dsh-mcp-panel 0.4.2 → 0.5.1

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.5.1] - 2026-08-22
+
+### Changed
+
+- All `@deepseek-ai/dsh-*` dependencies moved from the `0.1.0-rc.8` line to `0.1.1-rc.2`: the 15 devDependencies pin `0.1.1-rc.2` exactly, `@deepseek-ai/dsh-subprocess` (the one runtime dependency) pins `0.1.1-rc.2`, and the four peerDependencies (`dsh-commands` / `dsh-jobs` / `dsh-tools` / `dsh-typert-protocol`) keep their `>=0.1.0-rc.8 <0.2.0` range (no rc.2-exclusive API is used). `@deepseek-ai/cordis` and the non-dsh dependency lines are unchanged; the compatibility tables now claim `0.1.1-rc.2`–`0.2.0`, and the compat workflow pins the harness CLI and base/headless bundles to `0.1.1-rc.2`.
+- The `/mcp` and `mcp_probe` surfaces are unchanged: rc.2 keeps the `commands.execute(agent, line, images, signal)` signature and the single-`CommandInvocation` handler shape this package already drives, so no call-site edits were needed.
+
+### Engineering
+
+- `pnpm-lock.yaml` regenerated against the rc.2 graph; `minimumReleaseAgeExclude` collapses the stale per-package rc.6 list to a single `@deepseek-ai/*` wildcard so fresh harness releases install without a release-age delay.
+
+## [0.5.0] - 2026-08-21
+
+### Added
+
+- `mcp_probe`, the panel probe action, `/mcp <server> probe`, and the passive probe now support **stdio** MCP servers: a probe on a stdio row spawns the configured `command`/`args` under the same `scrubbedParentEnv` base the mcp-client bridge uses (credential-shaped and `DSH_*` names never leak into the child implicitly) plus the row's explicit `env`/`cwd`, completes one MCP `initialize` handshake over stdin/stdout, and records the sanitized server name/version or a sanitized failure detail — still panel-only, with the same unowned-job semantics (cancel, per-probe timeout, display cap). `ProbeTarget` is now a `kind`-discriminated union (`http` | `stdio`) resolved by `McpPanelService.probeSpec`; streamable-http rows are probed exactly as before.
+
 ## [0.4.2] - 2026-08-21
 
 ### Changed

package/README.es.md

@@ -24,7 +24,7 @@
 
 | Superficie | Estado |
 |---|---|
-| Harness | DeepSeek Harness `0.1.0-rc.8`–`0.2.0` |
+| Harness | DeepSeek Harness `0.1.1-rc.2`–`0.2.0` |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Plataformas | Web GUI (doble cara: host + navegador) |
 | Modelo | Cualquiera (el panel es de solo lectura; solo la salida de `/mcp` es legible por el modelo) |

package/README.hi.md

@@ -24,7 +24,7 @@
 
 | सतह | स्थिति |
 |---|---|
-| Harness | DeepSeek Harness `0.1.0-rc.8`–`0.2.0` |
+| Harness | DeepSeek Harness `0.1.1-rc.2`–`0.2.0` |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | प्लेटफ़ॉर्म | Web GUI (दोहरा चेहरा: host + browser) |
 | मॉडल | कोई भी (पैनल रीड-ओनली है; केवल `/mcp` आउटपुट मॉडल-पठनीय है) |

package/README.md

@@ -1,6 +1,7 @@
 <div align="center">
 
 # dsh-mcp-panel
+[![Gitee](https://img.shields.io/badge/Gitee-mirror-c71d23?logo=gitee)](https://gitee.com/perrylink/dsh-mcp-panel)
 
 **The MCP management console for the official DeepSeek Harness MCP client — add, edit, remove, and trial-call MCP servers from a settings page, with honest status, health diagnostics, and safe, reversible profile writes.**
 
@@ -24,7 +25,7 @@
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `0.1.0-rc.8`–`0.2.0` |
+| Harness | DeepSeek Harness `0.1.1-rc.2`–`0.2.0` |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Platforms | Web GUI (dual-face: host + browser) |
 | Model | Any (the panel is read-only; only `/mcp` output is model-readable) |

package/README.pt.md

@@ -24,7 +24,7 @@
 
 | Superfície | Status |
 |---|---|
-| Harness | DeepSeek Harness `0.1.0-rc.8`–`0.2.0` |
+| Harness | DeepSeek Harness `0.1.1-rc.2`–`0.2.0` |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Plataformas | Web GUI (duas faces: host + navegador) |
 | Modelo | Qualquer (o painel é somente leitura; só a saída de `/mcp` é legível pelo modelo) |

package/README.zh.md

@@ -24,7 +24,7 @@
 
 | 维度 | 状态 |
 |---|---|
-| Harness | DeepSeek Harness `0.1.0-rc.8`–`0.2.0` |
+| Harness | DeepSeek Harness `0.1.1-rc.2`–`0.2.0` |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | 平台 | Web GUI（双面：Host + 浏览器） |
 | 模型 | 任意（面板只读；仅 `/mcp` 输出对模型可见） |

