dsh-edge 0.15.1 → 0.16.0

package/dist/plugins/dsh-edge-client-ui/client.js

@@ -274,23 +274,43 @@ window.__ModuleLoader__.load({
 			return health.ok === true && health.service === "dsh-edge" && health.status === "ready" && (health.shell === "just-bash-direct" || health.shell === "just-bash-isolated") && health.storage === "durable-object-sqlite-vfs" && typeof health.deploymentId === "string" && typeof health.version === "string" && typeof health.upstreamVersion === "string";
 		}
 		/** Lazy, fail-soft controller for the Edge deployment settings page. */
-		var EdgeSettingsController = class {
+		var EdgeSettingsController = class EdgeSettingsController {
 			io;
 			/** Observable settings state consumed by the client runtime. */
 			store = (0, _deepseek_ai_dsh_client_store.createSnapshotStore)({
 				status: "idle",
 				copied: false,
-				signingOut: false
+				signingOut: false,
+				approvalMode: "never",
+				approvalSaving: false,
+				approvalSaved: false,
+				mcpServers: [],
+				mcpLoaded: false,
+				mcpSaving: false
 			});
 			loadGeneration = 0;
+			approvalGeneration = 0;
+			mcpGeneration = 0;
+			oauthMessageHandler;
 			constructor(io) {
 				this.io = io;
+				this.oauthMessageHandler = (e) => {
+					if (e.data?.type === "mcp-oauth-complete") this.refreshMcpServers();
+				};
+				globalThis.addEventListener?.("message", this.oauthMessageHandler);
+			}
+			dispose() {
+				if (this.oauthMessageHandler !== void 0) {
+					globalThis.removeEventListener?.("message", this.oauthMessageHandler);
+					this.oauthMessageHandler = void 0;
+				}
 			}
 			/** Load the current deployment projection without affecting owner-session state. */
 			async load() {
 				const generation = ++this.loadGeneration;
 				this.store.update((state) => {
 					state.status = "loading";
+					state.mcpLoaded = false;
 					delete state.error;
 				});
 				try {
@@ -308,6 +328,36 @@ window.__ModuleLoader__.load({
 						delete state.latestVersion;
 						delete state.error;
 					});
+					const approvalGen = ++this.approvalGeneration;
+					try {
+						const approvalResponse = await this.io.fetch("/api/approval-mode", { credentials: "same-origin" });
+						if (approvalGen === this.approvalGeneration) {
+							if (approvalResponse.ok) {
+								const data = await approvalResponse.json();
+								if (approvalGen === this.approvalGeneration && (data.mode === "ask" || data.mode === "never")) this.store.update((state) => {
+									state.approvalMode = data.mode;
+									delete state.approvalError;
+								});
+							} else this.store.update((state) => {
+								state.approvalError = `HTTP ${String(approvalResponse.status)}`;
+							});
+						}
+					} catch {
+						if (approvalGen === this.approvalGeneration) this.store.update((state) => {
+							state.approvalError = "Could not load approval setting.";
+						});
+					}
+					const mcpGen = ++this.mcpGeneration;
+					try {
+						const mcpResponse = await this.io.fetch("/api/mcp-servers", { credentials: "same-origin" });
+						if (mcpGen === this.mcpGeneration && mcpResponse.ok) {
+							const data = await mcpResponse.json();
+							if (mcpGen === this.mcpGeneration && Array.isArray(data.servers)) this.store.update((state) => {
+								state.mcpServers = data.servers;
+								state.mcpLoaded = true;
+							});
+						}
+					} catch {}
 					let latestVersion;
 					try {
 						const releaseResponse = await this.io.fetch(`https://registry.npmjs.org/dsh-edge/${channel}`, { signal: AbortSignal.timeout(5e3) });
@@ -330,7 +380,234 @@ window.__ModuleLoader__.load({
 					});
 				}
 			}
-			/** Copy the matching channel upgrade command without affecting deployment state. */
+			async setApprovalMode(mode) {
+				this.approvalGeneration++;
+				this.store.update((state) => {
+					state.approvalSaving = true;
+					state.approvalSaved = false;
+					delete state.approvalError;
+				});
+				try {
+					const response = await this.io.fetch("/api/approval-mode", {
+						method: "PUT",
+						credentials: "same-origin",
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify({ mode })
+					});
+					if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+					this.store.update((state) => {
+						state.approvalMode = mode;
+						state.approvalSaving = false;
+						state.approvalSaved = true;
+					});
+				} catch (error) {
+					this.store.update((state) => {
+						state.approvalSaving = false;
+						state.approvalError = messageOf(error);
+					});
+				}
+			}
+			async refreshMcpServers() {
+				const mcpGen = ++this.mcpGeneration;
+				try {
+					const response = await this.io.fetch("/api/mcp-servers", { credentials: "same-origin" });
+					if (mcpGen === this.mcpGeneration && response.ok) {
+						const data = await response.json();
+						if (mcpGen === this.mcpGeneration && Array.isArray(data.servers)) this.store.update((state) => {
+							state.mcpServers = data.servers;
+							state.mcpLoaded = true;
+						});
+					}
+				} catch {}
+			}
+			static stripServerManagedFields(servers) {
+				return servers.map(({ serverName, url, auth, toolPolicy, toolCallTimeoutMs }) => ({
+					serverName,
+					url,
+					...auth !== void 0 ? { auth } : {},
+					...toolPolicy !== void 0 ? { toolPolicy } : {},
+					...toolCallTimeoutMs !== void 0 ? { toolCallTimeoutMs } : {}
+				}));
+			}
+			async saveMcpServers(servers) {
+				this.mcpGeneration++;
+				this.store.update((state) => {
+					state.mcpSaving = true;
+					delete state.mcpError;
+				});
+				try {
+					const response = await this.io.fetch("/api/mcp-servers", {
+						method: "PUT",
+						credentials: "same-origin",
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify({ servers: EdgeSettingsController.stripServerManagedFields(servers) })
+					});
+					if (!response.ok) {
+						const data = await response.json().catch(() => ({}));
+						throw new Error(data.error ?? `HTTP ${String(response.status)}`);
+					}
+					const saved = (await response.json()).servers ?? servers;
