dsh-mcp 1.0.0 → 1.2.0

package/CHANGELOG.en.md

@@ -7,6 +7,30 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.0] - 2026-08-16
+
+### Added
+
+- **OAuth authentication**: `streamable-http` servers using MCP OAuth (authorization-code + PKCE) trigger browser authorization on connect; tokens are persisted (credentials document) and refreshed automatically by the SDK (auto-renewed while active within 24h) (`lib/oauth.js`)
+
+### Fixed
+
+- OAuth token credential-ref names collided with hyphens in server ids and failed credential validation (ref names only allow `[A-Za-z_][A-Za-z0-9_]*`): refs now use a sanitized server id plus a stable short hash, avoiding illegal characters and naming collisions
+- The interactive OAuth probe budget was raised from 90 seconds to 5 minutes: the first authorization requires browser login/approval, and slower-than-90s flows caused the probe to time out and report a false failure (the authorization had actually succeeded and tokens were saved); now the test result appears automatically once authorization completes
+- Disabled servers no longer render two "Disabled" badges (the phase badge plus a redundant caption)
+- The settings page primary buttons (Add/Save) and the "Connecting" badge used theme tokens that do not exist in the web shell, breaking their text color: switched to the shell's real theme tokens (`--dsw-alias-button-primary-fill` / `--dsw-alias-label-primary-foreground` / `--dsw-alias-brand-primary`)
+
+### Improved
+
+- While testing a streamable-http server, a hint explains that a browser authorization page may open and the result refreshes automatically after it is completed
+- After saving a server, the list refreshes itself on a delay so "Connecting" settles to "Connected" once the mount is live
+
+## [1.1.0] - 2026-08-15
+
+### Added
+
+- **Tool-list stabilization**: during a same-connection re-sync (e.g. a `tools/list_changed` notification), unchanged MCP tools keep their existing registration instead of being disposed and re-registered, keeping the system-prompt tool list stable to preserve prompt-cache hits (vendored `lib/mcp-client.js` extension)
+
 ## [1.0.0] - 2026-08-15
 
 First stable release.

package/CHANGELOG.md

@@ -7,6 +7,30 @@
 格式基于 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## [1.2.0] - 2026-08-16
+
+### 新增
+
+- **OAuth 认证支持**：`streamable-http` 服务器支持 MCP OAuth（授权码 + PKCE），连接时自动打开浏览器授权；token 持久化（凭据文档）并由 SDK 自动刷新（24 小时内活跃自动续期）（`lib/oauth.js`）
+
+### 修复
+
+- OAuth token 凭据引用名与服务器名中的连字符冲突导致 `resolve` 校验失败（凭据引用名仅允许 `[A-Za-z_][A-Za-z0-9_]*`）：引用名改为清洗后的服务器名 + 稳定哈希，避免非法字符与命名碰撞
+- OAuth 交互授权探测预算从 90 秒提升到 5 分钟：首次授权需在浏览器完成登录/同意，慢于 90 秒会导致探测提前超时并误报连接失败（授权其实已成功、token 已保存），现授权完成后测试结果会自动展示
+- 禁用状态的服务器不再重复展示两个「未启用」徽标（badge 与补充文案叠加）
+- 设置页 primary 按钮（添加/保存）与「连接中」徽标使用了不存在的主题 token，导致文字颜色异常：改用 web shell 真实主题 token（`--dsw-alias-button-primary-fill` / `--dsw-alias-label-primary-foreground` / `--dsw-alias-brand-primary`）
+
+### 优化
+
+- 测试连接（streamable-http）期间提示浏览器授权：若弹出授权页，完成授权后返回，结果自动刷新
+- 保存服务器后自动延迟刷新列表状态，挂载完成后「连接中」自动变为「已连接」
+
+## [1.1.0] - 2026-08-15
+
+### 新增
+
+- **工具列表稳定化**：同一连接的 re-sync（如 `tools/list_changed` 通知）时，未变化的 MCP 工具保留原注册，不再反复注销/重注册，保持系统提示词工具列表稳定以提升 prompt cache 命中率（vendored `lib/mcp-client.js` 扩展）
+
 ## [1.0.0] - 2026-08-15
 
 首个正式版本。

package/README.en.md

@@ -1,6 +1,25 @@
-# dsh-mcp — MCP server management plugin for DeepSeek Harness (standalone)
+# dsh-mcp — MCP management UI + tool search: stable tool list, cache hits, no context bloat
 
-![Settings preview](static/snapshot.webp)
+[![dshfind](https://dshfind.com/api/badge/ArvinQi/dsh-mcp?lang=en)](https://dshfind.com/en/plugins/ArvinQi/dsh-mcp?ref=badge)
+
+![Settings preview](static/snapshot.en.webp)
+
+## Why dsh-mcp?
+
+**Problems it solves:**
+
+- **Full tool injection burns tokens**: with multiple MCP servers, the tool count can reach hundreds, and injecting all of them every request is expensive. The `search` mode lets the model hot-inject only the tools it needs via `mcp_tool_search`, saving tokens at scale.
+- **Re-syncs churn the tool list and break caches**: `tools/list_changed` notifications dispose and re-register same-named tools, jittering the system-prompt tool list and constantly invalidating the prompt cache. Tool-list stabilization keeps unchanged tools registered, maximizing cache hits.
+- **No visual management entry**: server config, enable/disable, and tool toggles used to require editing files by hand. Settings → MCP brings everything into one UI.
+
+**Highlights:**
+
+- **Visual management**: server list / create / edit / delete / test connection / enable-disable / refresh, all in the UI
+- **Fine-grained tool control**: expand each server to see its tools, all checked by default; uncheck to load only what you need
+- **Two injection modes**: `search` (on-demand, token-saving) and `full` (inject everything)
+- **Zero npm dependencies**: plugs into DeepSeek Harness internals, install and go
+- **OAuth authentication**: for `streamable-http` servers using MCP OAuth (authorization-code + PKCE), the browser opens automatically for authorization on connect; tokens are persisted and refreshed automatically by the SDK (auto-renewed while active within 24h)
+- **Three install paths**: npm / GitHub git source / local link; bilingual UI and docs
 
