{t('transport')}<select id={`${prefix}-transport`} value={transport} onChange={event => setTransport(event.target.value)}>
-        <option value="stdio">{t('stdio')}</option><option value="streamable-http">{t('http')}</option></select></label>
+        <option value="stdio">{t('stdio')}</option><option value="streamable-http">{t('http')}</option><option value="sse">{t('sse')}</option></select></label>
       {transport === 'stdio' ? <>{field('command')}{field('args', false, true)}{field('cwd', false)}</> : field('url')}
       <p>{t('secret')}</p>
     </>}

package/src/client/locales.js

@@ -5,7 +5,7 @@ export const zh = {
   skills: 'Skill 路径', mcp: 'MCP 服务器', refresh: '刷新', add: '添加路径', addMcp: '添加服务器', newSkill: '新建 Skill',
   emptySkills: '还没有配置 Skill 路径', emptySkillsHint: '指定一个本地 skills 目录，目录下的各个子目录就是技能。',
   emptyMcp: '还没有添加 MCP 服务器', emptyMcpHint: '通过本地命令或 HTTP 地址连接外部工具。',
-  id: '标识', directory: 'Skill 路径', transport: '配置类型', stdio: 'stdio', http: 'HTTP',
+  id: '标识', directory: 'Skill 路径', transport: '配置类型', stdio: 'stdio', http: 'Streamable HTTP', sse: 'SSE（旧版兼容）',
   command: '命令', args: '参数（每行一个）', cwd: '工作目录（可选）', url: '服务器地址',
   cancel: '取消', save: '添加', saveChanges: '保存修改', create: '创建', edit: '编辑', delete: '删除', confirmDelete: '确认删除', deleting: '删除中…', saving: '保存中…', loading: '加载中…',
   deleteExtensionTitle: '移除 Skill 来源', deleteMcpTitle: '删除 MCP 服务器', deleteSkillTitle: '永久删除 Skill',
@@ -15,7 +15,7 @@ export const zh = {
   saved: '更改已保存。', failed: '操作失败，请检查输入、连接或服务端日志后重试。',
   conflict: '配置已被修改，请刷新后重试。未提交的表单内容已保留。',
   skillFootnote: '新路径默认禁用。启用后，Skill provider 会扫描该路径下的所有技能。配置变更会自动生效。',
-  mcpFootnote: '新服务器默认禁用。启用后会执行所填命令或连接所填地址。配置变更会自动生效。',
+  mcpFootnote: '新服务器默认禁用。新服务推荐 Streamable HTTP；SSE 仅用于兼容旧版 /sse + /messages 服务。配置变更会自动生效。',
   secret: '请勿填写密钥或带令牌的地址。此版本暂不支持认证参数。',
   tools: '工具列表', status_available: '工具可用', status_waiting: '等待发现工具', status_disabled: '已禁用',
   skillHint: '启用后由 Skill provider 扫描；每个配置项对应一个包含多个技能的目录。',
@@ -43,7 +43,7 @@ export const en = {
   skills: 'Skill paths', mcp: 'MCP servers', refresh: 'Refresh', add: 'Add path', addMcp: 'Add server', newSkill: 'New Skill',
   emptySkills: 'No Skill paths configured', emptySkillsHint: 'Choose a local skills directory whose children contain the individual skills.',
   emptyMcp: 'No MCP servers yet', emptyMcpHint: 'Connect external tools with a local command or HTTP endpoint.',
-  id: 'Identifier', directory: 'Skill path', transport: 'Type', stdio: 'stdio', http: 'HTTP',
+  id: 'Identifier', directory: 'Skill path', transport: 'Type', stdio: 'stdio', http: 'Streamable HTTP', sse: 'SSE (legacy)',
   command: 'Command', args: 'Arguments (one per line)', cwd: 'Working directory (optional)', url: 'Server URL',
   cancel: 'Cancel', save: 'Add', saveChanges: 'Save changes', create: 'Create', edit: 'Edit', delete: 'Delete', confirmDelete: 'Delete', deleting: 'Deleting…', saving: 'Saving…', loading: 'Loading…',
   deleteExtensionTitle: 'Remove Skill source', deleteMcpTitle: 'Delete MCP server', deleteSkillTitle: 'Permanently delete Skill',
@@ -53,7 +53,7 @@ export const en = {
   saved: 'Changes saved.', failed: 'Operation failed. Check input, connection or server logs and retry.',
   conflict: 'Configuration changed. Refresh and retry; your draft has been retained.',
   skillFootnote: 'New paths are disabled. Once enabled, the Skill provider scans every skill below them.',
-  mcpFootnote: 'New servers are disabled. Enabling one runs its command or connects to its endpoint; changes apply automatically.',
+  mcpFootnote: 'New servers are disabled. Prefer Streamable HTTP for new servers; SSE only supports legacy /sse + /messages endpoints.',
   secret: 'Do not enter secrets or token-bearing URLs. Authentication fields are not supported yet.',
   tools: 'Tools', status_available: 'Tools available', status_waiting: 'Waiting for tools', status_disabled: 'Disabled',
   skillHint: 'The Skill provider scans enabled paths; every configured path contains multiple skills.',