package/lib/index.js

@@ -1,5 +1,7 @@
 import { s as string } from "./schemas-BhI7GrM5.js";
 import z from "@deepseek-ai/schemastery";
+import { spawn } from "node:child_process";
+import { scrubbedParentEnv } from "@deepseek-ai/dsh-subprocess";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -591,6 +593,21 @@ function sanitizeError(error) {
 }
 //#endregion
 //#region src/probe.ts
+/**
+* The optional `mcp_probe` tool: a one-shot connectivity probe of one
+* configured MCP server (streamable-http or stdio transport), executed as an
+* UNOWNED background job. Probe results are panel-only — the tool returns
+* just the job id and a pointer to the settings tab, the job carries no
+* owner (so no completion notice is injected into the model), and the panel
+* reads the sanitized snapshot back through `mcpPanel/status`.
+*
+* The stdio probe spawns the configured `command`/`args` with the same
+* `scrubbedParentEnv` base the mcp-client bridge uses (credential-shaped and
+* `DSH_*` names never leak into the child implicitly) plus the row's explicit
+* `env`/`cwd`, and completes one MCP `initialize` handshake over stdin/stdout.
+*
+* @module dsh-mcp-panel/probe
+*/
 /** Producer kind; also the job-id prefix. */
 const PROBE_KIND = "mcp-probe";
 /** JSON-RPC MCP initialize request used by the probe (protocol constant). */
@@ -600,7 +617,7 @@ const INITIALIZE_PROTOCOL_VERSION = "2024-11-05";
 * advertised version tracks the package version. */
 const PROBE_CLIENT_INFO = {
 	name: "dsh-mcp-panel",
-	version: "0.4.2"
+	version: "0.5.1"
 };
 /** Display cap for server-reported name/version fields in probe details. */
 const DISPLAY_LIMIT = 80;
@@ -668,15 +685,128 @@ async function probeEndpoint(url, headers, timeoutMs, signal) {
 	}
 }
 /**
-* Create the background-job hooks for one probe: cancel aborts the fetch, the
-* outcome settles `done` with sanitized detail only.
+* Complete one MCP `initialize` handshake over a spawned stdio server's
+* stdin/stdout and describe the outcome in one sanitized line. The child runs
+* under the same `scrubbedParentEnv` base the mcp-client bridge uses —
+* credential-shaped and `DSH_*` parent names never reach it implicitly — plus
+* the row's explicit `env` (merged after the scrub) and optional `cwd`. The
+* child's stderr is consumed and never rendered; the configured `command`/
+* `args` are launch facts, not display content, but any error is sanitized
+* before it lands in the outcome detail.
 *
-* @param url - endpoint URL.
-* @param headers - configured headers (used, never rendered).
+* @param target - resolved stdio launch spec.
+* @param timeoutMs - probe deadline.
+* @param signal - caller-owned abort (job kill or timeout).
+* @returns the settled probe outcome.
+*/
+function probeStdio(target, timeoutMs, signal) {
+	const started = Date.now();
+	return new Promise((resolve) => {
+		let settled = false;
+		let child;
+		let buffer = "";
+		let timer;
+		const finish = (outcome) => {
+			if (settled) return;
+			settled = true;
+			if (timer !== void 0) clearTimeout(timer);
+			try {
+				child?.kill();
+			} catch {}
+			resolve(outcome);
+		};
+		timer = setTimeout(() => {
+			if (!settled) finish({
+				status: "failed",
+				detail: `timeout after ${timeoutMs}ms or cancelled`
+			});
+		}, timeoutMs);
+		try {
+			child = spawn(target.command, [...target.args], {
+				stdio: [
+					"pipe",
+					"pipe",
+					"pipe"
+				],
+				env: {
+					...scrubbedParentEnv(),
+					...target.env
+				},
+				...target.cwd !== void 0 && target.cwd !== "" ? { cwd: target.cwd } : {},
+				windowsHide: true
+			});
+		} catch (error) {
+			finish({
+				status: "failed",
+				detail: sanitizeError(error)
+			});
+			return;
+		}
+		child.on("error", (error) => finish({
+			status: "failed",
+			detail: sanitizeError(error)
+		}));
+		child.on("exit", (code, signalName) => {
+			if (!settled) finish({
+				status: "failed",
+				detail: `process exited before initialize response (code ${code ?? "null"}${signalName ? `, signal ${signalName}` : ""})`
+			});
+		});
+		child.stdout?.on("data", (chunk) => {
+			buffer += chunk.toString("utf8");
+			let index;
+			while ((index = buffer.indexOf("\n")) !== -1) {
+				const line = buffer.slice(0, index).trim();
+				buffer = buffer.slice(index + 1);
+				if (line === "") continue;
+				let message;
+				try {
+					message = JSON.parse(line);
+				} catch {
+					continue;
+				}
+				if (message !== null && typeof message === "object" && message.id === 1 && message.result !== void 0) {
+					const serverInfo = message.result.serverInfo ?? {};
+					const name = typeof serverInfo.name === "string" && serverInfo.name !== "" ? boundedDisplay(sanitizeText(serverInfo.name)) : "unnamed";
+					const version = typeof serverInfo.version === "string" && serverInfo.version !== "" ? boundedDisplay(sanitizeText(serverInfo.version)) : "unknown version";
+					finish({
+						status: "completed",
+						detail: `MCP initialize ok over stdio (server ${name} ${version}) in ${Date.now() - started}ms`
+					});
+					return;
+				}
+			}
+		});
+		child.stderr?.on("data", () => {});
+		signal.addEventListener("abort", () => {
+			if (!settled) finish({
+				status: "failed",
+				detail: `timeout after ${timeoutMs}ms or cancelled`
+			});
+		}, { once: true });
+		try {
+			child.stdin?.write(`${JSON.stringify({
+				jsonrpc: "2.0",
+				id: 1,
+				method: "initialize",
+				params: {
+					protocolVersion: INITIALIZE_PROTOCOL_VERSION,
+					capabilities: {},
+					clientInfo: PROBE_CLIENT_INFO
+				}
+			})}\n`);
+		} catch {}
+	});
+}
+/**
+* Create the background-job hooks for one probe: cancel aborts the fetch (or
+* the spawned child), the outcome settles `done` with sanitized detail only.
+*
+* @param target - resolved probe spec (http endpoint or stdio launch).
 * @param timeoutMs - probe deadline.
 * @returns the registry hooks.
 */
-function probeJob(url, headers, timeoutMs) {
+function probeJob(target, timeoutMs) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => {
 		controller.abort();
@@ -686,14 +816,14 @@ function probeJob(url, headers, timeoutMs) {
 		cancel: () => {
 			controller.abort();
 		},
-		done: probeEndpoint(url, headers, timeoutMs, controller.signal).then((outcome) => ({ ...outcome })).finally(() => {
+		done: (target.kind === "stdio" ? probeStdio(target, timeoutMs, controller.signal) : probeEndpoint(target.url, target.headers, timeoutMs, controller.signal)).then((outcome) => ({ ...outcome })).finally(() => {
 			clearTimeout(timer);
 		})
 	};
 }
-/** Resolve one configured server's raw endpoint for probing. */
+/** Resolve one configured server's probe spec (http endpoint or stdio launch). */
 function probeTarget(service, server) {
-	return service.rawEndpoint(server);
+	return service.probeSpec(server);
 }
 /**
 * Build the `mcp_probe` tool definition.
@@ -706,11 +836,11 @@ function probeTarget(service, server) {
 function mcpProbeTool(service, jobs, timeoutMs) {
 	return defineTool({
 		name: "mcp_probe",
-		description: "Run a one-shot connectivity probe of a configured streamable-http MCP server as a background job. Results appear in the MCP settings panel only — they are not injected into model context.",
+		description: "Run a one-shot connectivity probe of a configured MCP server (streamable-http or stdio) as a background job. Results appear in the MCP settings panel only — they are not injected into model context.",
 		parameters: { server: {
 			type: "string",
 			required: true,
-			description: "serverName of a configured streamable-http MCP server (see /mcp for the list)."
+			description: "serverName of a configured MCP server (see /mcp for the list); streamable-http and stdio transports are both supported."
 		} },
 		output: {
 			schema: {