 Migrated and merged from uncommitted MCP work in the `deepseek-harness` repository:
 
@@ -22,6 +41,10 @@ Migrated and merged from uncommitted MCP work in the `deepseek-harness` reposito
 - **Tool control**:
   - Injection mode: `search` (on-demand, default — the model hot-injects tools via `mcp_tool_search`) and `full` (inject every enabled tool each request).
   - Expandable per-server tool list, all checked by default; unchecking a tool keeps it out of injection. Changes take effect immediately.
+- **OAuth authentication** (host, `lib/oauth.js`): on a 401 + OAuth challenge from a `streamable-http`
+  server, runs the authorization-code + PKCE flow automatically — opens the browser, receives the
+  callback on a loopback server, persists tokens, and refreshes them on demand; test connection and
+  mounts share the same token.
 - **Remote self-mount**: the client half mounts the `mcpManager` Remote namespace itself via `ctx.remote.$mount()` in `apply()`,
   so no in-box package modification is required.
 - Zero npm runtime dependencies (`@deepseek-ai/*` resolve from the DSH profiles module fallback).
@@ -33,6 +56,8 @@ dsh-mcp/
 ├── package.json          name=dsh-mcp; dsh.client declaration; zero npm dependencies
 ├── lib/
 │   ├── index.js          host half (McpManagerService, built from mcp-manager)
+│   ├── mcp-client.js     vendored MCP client (from @deepseek-ai/dsh-mcp-client, with tool-list stability extension)
+│   ├── oauth.js          MCP OAuth client provider (authorization-code + PKCE, loopback callback, token persistence)
 │   ├── probe.js          vendored connection probe (from mcp-client/src/probe.ts)
 │   ├── transport.js      vendored transport factory (from mcp-client/src/transport.ts)
 │   └── client.js         browser half (esbuild bundle, ModuleLoader wire format)
@@ -53,15 +78,17 @@ node scripts/build.mjs
 - CSS Modules are handled by an esbuild onLoad plugin: styles are injected into a
   `<style data-plugin="dsh-mcp" data-file="…">` tag, and the module default-exports an identity class-name map.
 
-## Install
+## Install & Usage
+
+### 1. Install
 
-### Option 1: npm (after publishing)
+**Option 1: npm (after publishing)**
 
 ```sh
 dsh plugin --profile web add dsh-mcp
 ```
 
-### Option 2: GitHub git source
+**Option 2: GitHub git source**
 
 ```sh
 dsh plugin --profile web add github:ArvinQi/dsh-mcp
@@ -69,7 +96,7 @@ dsh plugin --profile web add github:ArvinQi/dsh-mcp
 dsh plugin --profile web add git+https://github.com/ArvinQi/dsh-mcp.git
 ```
 