+					this.store.update((state) => {
+						state.mcpServers = saved;
+					});
+					const probeErrors = [];
+					for (const s of saved) {
+						if (s.auth?.type === "oauth") continue;
+						try {
+							const probeRes = await this.io.fetch(`/api/mcp-servers/${encodeURIComponent(s.serverName)}/probe`, {
+								method: "POST",
+								credentials: "same-origin"
+							});
+							if (!probeRes.ok) {
+								const data = await probeRes.json().catch(() => ({}));
+								probeErrors.push(`${s.serverName}: ${data.error ?? "probe failed"}`);
+							}
+						} catch {
+							probeErrors.push(`${s.serverName}: network error`);
+						}
+					}
+					await this.refreshMcpServers();
+					this.store.update((state) => {
+						state.mcpSaving = false;
+					});
+					return true;
+				} catch (error) {
+					this.store.update((state) => {
+						state.mcpSaving = false;
+						state.mcpError = messageOf(error);
+					});
+					return false;
+				}
+			}
+			async setMcpToolPolicy(serverName, mode) {
+				const updated = this.store.getSnapshot().mcpServers.map((s) => s.serverName === serverName ? {
+					...s,
+					toolPolicy: { mode }
+				} : s);
+				try {
+					const response = await this.io.fetch("/api/mcp-servers", {
+						method: "PUT",
+						credentials: "same-origin",
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify({ servers: EdgeSettingsController.stripServerManagedFields(updated) })
+					});
+					if (!response.ok) {
+						const data = await response.json().catch(() => ({}));
+						this.store.update((state) => {
+							state.mcpError = data.error ?? "Policy update failed";
+						});
+						return false;
+					}
+					const result = await response.json();
+					if (Array.isArray(result.servers)) this.store.update((state) => {
+						state.mcpServers = result.servers;
+						delete state.mcpError;
+					});
+					return true;
+				} catch {
+					return false;
+				}
+			}
+			async probeMcpServer(serverName) {
+				try {
+					if (!(await this.io.fetch(`/api/mcp-servers/${encodeURIComponent(serverName)}/probe`, {
+						method: "POST",
+						credentials: "same-origin"
+					})).ok) {
+						await this.refreshMcpServers();
+						return false;
+					}
+					await this.refreshMcpServers();
+					return true;
+				} catch {
+					await this.refreshMcpServers().catch(() => {});
+					return false;
+				}
+			}
+			async getMcpTools(serverName) {
+				try {
+					const response = await this.io.fetch(`/api/mcp-servers/${encodeURIComponent(serverName)}/tools`, { credentials: "same-origin" });
+					if (!response.ok) return [];
+					return (await response.json()).tools ?? [];
+				} catch {
+					return [];
+				}
+			}
+			async saveMcpToken(serverName, token) {
+				try {
+					if (!(await this.io.fetch(`/api/mcp-servers/${encodeURIComponent(serverName)}/token`, {
+						method: "PUT",
+						credentials: "same-origin",
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify({ token })
+					})).ok) return false;
+					await this.io.fetch(`/api/mcp-servers/${encodeURIComponent(serverName)}/probe`, {
+						method: "POST",
+						credentials: "same-origin"
+					}).catch(() => {});
+					await this.refreshMcpServers();
+					return true;
+				} catch {
+					return false;
+				}
+			}
+			async startOAuthConnect(serverName, serverUrl) {
+				const redirectUri = `${globalThis.location?.origin ?? ""}/api/mcp/oauth/callback`;
+				try {
+					const response = await this.io.fetch("/api/mcp/oauth/start", {
+						method: "POST",
+						credentials: "same-origin",
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify({
+							serverName,
+							serverUrl,
+							redirectUri
+						})
+					});
+					if (!response.ok) {
+						const data = await response.json().catch(() => ({}));
+						this.store.update((state) => {
+							state.mcpError = data.error ?? "OAuth start failed";
+						});
+						return;
+					}
+					return (await response.json()).authorizationUrl;
+				} catch (error) {
+					this.store.update((state) => {
+						state.mcpError = messageOf(error);
+					});
+					return;
+				}
+			}
+			async completeOAuthConnect(code, state) {
+				try {
+					const response = await this.io.fetch("/api/mcp/oauth/complete", {
+						method: "POST",
+						credentials: "same-origin",
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify({
+							code,
+							state
+						})
+					});
+					if (!response.ok) {
+						const data = await response.json().catch(() => ({}));
+						this.store.update((state) => {
+							state.mcpError = data.error ?? "OAuth complete failed";
+						});
+						return false;
+					}
+					return true;
+				} catch {
+					return false;
+				}
+			}
+			async clearMcpToken(serverName) {
+				await this.io.fetch(`/api/mcp-servers/${encodeURIComponent(serverName)}/token`, {
+					method: "DELETE",
+					credentials: "same-origin"
+				}).catch(() => {});
+			}
 			async copyUpgrade() {
 				try {
 					const version = this.store.getSnapshot().health?.version ?? "0.0.0";
@@ -370,7 +647,7 @@ window.__ModuleLoader__.load({
 		};
 		//#endregion
 		//#region \0dsh-edge-css:src/client/EdgeSettingsSection.module.css.mjs
-		const css = "._68Y4qa_section{gap:20px;max-width:720px;display:grid}._68Y4qa_section header h2,._68Y4qa_card h3{color:var(--dsw-alias-text-primary);margin:0}._68Y4qa_section header p,._68Y4qa_card p{color:var(--dsw-alias-label-secondary)}._68Y4qa_card{border:1px solid var(--dsw-alias-border-subtle);border-radius:12px;padding:18px}._68Y4qa_card dl{margin:12px 0}._68Y4qa_row{border-bottom:1px solid var(--dsw-alias-border-secondary);grid-template-columns:minmax(150px,1fr) minmax(0,2fr);gap:16px;padding:8px 0;display:grid}._68Y4qa_row:last-child{border-bottom:0}._68Y4qa_row dt{color:var(--dsw-alias-label-secondary)}._68Y4qa_row dd{overflow-wrap:anywhere;color:var(--dsw-alias-text-primary);margin:0}._68Y4qa_actions{flex-wrap:wrap;align-items:center;gap:12px;display:flex}._68Y4qa_actions a{color:var(--dsw-alias-brand-primary)}._68Y4qa_status{align-items:center;gap:8px;display:flex}._68Y4qa_notice{color:var(--dsw-alias-label-secondary)}._68Y4qa_error{color:var(--dsw-alias-state-error-primary)!important}@media (width<=560px){._68Y4qa_row{grid-template-columns:1fr;gap:4px}}";