@@ -734,12 +864,12 @@ function mcpProbeTool(service, jobs, timeoutMs) {
 		},
 		async execute(args) {
 			const target = probeTarget(service, args.server);
-			if (target === void 0) throw new Error(`mcp_probe: "${args.server}" is not a configured streamable-http MCP server (see /mcp). stdio servers have no HTTP endpoint to probe.`);
+			if (target === void 0) throw new Error(`mcp_probe: "${args.server}" is not a configured MCP server (see /mcp).`);
 			return {
 				jobId: jobs.start({
 					kind: PROBE_KIND,
 					label: `mcp_probe ${args.server}`,
-					run: () => probeJob(target.url, target.headers, timeoutMs)
+					run: () => probeJob(target, timeoutMs)
 				}),
 				note: "Probe results are panel-only: Settings → Plugins → MCP."
 			};
@@ -2031,24 +2161,24 @@ var McpPanelService = class extends TypertRemoteService {
 		});
 	}
 	/**
-	* Start a one-shot connectivity probe of one configured streamable-http
-	* server as an UNOWNED background job — panel-only, like the `mcp_probe`
-	* tool, but callable from the settings tab. Exported on the wire by the
-	* `mcpPanel/probe` invocation descriptor.
+	* Start a one-shot connectivity probe of one configured MCP server
+	* (streamable-http or stdio) as an UNOWNED background job — panel-only,
+	* like the `mcp_probe` tool, but callable from the settings tab. Exported
+	* on the wire by the `mcpPanel/probe` invocation descriptor.
 	*
 	* @param serverName - configured namespace.
 	* @returns the started job id and where the result lands.
 	*/
 	probe(serverName) {
-		const target = this.rawEndpoint(serverName);
-		if (target === void 0) throw new Error(`dsh-mcp-panel: "${serverName}" is not a configured streamable-http MCP server`);
+		const target = this.probeSpec(serverName);
+		if (target === void 0) throw new Error(`dsh-mcp-panel: "${serverName}" is not a configured MCP server (streamable-http or stdio)`);
 		const jobs = this.ctx.get("jobs");
 		if (jobs === void 0) throw new Error("dsh-mcp-panel: ctx.jobs is not composed — the panel probe action needs a background-job registry");
 		return {
 			jobId: jobs.start({
 				kind: PROBE_KIND,
 				label: `mcp_probe ${serverName}`,
-				run: () => probeJob(target.url, target.headers, this.config.probeTimeoutMs)
+				run: () => probeJob(target, this.config.probeTimeoutMs)
 			}),
 			note: "Probe results are panel-only: Settings → Plugins → MCP."
 		};
@@ -2175,7 +2305,7 @@ var McpPanelService = class extends TypertRemoteService {
 	issueError(resolution) {
 		return /* @__PURE__ */ new Error(`dsh-mcp-panel: invalid patch operation — ${resolution.issues.map((issue) => issue.text).join(" ")}`);
 	}
-	/** One passive-probe sweep over every configured streamable-http server. */
+	/** One passive-probe sweep over every configured MCP server (both transports). */
 	async runPassiveProbes() {
 		if (this.passiveRunning) return;
 		this.passiveRunning = true;
@@ -2183,9 +2313,9 @@ var McpPanelService = class extends TypertRemoteService {
 			for (const entry of this.ctx.loader.entries()) {
 				if (entry.options.name !== "@deepseek-ai/dsh-mcp-client") continue;
 				const serverName = serverNameOf(entry.options.config, `entry:${entry.options.id}`);
-				const target = this.rawEndpoint(serverName);
+				const target = this.probeSpec(serverName);
 				if (target === void 0) continue;
-				const outcome = await probeEndpoint(target.url, target.headers, this.config.probeTimeoutMs, AbortSignal.timeout(this.config.probeTimeoutMs));
+				const outcome = await probeJob(target, this.config.probeTimeoutMs).done;
 				this.probeStates.set(serverName, {
 					state: outcome.status === "completed" ? "reachable" : "unreachable",
 					checkedAt: Date.now()
@@ -2196,35 +2326,84 @@ var McpPanelService = class extends TypertRemoteService {
 		}
 	}
 	/**
-	* Resolve one server's raw endpoint for the probe tool. Credentials stay
-	* inside this return value and are used for the request only — they never
-	* reach a snapshot, a log, or a display.
+	* Resolve one configured server's probe spec. Credentials stay inside the
+	* returned value and are used for the probe only — they never reach a
+	* snapshot, a log, or a display. Streamable-http rows yield their raw
+	* endpoint + configured headers; stdio rows yield the launch spec
+	* (`command`/`args`, explicit `env` merged after the scrub, optional
+	* `cwd`) that the probe spawns.
 	*
 	* @param serverName - configured namespace.
-	* @returns the raw URL + configured headers, or `undefined` when the server
-	*   is not a configured streamable-http row.
+	* @returns the transport-tagged probe spec, or `undefined` when the server
+	*   is not a configured MCP row of either transport.
 	*/
-	rawEndpoint(serverName) {
+	probeSpec(serverName) {
 		for (const entry of this.ctx.loader.entries()) {
 			if (entry.options.name !== "@deepseek-ai/dsh-mcp-client") continue;
 			const config = entry.options.config;
 			if (serverNameOf(config, `entry:${entry.options.id}`) !== serverName) continue;
 			if (typeof config !== "object" || config === null || Array.isArray(config)) return void 0;
 			const row = config;
-			if (row["transport"] !== "streamable-http") return void 0;
-			const url = row["url"];
-			if (typeof url !== "string" || url === "") return void 0;
-			const headersValue = row["headers"];
-			const headers = {};
-			if (typeof headersValue === "object" && headersValue !== null && !Array.isArray(headersValue)) {
-				for (const [name, value] of Object.entries(headersValue)) if (typeof value === "string") headers[name] = value;
+			if (row["transport"] === "streamable-http") {
+				const url = row["url"];
+				if (typeof url !== "string" || url === "") return void 0;
+				const headersValue = row["headers"];
+				const headers = {};
+				if (typeof headersValue === "object" && headersValue !== null && !Array.isArray(headersValue)) {
+					for (const [name, value] of Object.entries(headersValue)) if (typeof value === "string") headers[name] = value;
+				}
+				return {
+					kind: "http",
+					url,
+					headers
+				};
 			}
-			return {
-				url,
-				headers
-			};
+			if (row["transport"] === "stdio") {
+				const command = row["command"];
+				if (typeof command !== "string" || command === "") return void 0;
+				const argsValue = row["args"];
+				const args = [];
+				if (Array.isArray(argsValue)) for (const value of argsValue) {
+					if (typeof value !== "string") return void 0;
+					args.push(value);
+				}
+				else if (argsValue !== void 0) return void 0;
+				const envValue = row["env"];
+				const env = {};
+				if (typeof envValue === "object" && envValue !== null && !Array.isArray(envValue)) for (const [name, value] of Object.entries(envValue)) {
+					if (typeof value !== "string") return void 0;
+					env[name] = value;
+				}
+				else if (envValue !== void 0) return void 0;
+				const cwd = row["cwd"];
+				if (cwd !== void 0 && (typeof cwd !== "string" || cwd === "")) return void 0;
+				return {
+					kind: "stdio",
+					command,
+					args,
+					env,
+					...typeof cwd === "string" ? { cwd } : {}
+				};
+			}
+			return;
 		}
 	}
+	/**
+	* Resolve one server's raw endpoint for the streamable-http probe path.
+	* Credentials stay inside this return value and are used for the request
+	* only — they never reach a snapshot, a log, or a display.
+	*
+	* @param serverName - configured namespace.
+	* @returns the raw URL + configured headers, or `undefined` when the server
+	*   is not a configured streamable-http row.
+	*/
+	rawEndpoint(serverName) {
+		const spec = this.probeSpec(serverName);
+		return spec?.kind === "http" ? {
+			url: spec.url,
+			headers: { ...spec.headers }
+		} : void 0;
+	}
 	/** Unowned `mcp-probe` background jobs, newest first, sanitized for display. */
 	probeViews() {
 		const jobs = this.ctx.get("jobs");