-### Option 3: local development (link)
+**Option 3: local development (link)**
 
 ```sh
 dsh plugin --profile web add link:<absolute path to this repo>
@@ -79,7 +106,7 @@ dsh plugin --profile web add link:<absolute path to this repo>
 > symlink (development-only, not committed); otherwise the linked symlink is realpath-resolved and `@deepseek-ai/*`
 > cannot be resolved.
 
-### Registration (all install options)
+### 2. Registration (all install options)
 
 Append to `$DSH_HOME/profiles/web/cordis.patch.yml` (`$DSH_HOME` defaults to `~/.dsh`):
 
@@ -92,6 +119,50 @@ Append to `$DSH_HOME/profiles/web/cordis.patch.yml` (`$DSH_HOME` defaults to `~/
 Then **restart `dsh web`** (client roster changes require a restart); afterwards hard-refresh the browser
 (`Cmd/Ctrl + Shift + R`) to load the settings page.
 
+### 3. Usage
+
+**Open the management page**: after restart, open DSH Web → **Settings → MCP**.
+
+**Add a server**:
+
+1. Click **Add server**.
+2. Fill in: server name (`serverName`, determines the tool prefix `mcp__<serverName>__`), transport
+   (`streamable-http` → URL / `stdio` → command), headers, tool-call timeout, etc.
+3. Click **Test connection** to verify connectivity and the tool list, then **Save**.
+
+**OAuth servers** (`streamable-http` using MCP OAuth, e.g. OAuth-protected gateway services):
+
+- Just fill in the URL and test the connection; when the server responds with a 401 + OAuth challenge,
+  the plugin **opens the browser automatically** for authorization.
+- Log in / approve in the browser and return to DSH; the test result refreshes automatically
+  ("connection succeeded + tool count").
+- Tokens are persisted in the credentials document (scoped by `serverName`) and refreshed automatically
+  by the MCP SDK (auto-renewed while active within 24h); after authorizing once, mounts and later
+  test connections reuse the same token — no repeated authorization.
+- The first authorization needs browser interaction, so the test/connect wait budget is relaxed to
+  5 minutes; non-OAuth servers are unaffected and fail fast.
+
+**Day-to-day management**:
+
+- **Enable / disable**: row button; disabling a server unregisters all of its tools immediately.
+- **Refresh**: re-pulls server status and the tool list (syncs new tools after a server restart).
+- **Test connection**: available in the edit form at any time.
+
+**Tool control (the key to saving tokens)**:
+
+- **Injection mode**: switch at the top of the page between `search` (on-demand, default) and `full` (inject everything).
+  - In `search` mode, the model calls `mcp_tool_search` to discover and hot-inject the MCP tools it needs.
+- **Tool toggles**: click **Expand tools** to see all tools of that server (all checked by default);
+  unchecking a tool keeps it out of injection, applied immediately without saving.
+
+**Verifying the effect**:
+
+- In any agent session, available tools include `mcp__<serverName>__<tool>`.
+- In `search` mode, tools not retrieved stay out of the system prompt, saving tokens and improving
+  prompt-cache hit rate.
+- When tool content is unchanged, `list_changed` notifications no longer dispose and re-register
+  same-named tools, keeping the tool list stable.
+
 ## Versioning notes
 
 - The host half `lib/index.js` is a **build artifact** of mcp-manager (spec/types inlined); edit the lib files
@@ -104,3 +175,5 @@ Then **restart `dsh web`** (client roster changes require a restart); afterwards
 ## Changelog
 
 See [CHANGELOG.md](CHANGELOG.md). Released under the [MIT License](LICENSE).
+
+[![dshfind](https://dshfind.com/api/card/ArvinQi/dsh-mcp?lang=en)](https://dshfind.com/en/plugins/ArvinQi/dsh-mcp?ref=badge)

package/README.md

@@ -1,15 +1,37 @@
-# dsh-mcp — MCP 服务器管理插件（独立版）
+# dsh-mcp — MCP 管理界面 + tool search：稳定工具列表、命中缓存、不撑爆上下文
 
 **[English](README.en.md) | 简体中文**
 
+[![dshfind](https://dshfind.com/api/badge/ArvinQi/dsh-mcp?lang=zh)](https://dshfind.com/zh/plugins/ArvinQi/dsh-mcp?ref=badge)
+
 ![设置页预览](static/snapshot.webp)
 
+## 为什么用 dsh-mcp？
+
+**解决的核心问题：**
+
+- **MCP 工具全量注入烧 token**：接入多个 MCP 服务器后工具可达上百个，每轮全量注入开销巨大。`search` 按需检索模式让模型通过 `mcp_tool_search` 热注入所需工具，大幅节省 token。
+- **工具列表反复更新破坏缓存**：`tools/list_changed` 通知会让同名工具被反复注销/重注册，系统提示词工具列表抖动、prompt cache 频繁失效。工具列表稳定化让未变化的工具保留原注册，最大化 cache 命中。
+- **没有可视化管理入口**：服务器配置、启停、工具勾选全靠手工改文件。Settings → MCP 一站式可视化完成。
+
+**功能优势：**
+
+- **可视化管理**：服务器列表 / 新建 / 编辑 / 删除 / 测试连接 / 启停 / 刷新，全 UI 操作
+- **工具级精细控制**：每个服务器展开工具列表，默认全选，可取消勾选只加载需要的部分
+- **双注入模式**：`search`（按需检索，省 token）与 `full`（全量注入）
+- **零 npm 依赖**：直接对接 DeepSeek Harness 内部能力，安装即用
+- **OAuth 认证支持**：`streamable-http` 服务器若走 MCP OAuth（授权码 + PKCE），连接时自动打开浏览器授权；token 持久化、由 SDK 自动刷新（24 小时内活跃自动续期）
+- **三种安装方式**：npm / GitHub git 源 / 本地 link；中英文界面与文档
+
 ## 功能
 
 - **托管 MCP 服务器注册表**（host）：持久化定义（storage-domain `mcp_servers`）、按服务器挂载
   `@deepseek-ai/dsh-mcp-client` 实例、环境变量注入（明文入定义、secret 走 credentials）、
   连接探测（test）。
 - **Web 设置管理页**（client）：Settings → MCP，列表/编辑/删除/测试服务器。
+- **OAuth 认证**（host，`lib/oauth.js`）：`streamable-http` 服务器遇 401 + OAuth 挑战时自动走
+  授权码 + PKCE 流程，打开浏览器授权、回环回调收码、token 持久化并按需自动刷新；
+  测试连接与挂载共用同一份 token。
 - **Remote 自挂载**：client 半部在 `apply()` 里自行 `ctx.remote.$mount()` 挂载 `mcpManager`
   命名空间（原实现依赖 api-remotes 的 in-box 修改，独立版不再需要任何 in-box 包改动）。
 
@@ -20,6 +42,8 @@ dsh-mcp/
 ├── package.json          name=dsh-mcp；dsh.client 声明；零 npm dependencies
 ├── lib/
 │   ├── index.js          host 半部（McpManagerService，源自 mcp-manager 构建产物）
+│   ├── mcp-client.js     vendored MCP 客户端（源自 @deepseek-ai/dsh-mcp-client，含工具列表稳定扩展）
+│   ├── oauth.js          MCP OAuth 客户端提供者（授权码 + PKCE、回环回调、token 持久化）
 │   ├── probe.js          vendored 连接探测（源自 mcp-client/src/probe.ts）
 │   ├── transport.js      vendored 传输工厂（源自 mcp-client/src/transport.ts）
 │   └── client.js         浏览器半部（esbuild 打包，ModuleLoader wire format）
@@ -41,15 +65,17 @@ node scripts/build.mjs
 - CSS Modules 由 esbuild onLoad 插件处理：样式注入
   `<style data-plugin="dsh-mcp" data-file="…">`，默认导出 identity 类名映射。
 
-## 安装
+## 安装使用
+
+### 1. 安装
 
-### 方式一：npm（发布到 npm 后）
+**方式一：npm（发布到 npm 后）**
 
 ```sh
 dsh plugin --profile web add dsh-mcp
 ```
 
-### 方式二：GitHub git 源
+**方式二：GitHub git 源**
 
 ```sh
 dsh plugin --profile web add github:ArvinQi/dsh-mcp
@@ -57,7 +83,7 @@ dsh plugin --profile web add github:ArvinQi/dsh-mcp
 dsh plugin --profile web add git+https://github.com/ArvinQi/dsh-mcp.git
 ```
 
-### 方式三：本地开发（link）
+**方式三：本地开发（link）**
 