+		const css = "._68Y4qa_section{gap:20px;max-width:720px;display:grid}._68Y4qa_section header h2,._68Y4qa_card h3{color:var(--dsw-alias-text-primary);margin:0}._68Y4qa_section header p,._68Y4qa_card p{color:var(--dsw-alias-label-secondary)}._68Y4qa_card{border:1px solid var(--dsw-alias-border-subtle);border-radius:12px;padding:18px}._68Y4qa_card dl{margin:12px 0}._68Y4qa_row{border-bottom:1px solid var(--dsw-alias-border-secondary);grid-template-columns:minmax(150px,1fr) minmax(0,2fr);gap:16px;padding:8px 0;display:grid}._68Y4qa_row:last-child{border-bottom:0}._68Y4qa_row dt{color:var(--dsw-alias-label-secondary)}._68Y4qa_row dd{overflow-wrap:anywhere;color:var(--dsw-alias-text-primary);margin:0}._68Y4qa_actions{flex-wrap:wrap;align-items:center;gap:12px;display:flex}._68Y4qa_actions a{color:var(--dsw-alias-brand-primary)}._68Y4qa_status{align-items:center;gap:8px;display:flex}._68Y4qa_notice{color:var(--dsw-alias-label-tertiary,var(--dsw-alias-label-secondary));font-size:13px}._68Y4qa_error{word-break:break-word;overflow-wrap:anywhere;font-size:13px;color:var(--dsw-alias-state-error-primary)!important}._68Y4qa_select{border:.5px solid var(--dsw-alias-border-l4,var(--dsw-alias-border-subtle));background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-background-primary));color:var(--dsw-alias-label-primary,var(--dsw-alias-text-primary));height:34px;font:inherit;appearance:none;background-image:url(\"data:image/svg+xml,%3Csvg width='10' height='6' viewBox='0 0 10 6' fill='none' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath d='M1 1l4 4 4-4' stroke='%23999' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E\");background-position:right 10px center;background-repeat:no-repeat;border-radius:8px;padding:0 28px 0 10px;font-size:13px;line-height:1.5}._68Y4qa_select:focus-visible{border-color:var(--dsw-alias-brand-primary);outline:none}._68Y4qa_input{border:.5px solid var(--dsw-alias-border-l4,var(--dsw-alias-border-subtle));background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-background-primary));color:var(--dsw-alias-label-primary,var(--dsw-alias-text-primary));height:34px;font:inherit;box-sizing:border-box;border-radius:8px;width:100%;padding:0 12px;font-size:13px;line-height:1.5}._68Y4qa_input:focus-visible{border-color:var(--dsw-alias-brand-primary);outline:none}._68Y4qa_mcpList{flex-direction:column;gap:10px;margin:0;padding:0;list-style:none;display:flex}._68Y4qa_mcpCard{border:.5px solid var(--dsw-alias-border-l4,var(--dsw-alias-border-subtle));background:var(--dsw-alias-bg-layer-3,transparent);border-radius:16px;list-style:none;transition:border-color .16s,background .16s}._68Y4qa_mcpCard:hover{border-color:var(--dsw-alias-label-dimmed,#bbb)}._68Y4qa_mcpCardOpen{background:var(--dsw-alias-bg-layer-2,transparent);border-color:var(--dsw-alias-label-dimmed,#bbb)}._68Y4qa_mcpCardHeader{appearance:none;width:100%;font:inherit;color:inherit;text-align:left;cursor:pointer;background:0 0;border:0;border-radius:12px;align-items:center;gap:12px;padding:14px 16px;display:flex}._68Y4qa_mcpCardHeader:focus-visible{outline:2px solid var(--dsw-alias-brand-primary);outline-offset:-2px}._68Y4qa_mcpAvatar{background:var(--dsw-alias-brand-background,#eef2fe);width:32px;height:32px;color:var(--dsw-alias-brand-primary);border-radius:8px;flex-shrink:0;justify-content:center;align-items:center;font-size:14px;font-weight:600;display:flex}._68Y4qa_mcpCardTitleGroup{flex-direction:column;flex:1;gap:4px;min-width:0;display:flex}._68Y4qa_mcpCardName{color:var(--dsw-alias-label-primary,var(--dsw-alias-text-primary));margin:0;font-size:15px;font-weight:600;line-height:1.4}._68Y4qa_mcpCardSub{color:var(--dsw-alias-label-tertiary,var(--dsw-alias-label-secondary));align-items:center;gap:8px;margin:0;font-size:13px;line-height:1.5;display:flex}._68Y4qa_mcpChevron{color:var(--dsw-alias-label-tertiary,var(--dsw-alias-label-secondary));flex:none;transition:transform .16s}._68Y4qa_mcpChevronOpen{transform:rotate(180deg)}._68Y4qa_mcpChevron svg{display:block}._68Y4qa_mcpBadge{border-radius:4px;padding:1px 6px;font-size:11px;font-weight:500}._68Y4qa_mcpBadge[data-status=connected]{background:var(--dsw-alias-state-success-background,#ecfdf3);color:var(--dsw-alias-state-success-primary,#16a34a)}._68Y4qa_mcpBadge[data-status=error]{background:var(--dsw-alias-state-error-background,#fff0f0);color:var(--dsw-alias-state-error-primary,#dc2626)}._68Y4qa_mcpBadge[data-status=needs_reauth]{background:var(--dsw-alias-state-warning-background,#fff8e6);color:var(--dsw-alias-state-warning-primary,#d97706)}._68Y4qa_mcpBadge[data-status=unknown]{background:var(--dsw-alias-background-secondary,#f3f4f6);color:var(--dsw-alias-label-tertiary,var(--dsw-alias-label-secondary))}._68Y4qa_mcpCardBody{border-top:.5px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-secondary));gap:12px;min-width:0;margin:0 16px;padding:12px 0 8px;display:grid}._68Y4qa_mcpFieldRow{grid-template-columns:140px 1fr;align-items:center;gap:12px;display:grid}._68Y4qa_mcpFieldLabel{color:var(--dsw-alias-label-tertiary,var(--dsw-alias-label-secondary));font-size:13px;line-height:1.5}._68Y4qa_mcpFieldValue{color:var(--dsw-alias-label-primary,var(--dsw-alias-text-primary));font-size:13px;line-height:1.5}._68Y4qa_mcpCardSuccess{color:var(--dsw-alias-state-success-primary,#16a34a);margin:0;padding:4px 0;font-size:12px;line-height:1.4}._68Y4qa_mcpCardError{color:var(--dsw-alias-state-error-primary,#dc2626);margin:0;padding:4px 0;font-size:12px;line-height:1.4}._68Y4qa_mcpCardActions{border-top:.5px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-secondary));justify-content:flex-end;align-items:center;gap:8px;padding:12px 0 4px;display:flex}._68Y4qa_mcpAddTrigger{appearance:none;width:100%;font:inherit;cursor:pointer;border:.5px dashed var(--dsw-alias-border-l4,var(--dsw-alias-border-subtle));color:var(--dsw-alias-label-tertiary,var(--dsw-alias-label-secondary));background:0 