package/lib/types/probe.d.ts

@@ -1,10 +1,15 @@
 /**
  * The optional `mcp_probe` tool: a one-shot connectivity probe of one
- * configured Streamable HTTP endpoint, executed as an UNOWNED background job.
- * Probe results are panel-only — the tool returns just the job id and a
- * pointer to the settings tab, the job carries no owner (so no completion
- * notice is injected into the model), and the panel reads the sanitized
- * snapshot back through `mcpPanel/status`.
+ * configured MCP server (streamable-http or stdio transport), executed as an
+ * UNOWNED background job. Probe results are panel-only — the tool returns
+ * just the job id and a pointer to the settings tab, the job carries no
+ * owner (so no completion notice is injected into the model), and the panel
+ * reads the sanitized snapshot back through `mcpPanel/status`.
+ *
+ * The stdio probe spawns the configured `command`/`args` with the same
+ * `scrubbedParentEnv` base the mcp-client bridge uses (credential-shaped and
+ * `DSH_*` names never leak into the child implicitly) plus the row's explicit
+ * `env`/`cwd`, and completes one MCP `initialize` handshake over stdin/stdout.
  *
  * @module dsh-mcp-panel/probe
  */
@@ -15,7 +20,7 @@ import type { McpPanelService } from './service.js';
 export declare const PROBE_KIND = "mcp-probe";
 declare module '@deepseek-ai/dsh-jobs' {
     interface JobKindMap {
-        /** One-shot Streamable HTTP connectivity probe (panel-only results). */
+        /** One-shot connectivity probe (streamable-http or stdio; panel-only results). */
         'mcp-probe': 'mcp-probe';
     }
 }
@@ -33,6 +38,18 @@ export interface ProbeOutcome {
     /** Sanitized one-line detail (HTTP status, latency, server info, or error). */
     detail: string;
 }
+/** One configured server's probe spec: an HTTP endpoint or a stdio launch. */
+export type ProbeTarget = {
+    readonly kind: 'http';
+    readonly url: string;
+    readonly headers: Readonly<Record<string, string>>;
+} | {
+    readonly kind: 'stdio';
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly env: Readonly<Record<string, string>>;
+    readonly cwd?: string;
+};
 /**
  * POST one MCP `initialize` request and describe the outcome in one sanitized
  * line. Never sends or echoes credentials: the configured headers are used
@@ -46,15 +63,32 @@ export interface ProbeOutcome {
  */
 export declare function probeEndpoint(url: string, headers: Readonly<Record<string, string>>, timeoutMs: number, signal: AbortSignal): Promise<ProbeOutcome>;
 /**
- * Create the background-job hooks for one probe: cancel aborts the fetch, the
- * outcome settles `done` with sanitized detail only.
+ * Complete one MCP `initialize` handshake over a spawned stdio server's
+ * stdin/stdout and describe the outcome in one sanitized line. The child runs
+ * under the same `scrubbedParentEnv` base the mcp-client bridge uses —
+ * credential-shaped and `DSH_*` parent names never reach it implicitly — plus
+ * the row's explicit `env` (merged after the scrub) and optional `cwd`. The
+ * child's stderr is consumed and never rendered; the configured `command`/
+ * `args` are launch facts, not display content, but any error is sanitized
+ * before it lands in the outcome detail.
+ *
+ * @param target - resolved stdio launch spec.
+ * @param timeoutMs - probe deadline.
+ * @param signal - caller-owned abort (job kill or timeout).
+ * @returns the settled probe outcome.
+ */
+export declare function probeStdio(target: Extract<ProbeTarget, {
+    kind: 'stdio';
+}>, timeoutMs: number, signal: AbortSignal): Promise<ProbeOutcome>;
+/**
+ * Create the background-job hooks for one probe: cancel aborts the fetch (or
+ * the spawned child), the outcome settles `done` with sanitized detail only.
  *
- * @param url - endpoint URL.
- * @param headers - configured headers (used, never rendered).
+ * @param target - resolved probe spec (http endpoint or stdio launch).
  * @param timeoutMs - probe deadline.
  * @returns the registry hooks.
  */
-export declare function probeJob(url: string, headers: Readonly<Record<string, string>>, timeoutMs: number): JobHooks;
+export declare function probeJob(target: ProbeTarget, timeoutMs: number): JobHooks;
 /**
  * Build the `mcp_probe` tool definition.
  *

package/lib/types/probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../src/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAc,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAG5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,6CAA6C;AAC7C,eAAO,MAAM,UAAU,cAAc,CAAA;AAErC,OAAO,QAAQ,uBAAuB,CAAC;IACrC,UAAU,UAAU;QAClB,wEAAwE;QACxE,WAAW,EAAE,WAAW,CAAA;KACzB;CACF;AAKD;;oDAEoD;AACpD,eAAO,MAAM,iBAAiB;IAAK,IAAI;IAAmB,OAAO;CAAW,CAAA;AAE5E,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,yBAAyB;IACzB,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAA;IAC9B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAA;CACf;AAUD;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,YAAY,CAAC,CA4CvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CAW5G;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,cAAc,CA8C3G"}
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../src/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAc,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAE9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAG5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,6CAA6C;AAC7C,eAAO,MAAM,UAAU,cAAc,CAAA;AAErC,OAAO,QAAQ,uBAAuB,CAAC;IACrC,UAAU,UAAU;QAClB,kFAAkF;QAClF,WAAW,EAAE,WAAW,CAAA;KACzB;CACF;AAKD;;oDAEoD;AACpD,eAAO,MAAM,iBAAiB;IAAK,IAAI;IAAmB,OAAO;CAAW,CAAA;AAE5E,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,yBAAyB;IACzB,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAA;IAC9B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAA;CACf;AAED,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,GACnG;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAUL;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,YAAY,CAAC,CA4CvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,EAC/C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,YAAY,CAAC,CA6EvB;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CAazE;AAOD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,cAAc,CA6C3G"}