package/src/index.js

@@ -4,7 +4,7 @@ import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import { ExtensionStore } from './store.js'
-import { createWebHandler } from './web.js'
+import { createWebHandler, createWebHttpHandler } from './web.js'
 
 export const name = 'extension-manager'
 export const inject = ['tools', 'skills']
@@ -21,8 +21,19 @@ export async function apply(ctx, config) {
   const home = process.env.DSH_HOME || join(homedir(), '.dsh')
   const store = new ExtensionStore(config.patchPath || join(home, 'profiles', 'web', 'cordis.patch.yml'))
   await store.ensureNonFatalMcpStartup()
+
+  const webHandler = createWebHandler(store, ctx)
+  const httpHandler = createWebHttpHandler(store, ctx)
+
   ctx.inject(['connection'], web => {
-    web.connection.rpc.handle('/extensions', createWebHandler(store, ctx))
+    web.connection.rpc.handle('/extensions', webHandler)
+  })
+  ctx.inject(['webServer'], hostCtx => {
+    hostCtx.effect(() => hostCtx.webServer.register({
+      kind: 'prefix',
+      path: '/extensions',
+      handler: httpHandler,
+    }), 'extension-manager: /extensions route')
   })
   const register = (name, description, parameters, execute) => ctx.tools.register(defineTool({ name, description, parameters, output, execute }))
 
@@ -35,7 +46,7 @@ export async function apply(ctx, config) {
   register('extensions_add_skill', 'Add an existing root containing skill directories. Added sources are disabled until explicitly enabled.', {
     id: string, directory: string,
   }, (args, exec) => store.addSkill(args.id, args.directory, exec.signal))
-  register('extensions_add_mcp', 'Add a disabled MCP server. configuration is JSON with transport and command/args/cwd or url. Do not supply secrets in arguments.', {
+  register('extensions_add_mcp', 'Add a disabled MCP server. configuration is JSON for stdio, Streamable HTTP, or legacy SSE transport. Do not supply secrets in arguments.', {
     id: string, configuration: string,
   }, (args, exec) => {
     const input = JSON.parse(args.configuration)