 ```sh
 dsh plugin --profile web add link:<本仓库绝对路径>
@@ -67,7 +93,7 @@ dsh plugin --profile web add link:<本仓库绝对路径>
 > symlink（本机开发用，不入库），否则 `link:` 安装的 symlink 被 realpath 后无法解析
 > `@deepseek-ai/*`。
 
-### 注册与生效（三种方式通用）
+### 2. 注册与生效（三种方式通用）
 
 在 `$DSH_HOME/profiles/web/cordis.patch.yml`（`$DSH_HOME` 默认 `~/.dsh`）追加：
 
@@ -80,6 +106,44 @@ dsh plugin --profile web add link:<本仓库绝对路径>
 然后**重启 `dsh web`**（client roster 变更需重启）；之后浏览器硬刷新（`Cmd/Ctrl + Shift + R`）
 加载设置页。
 
+### 3. 使用
+
+**打开管理页**：重启后浏览器打开 DSH Web → **设置（Settings）→ MCP**。
+
+**添加服务器**：
+
+1. 点击「添加服务器」
+2. 填写：服务器名称（`serverName`，决定工具前缀 `mcp__<serverName>__`）、传输方式
+   （`streamable-http` 填 URL / `stdio` 填命令）、请求头、工具调用超时等
+3. 点「测试连接」确认连通性与工具列表，点「保存」
+
+**OAuth 服务器**（`streamable-http` 走 MCP OAuth，如受 OAuth 保护的网关服务）：
+
+- 只需正常填写 URL 并测试连接；服务器返回 401 + OAuth 挑战时，插件**自动打开浏览器**完成授权
+- 在浏览器中登录/同意后返回 DSH，测试结果自动刷新（「连接成功 + 工具数」）
+- token 持久化在凭据文档（按 `serverName` 隔离），由 MCP SDK 自动刷新（24 小时内活跃自动续期）；
+  授权一次后，挂载连接与后续测试连接复用同一份 token，无需重复授权
+- 首次授权需浏览器交互，测试/连接等待时间放宽至 5 分钟；非 OAuth 服务器不受影响，连接失败即时返回
+
+**日常管理**：
+
+- **启用 / 禁用**：列表行按钮，禁用后该服务器所有工具即时注销，不再注入
+- **刷新**：重新拉取服务器状态与工具列表（服务器重启后可同步新工具）
+- **测试连接**：编辑页可随时测试
+
+**工具控制（省 token 的关键）**：
+
+- **注入模式**：页面顶部切换 `search`（按需检索，默认）或 `full`（全量注入）
+  - `search` 模式下，模型需要某 MCP 工具时调用 `mcp_tool_search` 检索并热注入当前对话
+- **工具勾选**：点「展开工具」查看该服务器全部工具（默认全选），取消勾选 = 不注入该工具，
+  即时生效，无需保存
+
+**验证效果**：
+
+- 在任意 agent 会话中，可用工具应包含 `mcp__<服务器名>__<工具名>`
+- `search` 模式下未检索到的工具不占系统提示词，节省 token 并提升 prompt cache 命中率
+- 工具内容未变化时，`list_changed` 通知不会反复注销/重注册同名工具，工具列表保持稳定
+
 ## 版本注意
 
 - host 半部 `lib/index.js` 是 mcp-manager 的**构建产物**（spec/types 已内联），改动请直接编辑
@@ -87,3 +151,5 @@ dsh plugin --profile web add link:<本仓库绝对路径>
 - 浏览器半部改 `src/client/*` 后重新 `node scripts/build.mjs`；host 半部改动无需重装
   （link 安装直接生效）。
 - 配置变更（bundles 增删、新插件行）需重启 `dsh web` 才进入 client roster。
+
+[![dshfind](https://dshfind.com/api/card/ArvinQi/dsh-mcp?lang=zh)](https://dshfind.com/zh/plugins/ArvinQi/dsh-mcp?ref=badge)