0;border-radius:16px;justify-content:center;align-items:center;gap:6px;padding:14px 16px;font-size:13px;line-height:1.5;transition:border-color .16s,color .16s;display:flex}._68Y4qa_mcpAddTrigger:hover{border-color:var(--dsw-alias-label-dimmed,#bbb);color:var(--dsw-alias-label-primary,var(--dsw-alias-text-primary))}._68Y4qa_mcpAddTrigger:focus-visible{outline:2px solid var(--dsw-alias-brand-primary);outline-offset:-2px}._68Y4qa_mcpToolList{flex-direction:column;gap:6px;display:flex}._68Y4qa_mcpToolItems{flex-direction:column;gap:0;min-width:0;max-height:300px;margin:4px 0 0;padding:0;list-style:none;display:flex;overflow-y:auto}._68Y4qa_mcpToolItem{border-bottom:.5px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-secondary));flex-wrap:wrap;align-items:baseline;gap:4px 8px;padding:6px 0;display:flex}._68Y4qa_mcpToolItem:last-child{border-bottom:none}._68Y4qa_mcpToolName{font-family:var(--ds-font-family-code,monospace);color:var(--dsw-alias-label-primary,var(--dsw-alias-text-primary));font-size:12px}._68Y4qa_mcpToolDesc{color:var(--dsw-alias-label-tertiary,var(--dsw-alias-label-secondary));width:100%;font-size:12px;line-height:1.4}._68Y4qa_mcpAddForm{border:.5px solid var(--dsw-alias-border-l4,var(--dsw-alias-border-subtle));border-radius:16px;gap:14px;padding:16px;display:grid}._68Y4qa_mcpFormRow{grid-template-columns:1fr 1fr;gap:10px;display:grid}._68Y4qa_mcpFormActions{justify-content:flex-end;gap:8px;display:flex}@media (width<=560px){._68Y4qa_row{grid-template-columns:1fr;gap:4px}._68Y4qa_mcpFormRow{grid-template-columns:1fr}._68Y4qa_mcpFieldRow{grid-template-columns:1fr;gap:4px}}";
 		const tagId = "dsh-edge-client-ui/src/client/EdgeSettingsSection.module.css";
 		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
 			const tag = document.createElement("style");
@@ -383,9 +660,38 @@ window.__ModuleLoader__.load({
 			"actions": "_68Y4qa_actions",
 			"card": "_68Y4qa_card",
 			"error": "_68Y4qa_error",
+			"input": "_68Y4qa_input",
+			"mcpAddForm": "_68Y4qa_mcpAddForm",
+			"mcpAddTrigger": "_68Y4qa_mcpAddTrigger",
+			"mcpAvatar": "_68Y4qa_mcpAvatar",
+			"mcpBadge": "_68Y4qa_mcpBadge",
+			"mcpCard": "_68Y4qa_mcpCard",
+			"mcpCardActions": "_68Y4qa_mcpCardActions",
+			"mcpCardBody": "_68Y4qa_mcpCardBody",
+			"mcpCardError": "_68Y4qa_mcpCardError",
+			"mcpCardHeader": "_68Y4qa_mcpCardHeader",
+			"mcpCardName": "_68Y4qa_mcpCardName",
+			"mcpCardOpen": "_68Y4qa_mcpCardOpen",
+			"mcpCardSub": "_68Y4qa_mcpCardSub",
+			"mcpCardSuccess": "_68Y4qa_mcpCardSuccess",
+			"mcpCardTitleGroup": "_68Y4qa_mcpCardTitleGroup",
+			"mcpChevron": "_68Y4qa_mcpChevron",
+			"mcpChevronOpen": "_68Y4qa_mcpChevronOpen",
+			"mcpFieldLabel": "_68Y4qa_mcpFieldLabel",
+			"mcpFieldRow": "_68Y4qa_mcpFieldRow",
+			"mcpFieldValue": "_68Y4qa_mcpFieldValue",
+			"mcpFormActions": "_68Y4qa_mcpFormActions",
+			"mcpFormRow": "_68Y4qa_mcpFormRow",
+			"mcpList": "_68Y4qa_mcpList",
+			"mcpToolDesc": "_68Y4qa_mcpToolDesc",
+			"mcpToolItem": "_68Y4qa_mcpToolItem",
+			"mcpToolItems": "_68Y4qa_mcpToolItems",
+			"mcpToolList": "_68Y4qa_mcpToolList",
+			"mcpToolName": "_68Y4qa_mcpToolName",
 			"notice": "_68Y4qa_notice",
 			"row": "_68Y4qa_row",
 			"section": "_68Y4qa_section",
+			"select": "_68Y4qa_select",
 			"status": "_68Y4qa_status"
 		};
 		//#endregion
@@ -397,7 +703,7 @@ window.__ModuleLoader__.load({
 			});
 		}
 		function EdgeSettingsSection(props) {
-			const { useEdgeSettings, load, copyUpgrade, signOut, t } = props;
+			const { useEdgeSettings, load, copyUpgrade, signOut, setApprovalMode, t } = props;
 			(0, react.useEffect)(() => {
 				load();
 			}, [load]);
@@ -494,6 +800,44 @@ window.__ModuleLoader__.load({
 				children: [
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("header", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h2", { children: t("title") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("intro") })] }),
 					deploymentDetails,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+						className: EdgeSettingsSection_module_css_default.card,
+						"aria-labelledby": "edge-approval-title",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
+								id: "edge-approval-title",
+								children: t("toolPermissions")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dl", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Row, {
+								label: t("approvalMode"),
+								value: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+									className: EdgeSettingsSection_module_css_default.select,
+									value: state.approvalMode,
+									disabled: state.approvalSaving || state.status !== "ready",
+									"aria-label": t("approvalMode"),
+									onChange: (e) => {
+										setApprovalMode(e.target.value);
+									},
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+										value: "ask",
+										children: t("approvalAsk")
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+										value: "never",
+										children: t("approvalNever")
+									})]
+								})
+							}) }),
+							state.approvalSaved ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: EdgeSettingsSection_module_css_default.status,
+								children: t("approvalSaved")
+							}) : null,
+							state.approvalError !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: EdgeSettingsSection_module_css_default.error,
+								role: "alert",
+								children: t("approvalError")
+							}) : null
+						]
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 						className: EdgeSettingsSection_module_css_default.card,
 						"aria-labelledby": "edge-owner-title",
@@ -523,6 +867,467 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
+		//#region ../../../packages/client/ui-edge/src/client/EdgeMcpSection.tsx
+		function ChevronIcon({ expanded }) {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+				className: `${EdgeSettingsSection_module_css_default.mcpChevron}${expanded ? ` ${EdgeSettingsSection_module_css_default.mcpChevronOpen}` : ""}`,