package/src/mcp-sse.js

@@ -0,0 +1,122 @@
+/** Legacy HTTP+SSE MCP client used only for servers that predate Streamable HTTP. */
+import Schema from '@deepseek-ai/schemastery'
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js'
+import { CallToolResultSchema, ListToolsResultSchema, ToolListChangedNotificationSchema } from '@modelcontextprotocol/sdk/types.js'
+import { createHash } from 'node:crypto'
+
+export const name = 'mcp-sse-client'
+export const inject = ['tools']
+
+const serverNamePattern = /^[A-Za-z0-9_-]{1,32}$/
+const invalidNameCharacters = /[^A-Za-z0-9_-]/g
+const maxPublicNameLength = 64
+
+export const Config = Schema.object({
+  transport: Schema.const('sse'),
+  serverName: Schema.string().required().pattern(serverNamePattern),
+  url: Schema.string().required(),
+  toolCallTimeoutMs: Schema.number().default(60_000),
+  failOnStartupError: Schema.boolean().default(false),
+})
+
+export async function apply(ctx, config) {
+  const client = new Client({ name: `dsh-sse-${config.serverName}`, version: '1.0.0' }, { capabilities: {} })
+  const transport = new SSEClientTransport(new URL(config.url))
+  let disposed = false
+  let registrations = new Map()
+  let synchronization = Promise.resolve()
+
+  const clearTools = () => {
+    for (const dispose of registrations.values()) dispose()
+    registrations = new Map()
+  }
+  ctx.effect(() => () => {
+    disposed = true
+    clearTools()
+    void client.close().catch(() => {})
+  }, 'mcp-sse-client.connection')
+
+  const synchronizeTools = async () => {
+    const definitions = new Map()
+    let cursor
+    do {
+      const response = await client.request({
+        method: 'tools/list',
+        ...(cursor === undefined ? {} : { params: { cursor } }),
+      }, ListToolsResultSchema)
+      for (const tool of response.tools) {
+        const publicName = publicToolName(config.serverName, tool.name)
+        if (definitions.has(publicName)) throw new Error(`SSE MCP server listed duplicate tool: ${tool.name}`)
+        definitions.set(publicName, createTool(client, publicName, tool, config.toolCallTimeoutMs))
+      }
+      cursor = response.nextCursor
+    } while (cursor)
+    if (disposed) return
+    clearTools()
+    const next = new Map()
+    try {
+      for (const [publicName, definition] of definitions) next.set(publicName, ctx.tools.register(definition))
+      registrations = next
+    } catch (error) {
+      for (const dispose of next.values()) dispose()
+      throw error
+    }
+  }
+
+  client.setNotificationHandler(ToolListChangedNotificationSchema, () => {
+    synchronization = synchronization.then(synchronizeTools).catch(error => {
+      ctx.logger.warn(`mcp-sse-client(${config.serverName}): tool refresh failed: ${messageOf(error)}`)
+    })
+  })
+
+  try {
+    await client.connect(transport)
+    await synchronizeTools()
+  } catch (error) {
+    clearTools()
+    await client.close().catch(() => {})
+    if (config.failOnStartupError) throw new Error(`mcp-sse-client(${config.serverName}): initial connection failed: ${messageOf(error)}`, { cause: error })
+    ctx.logger.warn(`mcp-sse-client(${config.serverName}): initial connection failed: ${messageOf(error)}`)
+  }
+}
+
+function createTool(client, publicName, tool, timeout) {
+  return {
+    name: publicName,
+    description: tool.description ?? '',
+    parameters: tool.inputSchema,
+    output: {
+      schema: {
+        type: 'object',
+        properties: { content: { type: 'array', items: {} }, structuredContent: {} },
+        required: ['content'],
+        additionalProperties: true,
+      },
+      render: (_args, value) => [{ type: 'text', text: textContent(value.content) }],
+    },
+    async execute(args, exec) {
+      const result = await client.request({ method: 'tools/call', params: { name: tool.name, arguments: args } }, CallToolResultSchema, {
+        signal: exec.signal,
+        timeout,
+      })
+      if (result.isError) throw new Error(textContent(result.content) || `MCP tool ${tool.name} failed`)
+      return result
+    },
+  }
+}
+
+function publicToolName(serverName, rawName) {
+  const joined = `mcp__${serverName}__${rawName}`
+  const normalized = joined.replace(invalidNameCharacters, '_')
+  if (normalized === joined && normalized.length <= maxPublicNameLength) return normalized
+  const hash = createHash('sha256').update(`${serverName}\0${rawName}`).digest('hex').slice(0, 12)
+  return `${normalized.slice(0, maxPublicNameLength - 13)}_${hash}`
+}
+
+function textContent(content) {
+  const text = Array.isArray(content) ? content.filter(item => item?.type === 'text').map(item => item.text).join('\n') : ''
+  return text || JSON.stringify(content ?? [])
+}
+
+const messageOf = error => error instanceof Error ? error.message : String(error)

package/src/store.js

@@ -4,11 +4,13 @@ import { basename, isAbsolute, resolve, win32 } from 'node:path'
 import { randomUUID, createHash } from 'node:crypto'
 import { Config as McpConfig } from '@deepseek-ai/dsh-mcp-client'
 import { Config as SkillConfig } from '@deepseek-ai/dsh-skill-filesystem'
+import { Config as SseMcpConfig } from './mcp-sse.js'
 import { parse, stringify } from 'yaml'
 
 const moduleNames = {
   skill: '@deepseek-ai/dsh-skill-filesystem',
   mcp: '@deepseek-ai/dsh-mcp-client',
+  mcpSse: '@civilization/deepseek-harness-skill-mcp/mcp-sse',
 }
 const managerModule = new URL('./index.js', import.meta.url).href
 const resolvedModules = Object.fromEntries(Object.entries(moduleNames).map(([kind, name]) => [kind, import.meta.resolve(name)]))
@@ -61,6 +63,9 @@ function parsePatch(value) {
     } else if (isModule(row.name, 'mcp')) {
       McpConfig(row.config)
       if (row.config.serverName !== row.id) throw new Error('MCP namespace must match its id.')
+    } else if (isModule(row.name, 'mcpSse')) {
+      SseMcpConfig(row.config)
+      if (row.config.serverName !== row.id) throw new Error('MCP namespace must match its id.')
     } else throw new Error('Unknown managed plugin module.')
     managed.push(row)
   }
@@ -183,7 +188,8 @@ export class ExtensionStore {
   async addMcp(id, input, signal, expectedRevision) {
     validateId(id)
     const config = this.normalizeMcp(id, input)
-    return this.add({ id, name: moduleNames.mcp, disabled: true, config }, signal, expectedRevision)
+    const name = config.transport === 'sse' ? moduleNames.mcpSse : moduleNames.mcp
+    return this.add({ id, name, disabled: true, config }, signal, expectedRevision)
   }
 