package/lib/types/service.d.ts

@@ -26,6 +26,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
+import { type ProbeTarget } from './probe.js';
 import type { McpServerStatus } from './upstream.js';
 import type { McpPanelSnapshot, McpTrialResultWire, PatchPreview, PatchWriteResult, ProbeStarted } from './wire.js';
 declare module '@deepseek-ai/cordis' {
@@ -105,10 +106,10 @@ export declare class McpPanelService extends TypertRemoteService {
      */
     status(): McpPanelSnapshot;
     /**
-     * Start a one-shot connectivity probe of one configured streamable-http
-     * server as an UNOWNED background job — panel-only, like the `mcp_probe`
-     * tool, but callable from the settings tab. Exported on the wire by the
-     * `mcpPanel/probe` invocation descriptor.
+     * Start a one-shot connectivity probe of one configured MCP server
+     * (streamable-http or stdio) as an UNOWNED background job — panel-only,
+     * like the `mcp_probe` tool, but callable from the settings tab. Exported
+     * on the wire by the `mcpPanel/probe` invocation descriptor.
      *
      * @param serverName - configured namespace.
      * @returns the started job id and where the result lands.
@@ -159,12 +160,25 @@ export declare class McpPanelService extends TypertRemoteService {
     private resolveOp;
     /** Render validation issues as one actionable error. */
     private issueError;
-    /** One passive-probe sweep over every configured streamable-http server. */
+    /** One passive-probe sweep over every configured MCP server (both transports). */
     private runPassiveProbes;
     /**
-     * Resolve one server's raw endpoint for the probe tool. Credentials stay
-     * inside this return value and are used for the request only — they never
-     * reach a snapshot, a log, or a display.
+     * Resolve one configured server's probe spec. Credentials stay inside the
+     * returned value and are used for the probe only — they never reach a
+     * snapshot, a log, or a display. Streamable-http rows yield their raw
+     * endpoint + configured headers; stdio rows yield the launch spec
+     * (`command`/`args`, explicit `env` merged after the scrub, optional
+     * `cwd`) that the probe spawns.
+     *
+     * @param serverName - configured namespace.
+     * @returns the transport-tagged probe spec, or `undefined` when the server
+     *   is not a configured MCP row of either transport.
+     */
+    probeSpec(serverName: string): ProbeTarget | undefined;
+    /**
+     * Resolve one server's raw endpoint for the streamable-http probe path.
+     * Credentials stay inside this return value and are used for the request
+     * only — they never reach a snapshot, a log, or a display.
      *
      * @param serverName - configured namespace.
      * @returns the raw URL + configured headers, or `undefined` when the server

package/lib/types/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AAyBtE,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAA;AACpE,OAAO,KAAK,EAEV,gBAAgB,EAEhB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACb,MAAM,WAAW,CAAA;AAElB,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,wEAAwE;QACxE,QAAQ,EAAE,eAAe,CAAA;KAC1B;CACF;AAoDD,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,yCAAyC;IACzC,cAAc,EAAE,MAAM,CAAA;IACtB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,CAAA;IACzB,2CAA2C;IAC3C,mBAAmB,EAAE,OAAO,CAAA;IAC5B,8CAA8C;IAC9C,sBAAsB,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,YAAY,EAAE,OAAO,CAAA;IACrB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,mBAAmB,EAAE,MAAM,CAAA;IAC3B,uDAAuD;IACvD,YAAY,EAAE,OAAO,CAAA;IACrB,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAA;CACpB;AAiCD,qFAAqF;AACrF,qBAAa,eAAgB,SAAQ,mBAAmB;IA2B5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IA1BjD,MAAM,CAAC,MAAM,WAAsB;IAEnC,oDAAoD;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAC9D,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+E;IAE7G,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAChD,qDAAqD;IACrD,OAAO,CAAC,cAAc,CAAQ;IAE9B;;;OAGG;IACH,YAAY,GAAG,EAAE,OAAO,EAAmB,MAAM,GAAE,qBAA8C,EAQhG;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAmCtC;IAED;;;;;;;;OAQG;IACH,MAAM,IAAI,gBAAgB,CAwCzB;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAmBtC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAQzC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgD7G;IAED;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAmB9F;IAED,yDAAyD;IACzD,OAAO,CAAC,SAAS;IAoBjB,wDAAwD;IACxD,OAAO,CAAC,UAAU;IAIlB,4EAA4E;YAC9D,gBAAgB;IAiB9B;;;;;;;;OAQG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,SAAS,CAwB5F;IAED,gFAAgF;IAChF,OAAO,CAAC,UAAU;IAoBlB,4EAA4E;IAC5E,OAAO,CAAC,SAAS;CAMlB;eASc,eAAe"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AAuBtE,OAAO,EAAwB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAA;AAEnE,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAA;AACpE,OAAO,KAAK,EAEV,gBAAgB,EAEhB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACb,MAAM,WAAW,CAAA;AAElB,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,wEAAwE;QACxE,QAAQ,EAAE,eAAe,CAAA;KAC1B;CACF;AAoDD,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,yCAAyC;IACzC,cAAc,EAAE,MAAM,CAAA;IACtB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,CAAA;IACzB,2CAA2C;IAC3C,mBAAmB,EAAE,OAAO,CAAA;IAC5B,8CAA8C;IAC9C,sBAAsB,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,YAAY,EAAE,OAAO,CAAA;IACrB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,mBAAmB,EAAE,MAAM,CAAA;IAC3B,uDAAuD;IACvD,YAAY,EAAE,OAAO,CAAA;IACrB,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAA;CACpB;AAiCD,qFAAqF;AACrF,qBAAa,eAAgB,SAAQ,mBAAmB;IA2B5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IA1BjD,MAAM,CAAC,MAAM,WAAsB;IAEnC,oDAAoD;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAC9D,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+E;IAE7G,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAChD,qDAAqD;IACrD,OAAO,CAAC,cAAc,CAAQ;IAE9B;;;OAGG;IACH,YAAY,GAAG,EAAE,OAAO,EAAmB,MAAM,GAAE,qBAA8C,EAQhG;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAmCtC;IAED;;;;;;;;OAQG;IACH,MAAM,IAAI,gBAAgB,CAwCzB;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAmBtC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAQzC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgD7G;IAED;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAmB9F;IAED,yDAAyD;IACzD,OAAO,CAAC,SAAS;IAoBjB,wDAAwD;IACxD,OAAO,CAAC,UAAU;IAIlB,kFAAkF;YACpE,gBAAgB;IAiB9B;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAiDrD;IAED;;;;;;;;OAQG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,SAAS,CAG5F;IAED,gFAAgF;IAChF,OAAO,CAAC,UAAU;IAoBlB,4EAA4E;IAC5E,OAAO,CAAC,SAAS;CAMlB;eASc,eAAe"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-panel",
-  "version": "0.4.2",
+  "version": "0.5.1",
   "description": "MCP management console for the official DeepSeek Harness MCP client: /mcp command with health diagnostics and pipeline trial calls, a Settings MCP tab with server CRUD (append-only profile-patch fragments, approval-gated writes with automatic backups), a tool trial console over the official tool pipeline, connection status, reconnect counts and sanitized tool inventory, plus an optional Streamable HTTP probe.",
   "repository": {
     "type": "git",
@@ -81,7 +81,7 @@
     ],
     "compatibility": {
       "dshVersions": [
-        "0.1.0-rc.8"
+        "0.1.1-rc.2"
       ]
     },
     "capability": {
@@ -125,27 +125,28 @@
   "dependencies": {
     "tsdown": "^0.22.14",
     "typescript": "^7.0.0",
-    "zod": "^4.4.3"
+    "zod": "^4.4.3",
+    "@deepseek-ai/dsh-subprocess": "0.1.1-rc.2"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/cordis-plugin-include": "1.0.6",
     "@deepseek-ai/cordis-plugin-loader": "^1.0.2",
-    "@deepseek-ai/dsh-agent": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-app-boot": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-connection": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-cmdline": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-commands": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-home-paths": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-jobs": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-session": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-agent": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-app-boot": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-connection": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-cmdline": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-commands": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-jobs": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.1-rc.2",
     "@deepseek-ai/schemastery": "^3.18.0",
     "@types/node": "^22.19.0",
     "@types/react": "18.3.31",