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("svg", {
+					width: "16",
+					height: "16",
+					viewBox: "0 0 16 16",
+					fill: "none",
+					children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+						d: "M4 6l4 4 4-4",
+						stroke: "currentColor",
+						strokeWidth: "1.5",
+						strokeLinecap: "round",
+						strokeLinejoin: "round"
+					})
+				})
+			});
+		}
+		function McpConnectorCard({ server: s, saving, disabled, expanded, onToggle, onRemove, onSetToolPolicy, onProbe, onGetTools, onOAuthConnect, connecting, t }) {
+			const hasTools = s.toolCount !== void 0 && s.toolCount > 0;
+			const [probing, setProbing] = (0, react.useState)(false);
+			const [tools, setTools] = (0, react.useState)(null);
+			const [toolsLoading, setToolsLoading] = (0, react.useState)(false);
+			(0, react.useEffect)(() => {
+				if (expanded && hasTools && tools === null && !toolsLoading) {
+					setToolsLoading(true);
+					onGetTools().then((t) => {
+						setTools(t);
+						setToolsLoading(false);
+					});
+				}
+				if (!expanded) setTools(null);
+			}, [expanded, hasTools]);
+			const authLabel = s.auth?.type === "oauth" ? "OAuth 2.1" : s.auth?.type === "bearer" ? "Bearer Token" : t("mcpAuthNone");
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: `${EdgeSettingsSection_module_css_default.mcpCard}${expanded ? ` ${EdgeSettingsSection_module_css_default.mcpCardOpen}` : ""}`,
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+					type: "button",
+					className: EdgeSettingsSection_module_css_default.mcpCardHeader,
+					"aria-expanded": expanded,
+					onClick: onToggle,
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: EdgeSettingsSection_module_css_default.mcpAvatar,
+							children: s.serverName.charAt(0).toUpperCase()
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: EdgeSettingsSection_module_css_default.mcpCardTitleGroup,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: EdgeSettingsSection_module_css_default.mcpCardName,
+								children: s.serverName
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: EdgeSettingsSection_module_css_default.mcpCardSub,
+								children: s.auth?.type !== void 0 && s.auth.type !== "none" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: EdgeSettingsSection_module_css_default.mcpBadge,
+									"data-status": "unknown",
+									children: s.auth.type.toUpperCase()
+								}) : null
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ChevronIcon, { expanded })
+					]
+				}), expanded ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: EdgeSettingsSection_module_css_default.mcpCardBody,
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: EdgeSettingsSection_module_css_default.mcpFieldRow,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: EdgeSettingsSection_module_css_default.mcpFieldLabel,
+								children: "URL"
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", {
+								className: EdgeSettingsSection_module_css_default.mcpFieldValue,
+								style: {
+									fontSize: 12,
+									wordBreak: "break-all"
+								},
+								children: s.url
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: EdgeSettingsSection_module_css_default.mcpFieldRow,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: EdgeSettingsSection_module_css_default.mcpFieldLabel,
+								children: t("mcpAuthLabel")
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: EdgeSettingsSection_module_css_default.mcpFieldValue,
+								children: authLabel
+							})]
+						}),
+						s.serverInfo?.name !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: EdgeSettingsSection_module_css_default.mcpFieldRow,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: EdgeSettingsSection_module_css_default.mcpFieldLabel,
+								children: t("mcpServerInfo")
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: EdgeSettingsSection_module_css_default.mcpFieldValue,
+								children: [s.serverInfo.name, s.serverInfo.version !== void 0 ? ` v${s.serverInfo.version}` : ""]
+							})]
+						}) : null,
+						s.status === "connected" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+							className: EdgeSettingsSection_module_css_default.mcpCardSuccess,
+							children: [
+								s.toolCount ?? 0,
+								" ",
+								t("mcpTools"),
+								" · ",
+								t("mcpConnected")
+							]
+						}) : s.status === "error" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: EdgeSettingsSection_module_css_default.mcpCardError,
+							children: t("mcpConnectionFailed")
+						}) : null,
+						s.status === "connected" || hasTools ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: EdgeSettingsSection_module_css_default.mcpFieldRow,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: EdgeSettingsSection_module_css_default.mcpFieldLabel,
+								children: t("mcpToolPolicy")
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+								className: EdgeSettingsSection_module_css_default.select,
+								value: s.toolPolicy?.mode ?? "read_only",
+								disabled: saving || disabled,
+								"aria-label": t("mcpToolPolicy"),
+								onChange: (e) => onSetToolPolicy(e.target.value),
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+										value: "approve_all",
+										children: t("mcpPolicyApproveAll")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+										value: "read_only",
+										children: t("mcpPolicyReadOnly")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+										value: "allow_all",
+										children: t("mcpPolicyAllowAll")
+									})
+								]
+							})]
+						}) : null,
+						hasTools && tools !== null && tools.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: EdgeSettingsSection_module_css_default.mcpToolList,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: EdgeSettingsSection_module_css_default.mcpFieldLabel,
+								children: [
+									t("mcpToolsLabel"),
+									" (",
+									tools.length,
+									")"
+								]
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+								className: EdgeSettingsSection_module_css_default.mcpToolItems,