   normalizeMcp(id, input) {
@@ -194,8 +200,10 @@ export class ExtensionStore {
       command: typeof input.command === 'string' ? normalizeWindowsPath(input.command) : input.command,
       cwd: typeof input.cwd === 'string' && input.cwd ? normalizeWindowsPath(input.cwd) : input.cwd,
     } : input
-    const config = McpConfig({ ...normalized, serverName: id, failOnStartupError: false })
-    if (config.transport === 'streamable-http') {
+    const config = input.transport === 'sse'
+      ? SseMcpConfig({ ...normalized, serverName: id, failOnStartupError: false })
+      : McpConfig({ ...normalized, serverName: id, failOnStartupError: false })
+    if (config.transport === 'streamable-http' || config.transport === 'sse') {
       const url = new URL(config.url)
       if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new Error('Use an HTTP(S) endpoint without credentials, query or fragment.')
     } else if (!config.command.trim()) throw new Error('MCP command cannot be empty.')
@@ -235,6 +243,7 @@ export class ExtensionStore {
     return this.update(rows => {
       const row = rows.find(row => row.id === id && row.config.serverName)
       if (!row) throw new Error('Unknown MCP server.')
+      row.name = config.transport === 'sse' ? moduleNames.mcpSse : moduleNames.mcp
       row.config = config
     }, signal, expectedRevision)
   }

package/src/web.js

@@ -43,7 +43,7 @@ export async function describeExtensions(store, ctx) {
       kind: row.config.serverName ? 'mcp' : 'skill',
       enabled: !row.disabled,
       location: row.config.transport === 'stdio' ? row.config.command
-        : row.config.transport === 'streamable-http' ? new URL(row.config.url).origin
+        : ['streamable-http', 'sse'].includes(row.config.transport) ? new URL(row.config.url).origin
           : row.config.customSkillDirs[0],
       transport: row.config.transport ?? '',
       configuration: row.config.serverName ? (row.config.transport === 'stdio'
@@ -61,7 +61,7 @@ export function createWebHandler(store, ctx) {
     try {
       if (!Object.hasOwn(schemas, endpoint)) throw new Error('Unknown operation.')
       const args = schemas[endpoint](payload)
-      signal.throwIfAborted()
+      signal?.throwIfAborted()
       if (endpoint === 'add-skill') await store.addSkillPath(args.directory, signal, args.revision)
       if (endpoint === 'add-mcp') {
         const input = JSON.parse(args.configuration)
@@ -97,3 +97,68 @@ export function createWebHandler(store, ctx) {
     }
   }
 }
+
+/** HTTP server route handler that satisfies DSH WebServer and RPC envelope protocols. */
+export function createWebHttpHandler(store, ctx) {
+  const handler = createWebHandler(store, ctx)
+  return async (req, res) => {
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204, {
+        'access-control-allow-origin': '*',
+        'access-control-allow-methods': 'POST, OPTIONS',
+        'access-control-allow-headers': 'content-type, *',
+      })
+      res.end()
+      return
+    }
+    if (req.method !== 'POST') {
+      res.writeHead(405, { 'content-type': 'application/json; charset=utf-8' })
+      res.end(JSON.stringify({ ok: false, error: { message: 'Method Not Allowed' } }))
+      return
+    }
+    const pathname = new URL(req.url ?? '/', 'http://dsh.internal').pathname
+    const endpoint = pathname.startsWith('/extensions/') ? pathname.slice('/extensions/'.length)
+      : pathname === '/extensions' ? 'list' : undefined
+    if (!endpoint) {
+      res.writeHead(404, { 'content-type': 'application/json; charset=utf-8' })
+      res.end(JSON.stringify({ ok: false, error: { message: 'Not Found' } }))
+      return
+    }
+
+    let raw = ''
+    try {
+      for await (const chunk of req) raw += chunk.toString('utf8')
+    } catch {
+      res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' })
+      res.end(JSON.stringify({ ok: false, error: { message: 'Failed to read request body.' } }))
+      return
+    }
+
+    let body = {}
+    if (raw.trim()) {
+      try { body = JSON.parse(raw) }
+      catch {
+        res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' })
+        res.end(JSON.stringify({ ok: false, error: { message: 'Invalid JSON body.' } }))
+        return
+      }
+    }
+
+    const isRpcEnvelope = body && body.type === 'client-request' && typeof body.rpcId === 'string'
+    const actualEndpoint = isRpcEnvelope ? (body.method || endpoint) : endpoint
+    const payload = isRpcEnvelope ? (body.payload ?? {}) : body
+
+    const result = await handler(actualEndpoint, payload, req.signal)
+
+    const responseBody = isRpcEnvelope
+      ? { type: 'server-response', rpcId: body.rpcId, result }
+      : result
+
+    const data = JSON.stringify(responseBody)
+    res.writeHead(200, {
+      'content-type': 'application/json; charset=utf-8',
+      'content-length': Buffer.byteLength(data),
+    })
+    res.end(data)
+  }
+}