package/lib/client.js

@@ -14905,7 +14905,9 @@ function emptyDraft() {
     headersText: "",
     env: [],
     toolCallTimeoutMs: String(DEFAULT_TOOL_CALL_TIMEOUT_MS),
-    failOnStartupError: false
+    // Reject the mount by default when the startup connection fails, so a
+    // broken server never registers stale tools.
+    failOnStartupError: true
   };
 }
 function draftFromServer(server) {
@@ -14969,6 +14971,20 @@ function draftToSubmission(draft) {
     }))
   };
 }
+function failureLocaleKey(code) {
+  switch (code) {
+    case "MCP_SERVER_NAME_CONFLICT":
+      return "serverNameConflict";
+    case "MCP_SERVER_NOT_FOUND":
+      return "notFound";
+    case "MCP_INVALID_SPEC":
+      return "invalidSpec";
+    case "MCP_MOUNT_FAILED":
+      return "mountFailed";
+    default:
+      return "failureTitle";
+  }
+}
 function createMcpManagerStore() {
   return (0, import_client.defineStore)({
     init: () => ({
@@ -15024,7 +15040,7 @@ function createMcpManagerStore() {
       const style = document.createElement("style");
       style.setAttribute("data-plugin", "dsh-mcp");
       style.setAttribute("data-file", "ServerForm.module.css");
-      style.textContent = ".form {\n  display: flex;\n  flex-direction: column;\n  gap: 14px;\n  width: 100%;\n  max-width: 760px;\n  color: var(--dsw-alias-label-primary);\n}\n\n.titleRow {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n}\n\n.title {\n  margin: 0;\n  font-size: 15px;\n  line-height: 22px;\n  font-weight: 600;\n}\n\n.titleActions {\n  display: flex;\n  gap: 8px;\n}\n\nbutton {\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  padding: 5px 12px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n  line-height: 20px;\n  cursor: pointer;\n}\n\nbutton:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\nbutton:focus-visible {\n  outline: 2px solid var(--dsw-alias-state-business-primary);\n  outline-offset: 1px;\n}\n\nbutton:disabled {\n  cursor: not-allowed;\n  opacity: 0.55;\n}\n\n.primary {\n  border-color: var(--dsw-alias-state-business-primary);\n  background: var(--dsw-alias-state-business-primary);\n  color: var(--dsw-alias-label-on-accent);\n}\n\n.primary:hover {\n  background: var(--dsw-alias-state-business-primary-hover);\n}\n\n.danger {\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.error {\n  margin: 0;\n  color: var(--dsw-alias-state-error-primary);\n  font-size: 13px;\n  line-height: 20px;\n}\n\n.field {\n  display: flex;\n  flex-direction: column;\n  gap: 5px;\n  font-size: 13px;\n  line-height: 20px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.field input,\n.field select,\n.field textarea {\n  width: 100%;\n  box-sizing: border-box;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 8px;\n  padding: 6px 10px;\n  outline: none;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n  resize: vertical;\n}\n\n.field input::placeholder,\n.field textarea::placeholder {\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.field input:focus-visible,\n.field select:focus-visible,\n.field textarea:focus-visible {\n  border-color: var(--dsw-alias-state-business-primary);\n  box-shadow: 0 0 0 2px color-mix(in srgb, var(--dsw-alias-state-business-primary) 18%, transparent);\n}\n\n.envBlock {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  padding: 10px 12px 12px;\n  margin: 0;\n}\n\n.envBlock legend {\n  padding: 0 4px;\n  font-size: 13px;\n  line-height: 20px;\n  font-weight: 600;\n}\n\n.hint,\n.muted {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.envRow {\n  display: grid;\n  grid-template-columns: minmax(0, 1.2fr) minmax(0, 1.6fr) auto auto;\n  align-items: center;\n  gap: 8px;\n}\n\n.envRow input {\n  box-sizing: border-box;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  padding: 5px 8px;\n  outline: none;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n}\n\n.secretToggle {\n  display: inline-flex;\n  align-items: center;\n  gap: 4px;\n  color: var(--dsw-alias-label-secondary);\n  font-size: 12px;\n  line-height: 18px;\n  white-space: nowrap;\n  cursor: pointer;\n}\n\n.checkRow {\n  display: inline-flex;\n  align-items: center;\n  gap: 8px;\n  font-size: 13px;\n  line-height: 20px;\n  color: var(--dsw-alias-label-secondary);\n  cursor: pointer;\n}\n\n.testResult {\n  margin: 0;\n  font-size: 13px;\n  line-height: 20px;\n}\n\n.testOk {\n  color: var(--dsw-alias-state-success-primary);\n}\n\n.testFail {\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.actions {\n  display: flex;\n  justify-content: flex-end;\n  gap: 8px;\n}\n";
+      style.textContent = ".form {\n  display: flex;\n  flex-direction: column;\n  gap: 14px;\n  width: 100%;\n  max-width: 760px;\n  color: var(--dsw-alias-label-primary);\n}\n\n.titleRow {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n}\n\n.title {\n  margin: 0;\n  font-size: 15px;\n  line-height: 22px;\n  font-weight: 600;\n}\n\n.titleActions {\n  display: flex;\n  gap: 8px;\n}\n\nbutton {\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  padding: 5px 12px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n  line-height: 20px;\n  cursor: pointer;\n}\n\nbutton:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\nbutton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\nbutton:disabled {\n  cursor: not-allowed;\n  opacity: 0.55;\n}\n\n.primary {\n  border-color: var(--dsw-alias-button-primary-fill);\n  background: var(--dsw-alias-button-primary-fill);\n  color: var(--dsw-alias-label-primary-foreground);\n}\n\n.primary:hover {\n  background: var(--dsw-alias-button-primary-hover);\n}\n\n.danger {\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.error {\n  margin: 0;\n  color: var(--dsw-alias-state-error-primary);\n  font-size: 13px;\n  line-height: 20px;\n}\n\n.field {\n  display: flex;\n  flex-direction: column;\n  gap: 5px;\n  font-size: 13px;\n  line-height: 20px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.field input,\n.field select,\n.field textarea {\n  width: 100%;\n  box-sizing: border-box;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 8px;\n  padding: 6px 10px;\n  outline: none;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n  resize: vertical;\n}\n\n.field input::placeholder,\n.field textarea::placeholder {\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.field input:focus-visible,\n.field select:focus-visible,\n.field textarea:focus-visible {\n  border-color: var(--dsw-alias-brand-primary);\n  box-shadow: 0 0 0 2px color-mix(in srgb, var(--dsw-alias-brand-primary) 18%, transparent);\n}\n\n.envBlock {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  padding: 10px 12px 12px;\n  margin: 0;\n}\n\n.envBlock legend {\n  padding: 0 4px;\n  font-size: 13px;\n  line-height: 20px;\n  font-weight: 600;\n}\n\n.hint,\n.muted {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.envRow {\n  display: grid;\n  grid-template-columns: minmax(0, 1.2fr) minmax(0, 1.6fr) auto auto;\n  align-items: center;\n  gap: 8px;\n}\n\n.envRow input {\n  box-sizing: border-box;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  padding: 5px 8px;\n  outline: none;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n}\n\n.secretToggle {\n  display: inline-flex;\n  align-items: center;\n  gap: 4px;\n  color: var(--dsw-alias-label-secondary);\n  font-size: 12px;\n  line-height: 18px;\n  white-space: nowrap;\n  cursor: pointer;\n}\n\n.checkRow {\n  display: inline-flex;\n  align-items: center;\n  gap: 8px;\n  font-size: 13px;\n  line-height: 20px;\n  color: var(--dsw-alias-label-secondary);\n  cursor: pointer;\n}\n\n.testResult {\n  margin: 0;\n  font-size: 13px;\n  line-height: 20px;\n}\n\n.testOk {\n  color: var(--dsw-alias-state-success-primary);\n}\n\n.testFail {\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.actions {\n  display: flex;\n  justify-content: flex-end;\n  gap: 8px;\n}\n";