package/src/probe.ts

@@ -1,15 +1,22 @@
 /**
  * The optional `mcp_probe` tool: a one-shot connectivity probe of one
- * configured Streamable HTTP endpoint, executed as an UNOWNED background job.
- * Probe results are panel-only — the tool returns just the job id and a
- * pointer to the settings tab, the job carries no owner (so no completion
- * notice is injected into the model), and the panel reads the sanitized
- * snapshot back through `mcpPanel/status`.
+ * configured MCP server (streamable-http or stdio transport), executed as an
+ * UNOWNED background job. Probe results are panel-only — the tool returns
+ * just the job id and a pointer to the settings tab, the job carries no
+ * owner (so no completion notice is injected into the model), and the panel
+ * reads the sanitized snapshot back through `mcpPanel/status`.
+ *
+ * The stdio probe spawns the configured `command`/`args` with the same
+ * `scrubbedParentEnv` base the mcp-client bridge uses (credential-shaped and
+ * `DSH_*` names never leak into the child implicitly) plus the row's explicit
+ * `env`/`cwd`, and completes one MCP `initialize` handshake over stdin/stdout.
  *
  * @module dsh-mcp-panel/probe
  */
 
+import { spawn } from 'node:child_process'
 import type { JobHooks, JobOutcome, JobRegistry } from '@deepseek-ai/dsh-jobs'
+import { scrubbedParentEnv } from '@deepseek-ai/dsh-subprocess'
 import type { ToolDefinition } from '@deepseek-ai/dsh-tools'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import { sanitizeError, sanitizeText } from './sanitize.ts'
@@ -20,7 +27,7 @@ export const PROBE_KIND = 'mcp-probe'
 
 declare module '@deepseek-ai/dsh-jobs' {
   interface JobKindMap {
-    /** One-shot Streamable HTTP connectivity probe (panel-only results). */
+    /** One-shot connectivity probe (streamable-http or stdio; panel-only results). */
     'mcp-probe': 'mcp-probe'
   }
 }
@@ -31,7 +38,7 @@ const INITIALIZE_PROTOCOL_VERSION = '2024-11-05'
 /** MCP clientInfo facts; protocol constants, not configuration. Exported so the
  * version-consistency tripwire (`tests/version.spec.ts`) can assert the
  * advertised version tracks the package version. */
-export const PROBE_CLIENT_INFO = { name: 'dsh-mcp-panel', version: '0.4.2' }
+export const PROBE_CLIENT_INFO = { name: 'dsh-mcp-panel', version: '0.5.1' }
 
 /** One settled probe: outcome status plus a sanitized one-line detail. */
 export interface ProbeOutcome {
@@ -41,6 +48,17 @@ export interface ProbeOutcome {
   detail: string
 }
 
+/** One configured server's probe spec: an HTTP endpoint or a stdio launch. */
+export type ProbeTarget =
+  | { readonly kind: 'http'; readonly url: string; readonly headers: Readonly<Record<string, string>> }
+  | {
+      readonly kind: 'stdio'
+      readonly command: string
+      readonly args: readonly string[]
+      readonly env: Readonly<Record<string, string>>
+      readonly cwd?: string
+    }
+
 /** Display cap for server-reported name/version fields in probe details. */
 const DISPLAY_LIMIT = 80
 