+								children: tools.map((tool) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
+									className: EdgeSettingsSection_module_css_default.mcpToolItem,
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", {
+											className: EdgeSettingsSection_module_css_default.mcpToolName,
+											children: tool.name
+										}),
+										tool.readOnly === true ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: EdgeSettingsSection_module_css_default.mcpBadge,
+											"data-status": "connected",
+											children: t("mcpRead")
+										}) : tool.readOnly === false ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: EdgeSettingsSection_module_css_default.mcpBadge,
+											"data-status": "error",
+											children: t("mcpWrite")
+										}) : null,
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: EdgeSettingsSection_module_css_default.mcpToolDesc,
+											children: tool.description
+										})
+									]
+								}, tool.publicName))
+							})]
+						}) : toolsLoading ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: EdgeSettingsSection_module_css_default.mcpFieldLabel,
+							children: t("loading")
+						}) : null,
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: EdgeSettingsSection_module_css_default.mcpCardActions,
+							children: [s.auth?.type === "oauth" && s.status !== "connected" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								variant: "outline",
+								size: "sm",
+								disabled: saving || disabled || connecting,
+								onClick: onOAuthConnect,
+								children: connecting ? t("mcpConnecting") : s.status === "needs_reauth" ? t("mcpReconnect") : t("mcpConnect")
+							}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								variant: "outline",
+								size: "sm",
+								disabled: saving || disabled || probing,
+								onClick: () => {
+									setProbing(true);
+									onProbe().then(() => onGetTools().then(setTools)).finally(() => setProbing(false));
+								},
+								children: probing ? t("mcpProbing") : t("mcpRefresh")
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								variant: "outline",
+								size: "sm",
+								disabled: saving || disabled,
+								onClick: onRemove,
+								children: t("mcpRemove")
+							})]
+						})
+					]
+				}) : null]
+			});
+		}
+		function EdgeMcpSection(props) {
+			const { useEdgeSettings, load, saveMcpServers, saveMcpToken, setMcpToolPolicy, probeMcpServer, getMcpTools, startOAuthConnect, t } = props;
+			(0, react.useEffect)(() => {
+				load();
+			}, [load]);
+			const state = useEdgeSettings((snapshot) => snapshot);
+			const servers = state.mcpServers;
+			const saving = state.mcpSaving;
+			const disabled = state.status !== "ready" || !state.mcpLoaded;
+			const [expandedServer, setExpandedServer] = (0, react.useState)(null);
+			const [connectingServer, setConnectingServer] = (0, react.useState)(null);
+			const [popupError, setPopupError] = (0, react.useState)(null);
+			const [showAddForm, setShowAddForm] = (0, react.useState)(false);
+			(0, react.useEffect)(() => {
+				const handler = (e) => {
+					if (e.data?.type === "mcp-oauth-complete") setConnectingServer(null);
+				};
+				globalThis.addEventListener?.("message", handler);
+				return () => globalThis.removeEventListener?.("message", handler);
+			}, []);
+			const [draft, setDraft] = (0, react.useState)({
+				serverName: "",
+				url: "",
+				authType: "none",
+				token: ""
+			});
+			const addServer = (0, react.useCallback)(() => {
+				if (draft.serverName.trim() === "" || draft.url.trim() === "") return;
+				const entry = {
+					serverName: draft.serverName.trim(),
+					url: draft.url.trim(),
+					auth: { type: draft.authType }
+				};
+				(async () => {
+					const name = draft.serverName.trim();
+					if (!/^[A-Za-z0-9_-]{1,32}$/u.test(name)) return;
+					try {
+						new URL(draft.url.trim());
+					} catch {
+						return;
+					}
+					if (servers.some((s) => s.serverName === name)) return;
+					if (draft.authType === "bearer" && draft.token.trim() !== "") {
+						if (!await saveMcpToken(name, draft.token.trim())) return;
+					}
+					if (!await saveMcpServers([...servers, entry])) return;
+					const addedName = name;
+					const addedUrl = draft.url.trim();
+					const addedAuth = draft.authType;
+					setDraft({
+						serverName: "",
+						url: "",
+						authType: "none",
+						token: ""
+					});
+					setShowAddForm(false);
+					setExpandedServer(addedName);
+					if (addedAuth === "oauth") {
+						setConnectingServer(addedName);
+						const authUrl = await startOAuthConnect(addedName, addedUrl);
+						if (authUrl === void 0) setConnectingServer(null);
+						else {
+							const popup = globalThis.open(authUrl, "_blank", "width=600,height=700");
+							if (!popup) {
+								setConnectingServer(null);
+								setPopupError(addedName);
+							} else {
+								const check = setInterval(() => {
+									if (popup.closed) {
+										clearInterval(check);
+										setConnectingServer((c) => c === addedName ? null : c);
+									}
+								}, 500);
+							}
+						}
+					}
+				})();
+			}, [
+				draft,
+				servers,
+				saveMcpServers,
+				saveMcpToken
+			]);
+			const removeServer = (0, react.useCallback)((name) => {
+				saveMcpServers(servers.filter((s) => s.serverName !== name));
+				if (expandedServer === name) setExpandedServer(null);
+			}, [
+				servers,
+				saveMcpServers,
+				expandedServer
+			]);
+			if (state.status === "idle" || state.status === "loading") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: EdgeSettingsSection_module_css_default.section,
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					className: EdgeSettingsSection_module_css_default.notice,
+					children: t("loading")
+				})
+			});
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: EdgeSettingsSection_module_css_default.section,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("header", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h2", { children: t("mcpServers") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						style: { margin: "4px 0 0" },