       document.head.appendChild(style);
     }
   }
@@ -15034,7 +15050,7 @@ var ServerForm_default = { "form": "form", "titleRow": "titleRow", "title": "tit
 // src/client/ServerForm.tsx
 var import_jsx_runtime = require("react/jsx-runtime");
 function McpServerForm(props) {
-  const { draft, busy, testRunning, test, t, actions, injected } = props;
+  const { draft, busy, testRunning, test, t, actions, injected, onSaved } = props;
   const [saveError, setSaveError] = (0, import_react.useState)(null);
   const update = (patch) => {
     setSaveError(null);
@@ -15066,11 +15082,12 @@ function McpServerForm(props) {
     try {
       const failure = await injected.save(draft);
       if (failure !== null) {
-        setSaveError(failure.message);
+        setSaveError(t(failureLocaleKey(failure.code)));
         return;
       }
       await refresh();
       actions.cancelEdit();
+      onSaved?.();
     } catch {
       setSaveError(t("failureTitle"));
     } finally {
@@ -15285,6 +15302,7 @@ function McpServerForm(props) {
       t("enabled")
     ] }),
     test !== null ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: `${ServerForm_default.testResult} ${probe !== void 0 && probe.ok ? ServerForm_default.testOk : ServerForm_default.testFail}`, role: "status", children: probe !== void 0 && probe.ok ? `${t("testOk")} (${probe.tools.length} ${t("toolCount")}, ${test.elapsedMs}ms)` : probe !== void 0 && !probe.ok ? `${t("testFail")}: ${probe.message}` : t("testUnknown") }) : null,
+    testRunning && draft.transport === "streamable-http" ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: ServerForm_default.muted, role: "status", children: t("testBrowserHint") }) : null,
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: ServerForm_default.actions, children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", disabled: testRunning || busy !== null, onClick: () => void runTest(), children: testRunning ? t("testRunning") : t("test") }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "submit", className: ServerForm_default.primary, disabled: busy !== null || testRunning, children: busy === "save" ? t("saving") : t("save") }),
@@ -15301,7 +15319,7 @@ function McpServerForm(props) {
       const style = document.createElement("style");
       style.setAttribute("data-plugin", "dsh-mcp");
       style.setAttribute("data-file", "McpSettingsSection.module.css");
-      style.textContent = ".section {\n  display: flex;\n  flex-direction: column;\n  gap: 14px;\n  width: 100%;\n  max-width: 760px;\n  color: var(--dsw-alias-label-primary);\n}\n\n.header {\n  display: flex;\n  align-items: center;\n  justify-content: flex-end;\n}\n\n.status,\n.failure p {\n  margin: 0;\n}\n\n.status,\n.failure {\n  font-size: 13px;\n  line-height: 20px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.failure {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  color: var(--dsw-alias-state-error-primary);\n}\n\nbutton {\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  padding: 5px 12px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n  line-height: 20px;\n  cursor: pointer;\n}\n\nbutton:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\nbutton:focus-visible {\n  outline: 2px solid var(--dsw-alias-state-business-primary);\n  outline-offset: 1px;\n}\n\nbutton:disabled {\n  cursor: not-allowed;\n  opacity: 0.55;\n}\n\n.primary {\n  border-color: var(--dsw-alias-state-business-primary);\n  background: var(--dsw-alias-state-business-primary);\n  color: var(--dsw-alias-label-on-accent);\n}\n\n.primary:hover {\n  background: var(--dsw-alias-state-business-primary-hover);\n}\n\n.list {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  margin: 0;\n  padding: 0;\n  list-style: none;\n}\n\n.row {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  padding: 10px 14px;\n  background: var(--dsw-alias-bg-layer-3);\n}\n\n.rowMain {\n  display: flex;\n  flex-direction: column;\n  gap: 4px;\n  min-width: 0;\n}\n\n.rowTitle {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  min-width: 0;\n}\n\n.serverName {\n  overflow: hidden;\n  font-size: 14px;\n  line-height: 20px;\n  font-weight: 600;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n}\n\n.badge {\n  display: inline-flex;\n  align-items: center;\n  min-height: 18px;\n  border-radius: 5px;\n  padding: 1px 6px;\n  font-size: 11px;\n  line-height: 16px;\n  white-space: nowrap;\n}\n\n.badge.mounting {\n  background: color-mix(in srgb, var(--dsw-alias-state-business-primary) 12%, transparent);\n  color: var(--dsw-alias-state-business-primary);\n}\n\n.badge.live {\n  background: color-mix(in srgb, var(--dsw-alias-state-success-primary) 12%, transparent);\n  color: var(--dsw-alias-state-success-primary);\n}\n\n.badge.failed {\n  background: color-mix(in srgb, var(--dsw-alias-state-error-primary) 12%, transparent);\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.badge.stopped {\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.muted {\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.rowMeta {\n  display: flex;\n  gap: 14px;\n  color: var(--dsw-alias-label-tertiary);\n  font-size: 12px;\n  line-height: 18px;\n  font-variant-numeric: tabular-nums;\n}\n\n.rowActions {\n  flex: none;\n}\n\n.card {\n  display: flex;\n  flex-direction: column;\n  gap: 0;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  background: var(--dsw-alias-bg-layer-3);\n}\n\n.card > .row {\n  border: 0;\n  border-radius: 0;\n  background: transparent;\n}\n\n.modeRow {\n  display: flex;\n  align-items: center;\n  gap: 18px;\n  flex-wrap: wrap;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  padding: 8px 14px;\n  background: var(--dsw-alias-bg-layer-3);\n  font-size: 13px;\n  line-height: 20px;\n}\n\n.modeLabel {\n  font-weight: 600;\n}\n\n.modeOption {\n  display: inline-flex;\n  align-items: center;\n  gap: 6px;\n  cursor: pointer;\n}\n\n.modeHint {\n  margin: 0;\n  color: var(--dsw-alias-label-tertiary);\n  font-size: 12px;\n  line-height: 18px;\n}\n\n.toolPanel {\n  border-top: 1px solid var(--dsw-alias-border-l2);\n  padding: 10px 14px;\n}\n\n.toolGrid {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(230px, 1fr));\n  gap: 4px 14px;\n  max-height: 320px;\n  overflow-y: auto;\n}\n\n.toolRow {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  min-width: 0;\n  padding: 2px 0;\n  font-size: 12px;\n  line-height: 18px;\n  cursor: pointer;\n}\n\n.toolName {\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n}\n";