@@ -112,19 +130,118 @@ export async function probeEndpoint(
 }
 
 /**
- * Create the background-job hooks for one probe: cancel aborts the fetch, the
- * outcome settles `done` with sanitized detail only.
+ * Complete one MCP `initialize` handshake over a spawned stdio server's
+ * stdin/stdout and describe the outcome in one sanitized line. The child runs
+ * under the same `scrubbedParentEnv` base the mcp-client bridge uses —
+ * credential-shaped and `DSH_*` parent names never reach it implicitly — plus
+ * the row's explicit `env` (merged after the scrub) and optional `cwd`. The
+ * child's stderr is consumed and never rendered; the configured `command`/
+ * `args` are launch facts, not display content, but any error is sanitized
+ * before it lands in the outcome detail.
+ *
+ * @param target - resolved stdio launch spec.
+ * @param timeoutMs - probe deadline.
+ * @param signal - caller-owned abort (job kill or timeout).
+ * @returns the settled probe outcome.
+ */
+export function probeStdio(
+  target: Extract<ProbeTarget, { kind: 'stdio' }>,
+  timeoutMs: number,
+  signal: AbortSignal,
+): Promise<ProbeOutcome> {
+  const started = Date.now()
+  return new Promise<ProbeOutcome>((resolve) => {
+    let settled = false
+    let child: ReturnType<typeof spawn> | undefined
+    let buffer = ''
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const finish = (outcome: ProbeOutcome): void => {
+      if (settled) return
+      settled = true
+      if (timer !== undefined) clearTimeout(timer)
+      try { child?.kill() } catch { /* already gone */ }
+      resolve(outcome)
+    }
+    timer = setTimeout(() => {
+      if (!settled) finish({ status: 'failed', detail: `timeout after ${timeoutMs}ms or cancelled` })
+    }, timeoutMs)
+    try {
+      child = spawn(target.command, [...target.args], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: { ...scrubbedParentEnv(), ...target.env },
+        ...(target.cwd !== undefined && target.cwd !== '' ? { cwd: target.cwd } : {}),
+        windowsHide: true,
+      })
+    } catch (error) {
+      finish({ status: 'failed', detail: sanitizeError(error) })
+      return
+    }
+    child.on('error', (error) => finish({ status: 'failed', detail: sanitizeError(error) }))
+    child.on('exit', (code, signalName) => {
+      if (!settled) {
+        finish({ status: 'failed', detail: `process exited before initialize response (code ${code ?? 'null'}${signalName ? `, signal ${signalName}` : ''})` })
+      }
+    })
+    child.stdout?.on('data', (chunk: Buffer) => {
+      buffer += chunk.toString('utf8')
+      let index: number
+      while ((index = buffer.indexOf('\n')) !== -1) {
+        const line = buffer.slice(0, index).trim()
+        buffer = buffer.slice(index + 1)
+        if (line === '') continue
+        let message: { id?: unknown; result?: { serverInfo?: { name?: unknown; version?: unknown } } } | undefined
+        try {
+          message = JSON.parse(line) as typeof message
+        } catch {
+          continue
+        }
+        if (message !== null && typeof message === 'object' && message.id === 1 && message.result !== undefined) {
+          const serverInfo = message.result.serverInfo ?? {}
+          const name = typeof serverInfo.name === 'string' && serverInfo.name !== ''
+            ? boundedDisplay(sanitizeText(serverInfo.name))
+            : 'unnamed'
+          const version = typeof serverInfo.version === 'string' && serverInfo.version !== ''
+            ? boundedDisplay(sanitizeText(serverInfo.version))
+            : 'unknown version'
+          finish({ status: 'completed', detail: `MCP initialize ok over stdio (server ${name} ${version}) in ${Date.now() - started}ms` })
+          return
+        }
+      }
+    })
+    child.stderr?.on('data', () => { /* consumed, never rendered */ })
+    signal.addEventListener('abort', () => {
+      if (!settled) finish({ status: 'failed', detail: `timeout after ${timeoutMs}ms or cancelled` })
+    }, { once: true })
+    try {
+      child.stdin?.write(`${JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'initialize',
+        params: {
+          protocolVersion: INITIALIZE_PROTOCOL_VERSION,
+          capabilities: {},
+          clientInfo: PROBE_CLIENT_INFO,
+        },
+      })}\n`)
+    } catch { /* the exit/error paths settle the outcome */ }
+  })
+}
+
+/**
+ * Create the background-job hooks for one probe: cancel aborts the fetch (or
+ * the spawned child), the outcome settles `done` with sanitized detail only.
  *
- * @param url - endpoint URL.
- * @param headers - configured headers (used, never rendered).
+ * @param target - resolved probe spec (http endpoint or stdio launch).
  * @param timeoutMs - probe deadline.
  * @returns the registry hooks.
  */
-export function probeJob(url: string, headers: Readonly<Record<string, string>>, timeoutMs: number): JobHooks {
+export function probeJob(target: ProbeTarget, timeoutMs: number): JobHooks {
   const controller = new AbortController()
   const timer = setTimeout(() => { controller.abort() }, timeoutMs)
   timer.unref?.()
-  const done: Promise<JobOutcome> = probeEndpoint(url, headers, timeoutMs, controller.signal)
+  const done: Promise<JobOutcome> = (target.kind === 'stdio'
+    ? probeStdio(target, timeoutMs, controller.signal)
+    : probeEndpoint(target.url, target.headers, timeoutMs, controller.signal))
     .then(outcome => ({ ...outcome }))
     .finally(() => { clearTimeout(timer) })
   return {
@@ -133,12 +250,9 @@ export function probeJob(url: string, headers: Readonly<Record<string, string>>,
   }
 }
 
-/** Resolve one configured server's raw endpoint for probing. */
-function probeTarget(
-  service: McpPanelService,
-  server: string,
-): { url: string; headers: Record<string, string> } | undefined {
-  return service.rawEndpoint(server)
+/** Resolve one configured server's probe spec (http endpoint or stdio launch). */
+function probeTarget(service: McpPanelService, server: string): ProbeTarget | undefined {
+  return service.probeSpec(server)
 }
 
 /**
@@ -152,13 +266,13 @@ function probeTarget(
 export function mcpProbeTool(service: McpPanelService, jobs: JobRegistry, timeoutMs: number): ToolDefinition {
   return defineTool({
     name: 'mcp_probe',
-    description: 'Run a one-shot connectivity probe of a configured streamable-http MCP server as a background job. '
+    description: 'Run a one-shot connectivity probe of a configured MCP server (streamable-http or stdio) as a background job. '
       + 'Results appear in the MCP settings panel only — they are not injected into model context.',
     parameters: {
       server: {
         type: 'string',
         required: true,
-        description: 'serverName of a configured streamable-http MCP server (see /mcp for the list).',
+        description: 'serverName of a configured MCP server (see /mcp for the list); streamable-http and stdio transports are both supported.',
       },
     },
     output: {
@@ -179,15 +293,14 @@ export function mcpProbeTool(service: McpPanelService, jobs: JobRegistry, timeou
       const target = probeTarget(service, args.server)
       if (target === undefined) {
         throw new Error(
-          `mcp_probe: "${args.server}" is not a configured streamable-http MCP server (see /mcp). `
-          + 'stdio servers have no HTTP endpoint to probe.',
+          `mcp_probe: "${args.server}" is not a configured MCP server (see /mcp).`,
         )
       }
       const jobId = jobs.start({
         kind: PROBE_KIND,
         label: `mcp_probe ${args.server}`,
         // Unowned: no model completion notice, readable by the panel only.
-        run: () => probeJob(target.url, target.headers, timeoutMs),
+        run: () => probeJob(target, timeoutMs),
       })
       return {
         jobId,

package/src/service.ts

@@ -51,7 +51,7 @@ import {
 } from './patch.ts'
 import { appendPatchFragment } from './write.ts'
 import { createTrialCaller, validateTrialRequest, type McpAgentRegistryFace, type McpTrialRequest } from './trial.ts'
-import { probeEndpoint, probeJob, PROBE_KIND } from './probe.ts'
+import { probeJob, PROBE_KIND, type ProbeTarget } from './probe.ts'
 import { sanitizeText } from './sanitize.ts'
 import type { McpServerStatus, McpStatusPhase } from './upstream.ts'
 import type {
@@ -312,18 +312,18 @@ private readonly trialCaller = createTrialCaller()
   }
 