+						children: t("mcpIntro")
+					})] }),
+					servers.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+						className: EdgeSettingsSection_module_css_default.mcpList,
+						children: servers.map((s) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(McpConnectorCard, {
+							server: s,
+							saving,
+							disabled,
+							expanded: expandedServer === s.serverName,
+							onToggle: () => setExpandedServer((prev) => prev === s.serverName ? null : s.serverName),
+							onRemove: () => removeServer(s.serverName),
+							onSetToolPolicy: (mode) => {
+								setMcpToolPolicy(s.serverName, mode);
+							},
+							onProbe: () => probeMcpServer(s.serverName),
+							onGetTools: () => getMcpTools(s.serverName),
+							onOAuthConnect: () => {
+								setConnectingServer(s.serverName);
+								setPopupError(null);
+								startOAuthConnect(s.serverName, s.url).then((authUrl) => {
+									if (authUrl === void 0) {
+										setConnectingServer(null);
+										return;
+									}
+									const popup = globalThis.open(authUrl, "_blank", "width=600,height=700");
+									if (!popup) {
+										setConnectingServer(null);
+										setPopupError(s.serverName);
+										return;
+									}
+									const check = setInterval(() => {
+										if (popup.closed) {
+											clearInterval(check);
+											setConnectingServer((c) => c === s.serverName ? null : c);
+										}
+									}, 500);
+								});
+							},
+							connecting: connectingServer === s.serverName,
+							t
+						}) }, s.serverName))
+					}) : null,
+					!showAddForm ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+						type: "button",
+						className: EdgeSettingsSection_module_css_default.mcpAddTrigger,
+						disabled: saving || disabled,
+						onClick: () => setShowAddForm(true),
+						children: ["+ ", t("mcpAddServer")]
+					}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: EdgeSettingsSection_module_css_default.mcpAddForm,
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: EdgeSettingsSection_module_css_default.mcpFormRow,
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									className: EdgeSettingsSection_module_css_default.input,
+									placeholder: t("mcpNamePlaceholder"),
+									value: draft.serverName,
+									disabled: saving || disabled,
+									onChange: (e) => setDraft((d) => ({
+										...d,
+										serverName: e.target.value
+									}))
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									className: EdgeSettingsSection_module_css_default.input,
+									placeholder: t("mcpUrlPlaceholder"),
+									value: draft.url,
+									disabled: saving || disabled,
+									onChange: (e) => setDraft((d) => ({
+										...d,
+										url: e.target.value
+									}))
+								})]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: EdgeSettingsSection_module_css_default.mcpFormRow,
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+									className: EdgeSettingsSection_module_css_default.select,
+									style: { width: "100%" },
+									value: draft.authType,
+									disabled: saving || disabled,
+									"aria-label": "Auth type",
+									onChange: (e) => setDraft((d) => ({
+										...d,
+										authType: e.target.value
+									})),
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+											value: "none",
+											children: t("mcpAuthNone")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+											value: "bearer",
+											children: t("mcpAuthBearer")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+											value: "oauth",
+											children: t("mcpAuthOAuth")
+										})
+									]
+								}), draft.authType === "bearer" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									className: EdgeSettingsSection_module_css_default.input,
+									type: "password",
+									placeholder: t("mcpTokenPlaceholder"),
+									value: draft.token,
+									disabled: saving || disabled,
+									onChange: (e) => setDraft((d) => ({
+										...d,
+										token: e.target.value
+									}))
+								}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {})]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: EdgeSettingsSection_module_css_default.mcpFormActions,
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									variant: "outline",
+									size: "sm",
+									onClick: () => {
+										setShowAddForm(false);
+										setDraft({
+											serverName: "",
+											url: "",
+											authType: "none",
+											token: ""
+										});
+									},
+									children: t("mcpCancel")
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									variant: "outline",
+									size: "sm",
+									disabled: saving || disabled || draft.serverName.trim() === "" || draft.url.trim() === "" || draft.authType === "bearer" && draft.token.trim() === "",
+									onClick: addServer,
+									children: t("mcpAdd")
+								})]
+							})
+						]
+					}),
+					popupError !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: EdgeSettingsSection_module_css_default.error,
+						role: "alert",
+						children: t("mcpPopupBlocked")
+					}) : null,
+					state.mcpError !== void 0 && popupError === null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: EdgeSettingsSection_module_css_default.error,
+						role: "alert",
+						children: state.mcpError
+					}) : null
+				]
+			});
+		}
+		//#endregion
 		//#region ../../../packages/client/ui-edge/src/client/locales.ts
 		/** English copy is the key-set source of truth for the Edge settings page. */
 		const en = {
@@ -556,7 +1361,48 @@ window.__ModuleLoader__.load({
 			ownerIntro: "Signing out clears this browser’s owner session. Your deployment and data remain unchanged.",
 			signOut: "Sign out",
 			signingOut: "Signing out…",
-			signOutFailed: "Could not sign out. Try again."