+      style.textContent = ".section {\n  display: flex;\n  flex-direction: column;\n  gap: 14px;\n  width: 100%;\n  max-width: 760px;\n  color: var(--dsw-alias-label-primary);\n}\n\n.header {\n  display: flex;\n  align-items: center;\n  justify-content: flex-end;\n}\n\n.status,\n.failure p {\n  margin: 0;\n}\n\n.status,\n.failure {\n  font-size: 13px;\n  line-height: 20px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.failure {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  color: var(--dsw-alias-state-error-primary);\n}\n\nbutton {\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  padding: 5px 12px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n  line-height: 20px;\n  cursor: pointer;\n}\n\nbutton:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\nbutton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\nbutton:disabled {\n  cursor: not-allowed;\n  opacity: 0.55;\n}\n\n.primary {\n  border-color: var(--dsw-alias-button-primary-fill);\n  background: var(--dsw-alias-button-primary-fill);\n  color: var(--dsw-alias-label-primary-foreground);\n}\n\n.primary:hover {\n  background: var(--dsw-alias-button-primary-hover);\n}\n\n.list {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  margin: 0;\n  padding: 0;\n  list-style: none;\n}\n\n.row {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  padding: 10px 14px;\n  background: var(--dsw-alias-bg-layer-3);\n}\n\n.rowMain {\n  display: flex;\n  flex-direction: column;\n  gap: 4px;\n  min-width: 0;\n}\n\n.rowTitle {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  min-width: 0;\n}\n\n.serverName {\n  overflow: hidden;\n  font-size: 14px;\n  line-height: 20px;\n  font-weight: 600;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n}\n\n.badge {\n  display: inline-flex;\n  align-items: center;\n  min-height: 18px;\n  border-radius: 5px;\n  padding: 1px 6px;\n  font-size: 11px;\n  line-height: 16px;\n  white-space: nowrap;\n}\n\n.badge.mounting {\n  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 12%, transparent);\n  color: var(--dsw-alias-brand-primary);\n}\n\n.badge.live {\n  background: color-mix(in srgb, var(--dsw-alias-state-success-primary) 12%, transparent);\n  color: var(--dsw-alias-state-success-primary);\n}\n\n.badge.failed {\n  background: color-mix(in srgb, var(--dsw-alias-state-error-primary) 12%, transparent);\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.badge.stopped {\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.muted {\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.rowMeta {\n  display: flex;\n  gap: 14px;\n  color: var(--dsw-alias-label-tertiary);\n  font-size: 12px;\n  line-height: 18px;\n  font-variant-numeric: tabular-nums;\n}\n\n.rowActions {\n  flex: none;\n}\n\n.card {\n  display: flex;\n  flex-direction: column;\n  gap: 0;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  background: var(--dsw-alias-bg-layer-3);\n}\n\n.card > .row {\n  border: 0;\n  border-radius: 0;\n  background: transparent;\n}\n\n.modeRow {\n  display: flex;\n  align-items: center;\n  gap: 18px;\n  flex-wrap: wrap;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  padding: 8px 14px;\n  background: var(--dsw-alias-bg-layer-3);\n  font-size: 13px;\n  line-height: 20px;\n}\n\n.modeLabel {\n  font-weight: 600;\n}\n\n.modeOption {\n  display: inline-flex;\n  align-items: center;\n  gap: 6px;\n  cursor: pointer;\n}\n\n.modeHint {\n  margin: 0;\n  color: var(--dsw-alias-label-tertiary);\n  font-size: 12px;\n  line-height: 18px;\n}\n\n.toolPanel {\n  border-top: 1px solid var(--dsw-alias-border-l2);\n  padding: 10px 14px;\n}\n\n.toolGrid {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(230px, 1fr));\n  gap: 4px 14px;\n  max-height: 320px;\n  overflow-y: auto;\n}\n\n.toolRow {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  min-width: 0;\n  padding: 2px 0;\n  font-size: 12px;\n  line-height: 18px;\n  cursor: pointer;\n}\n\n.toolName {\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n}\n";
       document.head.appendChild(style);
     }
   }
@@ -15517,7 +15535,12 @@ function McpSettingsSection(props) {
         test: state.test,
         t,
         actions,
-        injected: { save, remove, test, list }
+        injected: { save, remove, test, list },
+        onSaved: () => {
+          const serverName = state.draft.serverName;
+          timersRef.current.push(window.setTimeout(() => refreshServer(serverName), 2e3));
+          timersRef.current.push(window.setTimeout(() => refreshServer(serverName), 6e3));
+        }
       }
     );
   }
@@ -15561,7 +15584,7 @@ function McpSettingsSection(props) {
             /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: McpSettingsSection_default.rowTitle, children: [
               /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: McpSettingsSection_default.serverName, children: server.serverName }),
               /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: `${McpSettingsSection_default.badge} ${McpSettingsSection_default[server.status.phase]}`, children: t(phaseKey(server.status.phase)) }),
-              !server.enabled ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: McpSettingsSection_default.muted, children: t("statusStopped") }) : null
+              !server.enabled && server.status.phase !== "stopped" ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: McpSettingsSection_default.muted, children: t("statusStopped") }) : null
             ] }),
             /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: McpSettingsSection_default.rowMeta, children: [
               /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { children: server.transport }),
@@ -15643,6 +15666,7 @@ var zh = {
   edit: "\u7F16\u8F91",
   test: "\u6D4B\u8BD5\u8FDE\u63A5",
   testRunning: "\u6B63\u5728\u6D4B\u8BD5\u2026",
+  testBrowserHint: "\u6B63\u5728\u6D4B\u8BD5\u2026\u82E5\u5F39\u51FA\u6D4F\u89C8\u5668\u6388\u6743\u9875\uFF0C\u8BF7\u5B8C\u6210\u6388\u6743\u540E\u8FD4\u56DE\uFF0C\u7ED3\u679C\u4F1A\u81EA\u52A8\u5237\u65B0\u3002",
   testOk: "\u8FDE\u63A5\u6210\u529F",
   testFail: "\u8FDE\u63A5\u5931\u8D25",
   testUnknown: "\u672A\u77E5\u7ED3\u679C",
@@ -15715,6 +15739,7 @@ var en = {
   edit: "Edit",
   test: "Test connection",
   testRunning: "Testing\u2026",
+  testBrowserHint: "Testing\u2026 if a browser authorization page opens, complete it and return; the result refreshes automatically.",
   testOk: "Connection succeeded",
   testFail: "Connection failed",
   testUnknown: "Unknown result",