   /**
-   * Start a one-shot connectivity probe of one configured streamable-http
-   * server as an UNOWNED background job — panel-only, like the `mcp_probe`
-   * tool, but callable from the settings tab. Exported on the wire by the
-   * `mcpPanel/probe` invocation descriptor.
+   * Start a one-shot connectivity probe of one configured MCP server
+   * (streamable-http or stdio) as an UNOWNED background job — panel-only,
+   * like the `mcp_probe` tool, but callable from the settings tab. Exported
+   * on the wire by the `mcpPanel/probe` invocation descriptor.
    *
    * @param serverName - configured namespace.
    * @returns the started job id and where the result lands.
    */
   probe(serverName: string): ProbeStarted {
-    const target = this.rawEndpoint(serverName)
+    const target = this.probeSpec(serverName)
     if (target === undefined) {
-      throw new Error(`dsh-mcp-panel: "${serverName}" is not a configured streamable-http MCP server`)
+      throw new Error(`dsh-mcp-panel: "${serverName}" is not a configured MCP server (streamable-http or stdio)`)
     }
     const jobs = this.ctx.get('jobs')
     if (jobs === undefined) {
@@ -333,7 +333,7 @@ private readonly trialCaller = createTrialCaller()
       kind: PROBE_KIND,
       label: `mcp_probe ${serverName}`,
       // Unowned: no model completion notice, readable by the panel only.
-      run: () => probeJob(target.url, target.headers, this.config.probeTimeoutMs),
+      run: () => probeJob(target, this.config.probeTimeoutMs),
     })
     return {
       jobId,
@@ -486,7 +486,7 @@ private readonly trialCaller = createTrialCaller()
     return new Error(`dsh-mcp-panel: invalid patch operation — ${resolution.issues.map(issue => issue.text).join(' ')}`)
   }
 
-  /** One passive-probe sweep over every configured streamable-http server. */
+  /** One passive-probe sweep over every configured MCP server (both transports). */
   private async runPassiveProbes(): Promise<void> {
     if (this.passiveRunning) return
     this.passiveRunning = true
@@ -494,9 +494,9 @@ private readonly trialCaller = createTrialCaller()
       for (const entry of this.ctx.loader.entries()) {
         if (entry.options.name !== MCP_CLIENT_MODULE) continue
         const serverName = serverNameOf(entry.options.config, `entry:${entry.options.id}`)
-        const target = this.rawEndpoint(serverName)
+        const target = this.probeSpec(serverName)
         if (target === undefined) continue
-        const outcome = await probeEndpoint(target.url, target.headers, this.config.probeTimeoutMs, AbortSignal.timeout(this.config.probeTimeoutMs))
+        const outcome = await probeJob(target, this.config.probeTimeoutMs).done
         this.probeStates.set(serverName, { state: outcome.status === 'completed' ? 'reachable' : 'unreachable', checkedAt: Date.now() })
       }
     } finally {
@@ -505,15 +505,18 @@ private readonly trialCaller = createTrialCaller()
   }
 
   /**
-   * Resolve one server's raw endpoint for the probe tool. Credentials stay
-   * inside this return value and are used for the request only — they never
-   * reach a snapshot, a log, or a display.
+   * Resolve one configured server's probe spec. Credentials stay inside the
+   * returned value and are used for the probe only — they never reach a
+   * snapshot, a log, or a display. Streamable-http rows yield their raw
+   * endpoint + configured headers; stdio rows yield the launch spec
+   * (`command`/`args`, explicit `env` merged after the scrub, optional
+   * `cwd`) that the probe spawns.
    *
    * @param serverName - configured namespace.
-   * @returns the raw URL + configured headers, or `undefined` when the server
-   *   is not a configured streamable-http row.
+   * @returns the transport-tagged probe spec, or `undefined` when the server
+   *   is not a configured MCP row of either transport.
    */
-  rawEndpoint(serverName: string): { url: string; headers: Record<string, string> } | undefined {
+  probeSpec(serverName: string): ProbeTarget | undefined {
     for (const entry of this.ctx.loader.entries()) {
       if (entry.options.name !== MCP_CLIENT_MODULE) continue
       const config = entry.options.config
@@ -524,21 +527,60 @@ private readonly trialCaller = createTrialCaller()
       if (serverNameOf(config, `entry:${entry.options.id}`) !== serverName) continue
       if (typeof config !== 'object' || config === null || Array.isArray(config)) return undefined
       const row = config as Record<string, unknown>
-      if (row['transport'] !== 'streamable-http') return undefined
-      const url = row['url']
-      if (typeof url !== 'string' || url === '') return undefined
-      const headersValue = row['headers']
-      const headers: Record<string, string> = {}
-      if (typeof headersValue === 'object' && headersValue !== null && !Array.isArray(headersValue)) {
-        for (const [name, value] of Object.entries(headersValue as Record<string, unknown>)) {
-          if (typeof value === 'string') headers[name] = value
+      if (row['transport'] === 'streamable-http') {
+        const url = row['url']
+        if (typeof url !== 'string' || url === '') return undefined
+        const headersValue = row['headers']
+        const headers: Record<string, string> = {}
+        if (typeof headersValue === 'object' && headersValue !== null && !Array.isArray(headersValue)) {
+          for (const [name, value] of Object.entries(headersValue as Record<string, unknown>)) {
+            if (typeof value === 'string') headers[name] = value
+          }
         }
+        return { kind: 'http', url, headers }
+      }
+      if (row['transport'] === 'stdio') {
+        const command = row['command']
+        if (typeof command !== 'string' || command === '') return undefined
+        const argsValue = row['args']
+        const args: string[] = []
+        if (Array.isArray(argsValue)) {
+          for (const value of argsValue) {
+            if (typeof value !== 'string') return undefined
+            args.push(value)
+          }
+        } else if (argsValue !== undefined) return undefined
+        const envValue = row['env']
+        const env: Record<string, string> = {}
+        if (typeof envValue === 'object' && envValue !== null && !Array.isArray(envValue)) {
+          for (const [name, value] of Object.entries(envValue as Record<string, unknown>)) {
+            if (typeof value !== 'string') return undefined
+            env[name] = value
+          }
+        } else if (envValue !== undefined) return undefined
+        const cwd = row['cwd']
+        if (cwd !== undefined && (typeof cwd !== 'string' || cwd === '')) return undefined
+        return { kind: 'stdio', command, args, env, ...(typeof cwd === 'string' ? { cwd } : {}) }
       }
-      return { url, headers }
+      return undefined
     }
     return undefined
   }
 
+  /**
+   * Resolve one server's raw endpoint for the streamable-http probe path.
+   * Credentials stay inside this return value and are used for the request
+   * only — they never reach a snapshot, a log, or a display.
+   *
+   * @param serverName - configured namespace.
+   * @returns the raw URL + configured headers, or `undefined` when the server
+   *   is not a configured streamable-http row.
+   */
+  rawEndpoint(serverName: string): { url: string; headers: Record<string, string> } | undefined {
+    const spec = this.probeSpec(serverName)
+    return spec?.kind === 'http' ? { url: spec.url, headers: { ...spec.headers } } : undefined
+  }
+
   /** Unowned `mcp-probe` background jobs, newest first, sanitized for display. */
   private probeViews(): McpProbeView[] {
     const jobs = this.ctx.get('jobs')