+			signOutFailed: "Could not sign out. Try again.",
+			toolPermissions: "Tool permissions",
+			approvalMode: "Web fetch tools",
+			approvalAsk: "Always ask before running",
+			approvalNever: "Trust all (no confirmation)",
+			approvalSaved: "Saved",
+			approvalError: "Could not save setting.",
+			mcpServers: "MCP Connectors",
+			mcpIntro: "Connect external tool servers to extend your agent with additional capabilities.",
+			mcpEmpty: "No MCP servers configured.",
+			mcpNamePlaceholder: "Server name (e.g. github)",
+			mcpUrlPlaceholder: "Endpoint URL (e.g. https://mcp.example.com/sse)",
+			mcpAdd: "Add server",
+			mcpRemove: "Remove",
+			mcpAuthNone: "No auth",
+			mcpAuthBearer: "Bearer",
+			mcpTokenPlaceholder: "Bearer token",
+			mcpTokenSaved: "Token saved",
+			mcpAuthOAuth: "OAuth",
+			mcpConnect: "Connect",
+			mcpReconnect: "Reconnect",
+			mcpConnected: "connected",
+			mcpNeedsReauth: "needs reconnect",
+			mcpError: "connection error",
+			mcpTools: "tools",
+			mcpToolPolicy: "Tool permissions",
+			mcpPolicyApproveAll: "Ask before every call",
+			mcpPolicyReadOnly: "Allow reads, ask for writes",
+			mcpPolicyAllowAll: "Trust all (no confirmation)",
+			mcpNav: "MCP Connectors",
+			mcpAddServer: "Add connector",
+			mcpCancel: "Cancel",
+			mcpAuthLabel: "Authentication",
+			mcpServerInfo: "Server",
+			mcpConnecting: "Connecting…",
+			mcpPopupBlocked: "Pop-up blocked by browser. Please allow pop-ups for this site and try again.",
+			mcpConnectionFailed: "Connection failed. Check the URL and authentication type.",
+			mcpRefresh: "Refresh",
+			mcpProbing: "Refreshing…",
+			mcpToolsLabel: "Tools",
+			mcpRead: "read",
+			mcpWrite: "write"
 		};
 		/** Simplified Chinese copy for the Edge settings page. */
 		const zh = {
@@ -590,7 +1436,48 @@ window.__ModuleLoader__.load({
 			ownerIntro: "退出只会清除此浏览器的 Owner 会话，不会改变部署或数据。",
 			signOut: "退出登录",
 			signingOut: "正在退出…",
-			signOutFailed: "退出失败，请重试。"
+			signOutFailed: "退出失败，请重试。",
+			toolPermissions: "工具权限",
+			approvalMode: "Web fetch 工具",
+			approvalAsk: "每次都询问",
+			approvalNever: "全部信任（不询问）",
+			approvalSaved: "已保存",
+			approvalError: "无法保存设置。",
+			mcpServers: "MCP 连接器",
+			mcpIntro: "连接外部工具服务器，为 Agent 扩展更多能力。",
+			mcpEmpty: "尚未配置 MCP 服务器。",
+			mcpNamePlaceholder: "服务器名称（如 github）",
+			mcpUrlPlaceholder: "端点 URL（如 https://mcp.example.com/sse）",
+			mcpAdd: "添加服务器",
+			mcpRemove: "移除",
+			mcpAuthNone: "无认证",
+			mcpAuthBearer: "Bearer Token",
+			mcpTokenPlaceholder: "Bearer Token",
+			mcpTokenSaved: "Token 已保存",
+			mcpAuthOAuth: "OAuth",
+			mcpConnect: "连接",
+			mcpReconnect: "重新连接",
+			mcpConnected: "已连接",
+			mcpNeedsReauth: "需要重连",
+			mcpError: "连接错误",
+			mcpTools: "个工具",
+			mcpToolPolicy: "工具权限",
+			mcpPolicyApproveAll: "每次调用都询问",
+			mcpPolicyReadOnly: "读取放行，写入询问",
+			mcpPolicyAllowAll: "全部信任（不询问）",
+			mcpNav: "MCP 连接器",
+			mcpAddServer: "添加连接器",
+			mcpCancel: "取消",
+			mcpAuthLabel: "认证方式",
+			mcpServerInfo: "服务器",
+			mcpConnecting: "连接中…",
+			mcpPopupBlocked: "弹窗被浏览器拦截，请允许此站点的弹窗后重试。",
+			mcpConnectionFailed: "连接失败，请检查 URL 和认证方式是否正确。",
+			mcpRefresh: "刷新",
+			mcpProbing: "刷新中…",
+			mcpToolsLabel: "工具",
+			mcpRead: "读取",
+			mcpWrite: "写入"
 		};
 		//#endregion
 		//#region ../../../packages/client/ui-edge/src/client/index.ts
@@ -619,11 +1506,22 @@ window.__ModuleLoader__.load({
 					globalThis.location.assign(path);
 				}
 			});
-			const injected = () => ({
+			const edgeInjected = () => ({
 				hooks: { edgeSettings: controller.store },
 				load: () => controller.load(),
 				copyUpgrade: () => controller.copyUpgrade(),
-				signOut: () => controller.signOut()
+				signOut: () => controller.signOut(),
+				setApprovalMode: (mode) => controller.setApprovalMode(mode)
+			});
+			const mcpInjected = () => ({
+				hooks: { edgeSettings: controller.store },
+				load: () => controller.load(),
+				saveMcpServers: (servers) => controller.saveMcpServers(servers),
+				saveMcpToken: (name, token) => controller.saveMcpToken(name, token),
+				setMcpToolPolicy: (name, mode) => controller.setMcpToolPolicy(name, mode),
+				probeMcpServer: (name) => controller.probeMcpServer(name),
+				getMcpTools: (name) => controller.getMcpTools(name),
+				startOAuthConnect: (name, url) => controller.startOAuthConnect(name, url)
 			});
 			slots.inject("settings.section", () => slots.register({
 				name: "settings.section",
@@ -631,8 +1529,16 @@ window.__ModuleLoader__.load({
 				order: 90,
 				label: () => ctx.locale.bind("settings.edge")("nav"),
 				locale: "settings.edge",
-				inject: injected
+				inject: edgeInjected
 			}, EdgeSettingsSection));
+			slots.inject("settings.section", () => slots.register({
+				name: "settings.section",
+				id: "mcp-connectors",
+				order: 55,
+				label: () => ctx.locale.bind("settings.edge")("mcpNav"),
+				locale: "settings.edge",
+				inject: mcpInjected
+			}, EdgeMcpSection));
 			ctx.inject(["remote.session"], (scope) => {
 				scope.effect(() => {
 					const session = scope.get("remote.session");