package/lib/index.js

@@ -1,7 +1,8 @@
 import { randomBytes } from "node:crypto";
 import { Service } from "@deepseek-ai/cordis";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
-import * as mcpClient from "@deepseek-ai/dsh-mcp-client";
+import * as mcpClient from "./mcp-client.js";
+import { createOAuthProvider } from "./oauth.js";
 import { probeConnection } from "./probe.js";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import z from "@deepseek-ai/schemastery";
@@ -66,19 +67,7 @@ const mcpServersDomainSpec = defineDomain({
 				message: "streamable-http requires an absolute http(s) URL"
 			});
 		}
-		const headerNames = /* @__PURE__ */ new Set();
-		row.headers.forEach((header, index) => {
-			if (headerNames.has(header.name)) ctx.addIssue({
-				code: "custom",
-				path: [
-					"headers",
-					index,
-					"name"
-				],
-				message: `duplicate header '${header.name}'`
-			});
-			headerNames.add(header.name);
-		});
+		// Same-name custom headers are allowed (matches other MCP clients).
 		const envNames = /* @__PURE__ */ new Set();
 		row.env.forEach((entry, index) => {
 			if (envNames.has(entry.name)) ctx.addIssue({
@@ -124,11 +113,10 @@ function validateServerInput(server, env) {
 		throw new McpServerValidationError("streamable-http requires an absolute http(s) URL");
 	}
 	if (!Number.isInteger(server.toolCallTimeoutMs) || server.toolCallTimeoutMs <= 0) throw new McpServerValidationError("toolCallTimeoutMs must be a positive integer");
-	const headerNames = /* @__PURE__ */ new Set();
+	// Custom headers pass through unvalidated (same-name headers are allowed,
+	// matching other MCP clients); only a blank name is rejected.
 	for (const header of server.headers) {
 		if (header.name.trim().length === 0) throw new McpServerValidationError("header names must not be blank");
-		if (headerNames.has(header.name)) throw new McpServerValidationError(`duplicate header '${header.name}'`);
-		headerNames.add(header.name);
 	}
 	const envNames = /* @__PURE__ */ new Set();
 	for (const entry of env) {
@@ -477,7 +465,13 @@ let McpManagerService = (() => {
 				let handle;
 				try {
 					const env = await this.resolveEnv(row);
-					handle = this.ctx.plugin(MCP_CLIENT_PLUGIN, this.toClientConfig(row, env));
+					// Every server gets an OAuth provider: servers that require
+					// OAuth (authorization-code flow) trigger browser auth on
+					// connect; servers that do not are unaffected. Tokens are
+					// keyed by serverName so a test-connection authorization is
+					// reused by the mount.
+					const authProvider = createOAuthProvider(row.serverName, this.ctx);
+					handle = this.ctx.plugin(MCP_CLIENT_PLUGIN, { ...this.toClientConfig(row, env), authProvider });
 				} catch (error) {
 					entry.phase = "failed";
 					entry.error = errorText(error);
@@ -691,7 +685,13 @@ let McpManagerService = (() => {
 				}
 			} else if (entry.value !== void 0) env[entry.name] = entry.value;
 			const startedAt = Date.now();
-			const probe = await probeConnection(this.toClientConfig(request.server, env), { timeoutMs: this.probeTimeoutMs });
+			// Test connection also supports OAuth: an OAuth-protected server
+			// opens the browser for authorization and the probe continues after
+			// tokens are stored (keyed by serverName, matching the mount path).
+			const probe = await probeConnection(this.toClientConfig(request.server, env), {
+				timeoutMs: this.probeTimeoutMs,
+				authProvider: createOAuthProvider(request.server.serverName, this.ctx)
+			});
 			const elapsedMs = Date.now() - startedAt;
 			return {
 				ok: true,